This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Unusual Web Logging

Hello,

Can anyone translate this persistent weblog, it is not stopping, im afraid it will consume the ASG 425 hardware resources.

Thanks

sub="http" request="0xeb0700c0" function="auth_adir_auth_crap_callback" file="auth_adir.c" line="887" message="Authorization denied (NT_STATUS_NO_SUCH_USER)"
2011:03:12-11:35:40 astaro httpproxy[12066]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0xeb0700c0" function="auth_adir_auth_crap_callback" file="auth_adir.c" line="887" message="Authorization denied (NT_STATUS_NO_SUCH_USER)"
2011:03:12-11:35:40 astaro httpproxy[12066]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0xeb0700c0" function="auth_adir_auth_crap_callback" file="auth_adir.c" line="887" message="Authorization denied (NT_STATUS_NO_SUCH_USER)"

This thread was automatically locked due to age.

0 BAlfson over 14 years ago

Hi, Aldahan. Please remember to be precise about versions. This looks like an Active Directory SSO issue - is this Server 2008-R2?

In any case, in the past, this problem was fixed by changing the proxy configuration in the users' browsers. If you have an IP adddress, NTLM is used. When you use the internal FQDN of the Astaro instead, Kerberos is used. Force authorization by Kerberos, and you should have no such problem.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 aldahan over 14 years ago in reply to BAlfson

Hi, Aldahan.  Please remember to be precise about versions.  This looks like an Active Directory SSO issue - is this Server 2008-R2?

In any case, in the past, this problem was fixed by changing the proxy configuration in the users' browsers.  If you have an IP adddress, NTLM is used.  When you use the internal FQDN of the Astaro instead, Kerberos is used.  Force authorization by Kerberos, and you should have no such problem.

Cheers - Bob

Im sorry for the less information, our AD is 2K8 not R2, ASG 425 Ver 8.101, just change the PAC file to FQDN of our webproxy and change the GPO to FQDN for the IE web browser settings, but still we face this issue, it is related to some users  trying to pass the astaro that doesnt belong to a group insider astaro, because we cannot sync the "Domain Users Group" to be prefetched by the astaro.
Cancel
Vote Up 0 Vote Down

Cancel
0 aldahan over 14 years ago

Now another problem arised as of this time, authentication pop up windows suddenly appear, but when you enter the username and password, it will not work, even changing the browers to FQDN, the authentication failed, but when i change the PAC file settings to IP address, the web browsing works!, this 8.102 have a lot of bugs or im missing something in our config.
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 14 years ago

These do sound like configuration issues.

AD-SSO only works for internal users logged into your Windows domain. SSO in not related to any AD server you might have defined on the 'Server' tab of 'Users - Authentication', so SSO also is not related to pre-fetch.

An authentication window pops up because the user has the browser configured to use the Astaro HTTP/S Proxy, and the user is in a network for which the proxy is in 'Basic user authentication' mode. The other way the user sees an authorization pop-up is if his browser is not configured to use the proxy, and is in a network in the 'Transparent with authentication' mode.

If using the FQDN doesn't work, it could be because you don't have an internal definition for that, and the user is getting name resolution from public DNS.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel