Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 11 replies
  • Subscribers 1 subscriber
  • Views 4831 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Remote AD SSO keeps failing

cthorpe
I'm having AD SSO issues where our new Sophos 120 units at our branch offices in NY and FLA keep disconnecting from our primary AD server in AZ and because of that, our users there are getting pop-ups for authentication.  To resolve this issue I had to re-join the domain and it'll work for 3 to 4 hours and then it breaks again.

We have Win2008 R2 RODC servers at both locations under one domain name.

The Sophos units are all connected via Site to Site VPN (IPSEC - AES256). MTU Discovery is checked at all remote gateways.

We have an older Astaro 320 here at the main office in AZ.  All units are on 8.306 (Can't wait for v9 to come out)

The web filter log shows this when users can not authenticate: (this log also appears on the FLA unit as well)

AD SSO works well at the AZ site and I'm guessing there might be some tweaking that needs to be done on the VPN side?

2012:09:13-17:02:23 ny01-proxy httpproxy[6205]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0x9d432f8" function="auth_adir_auth_crap_callback" file="auth_adir.c" line="888" message="Authorization denied (NT_STATUS_NO_TRUST_SAM_ACCOUNT)"
2012:09:13-17:02:23 ny01-proxy httpproxy[6205]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="192.168.1.252" dstip="" user="Administrator" statuscode="407" cached="0" profile="REF_HttProBlockUsersProfi (Blocked Users Profiles)" filteraction=" ()" size="4593" request="0x9d432f8" url="www.yahoo.com/" exceptions="" error=""
2012:09:13-17:03:02 ny01-proxy httpproxy[6205]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0x9d432f8" function="auth_adir_auth_crap_callback" file="auth_adir.c" line="888" message="Authorization denied (NT_STATUS_NO_TRUST_SAM_ACCOUNT)"
2012:09:13-17:03:02 ny01-proxy httpproxy[6205]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="192.168.1.252" dstip="" user="administrator" statuscode="407" cached="0" profile="REF_HttProBlockUsersProfi (Blocked Users Profiles)" filteraction=" ()" size="4593" request="0x9d432f8" url="www.yahoo.com/" exceptions="" error=""
2012:09:13-17:05:37 ny01-proxy httpproxy[6205]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0x9d43898" function="auth_adir_auth_crap_callback" file="auth_adir.c" line="888" message="Authorization denied (NT_STATUS_NO_TRUST_SAM_ACCOUNT)"
2012:09:13-17:05:37 ny01-proxy httpproxy[6205]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="192.168.1.252" dstip="" user="cthorpe" statuscode="407" cached="0" profile="REF_HttProBlockUsersProfi (Blocked Users Profiles)" filteraction=" ()" size="4593" request="0x9d43898" url="www.yahoo.com/" exceptions="" error=""
2012:09:13-17:05:44 ny01-proxy httpproxy[6205]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0x9d43e38" function="auth_adir_auth_crap_callback" file="auth_adir.c" line="888" message="Authorization denied (NT_STATUS_NO_TRUST_SAM_ACCOUNT)"
2012:09:13-17:05:44 ny01-proxy httpproxy[6205]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="CONNECT" srcip="192.168.1.252" dstip="" user="Administrator" statuscode="407" cached="0" profile="REF_HttProBlockUsersProfi (Blocked Users Profiles)" filteraction=" ()" size="4612" request="0x9d43e38" url="versioncheck.addons.mozilla.org/" exceptions="" error=""
2012:09:13-17:05:44 ny01-proxy httpproxy[6205]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0x9d47478" function="auth_adir_auth_crap_callback" file="auth_adir.c" line="888" message="Authorization denied (NT_STATUS_NO_TRUST_SAM_ACCOUNT)"
2012:09:13-17:05:44 ny01-proxy httpproxy[6205]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="CONNECT" srcip="192.168.1.252" dstip="" user="Administrator" statuscode="407" cached="0" profile="REF_HttProBlockUsersProfi (Blocked Users Profiles)" filteraction=" ()" size="4608" request="0x9d47478" url="services.addons.mozilla.org/" exceptions="" error=""


This thread was automatically locked due to age.
Parents
  • 0
    Here is the web filtering log and our users are getting the authentication pop-up.

    The one thing I keep reading on this forum is to reboot the Astaro to restart the winbindd which I will
    give it a try later in the day.

    2012:09:26-12:23:01 fla01-proxy httpproxy[12128]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0x8aa7030" function="auth_adir_getsid_callback" file="auth_adir.c" line="518" message="winbindd request failed ()"
    2012:09:26-12:23:01 fla01-proxy httpproxy[12128]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="x.x.x.x" dstip="" user="mprado" statuscode="407" cached="0" profile="REF_HttProBlockUsersProfi (Blocked Users Profiles)" filteraction=" ()" size="4635" request="0x8aa7030" url="crl.microsoft.com/.../microsoftrootcert.crl" exceptions="av,fileextension" error=""
    2012:09:26-12:23:02 fla01-proxy httpproxy[12128]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0x8aa75d0" function="auth_adir_getsid_callback" file="auth_adir.c" line="518" message="winbindd request failed ()"
    2012:09:26-12:23:02 fla01-proxy httpproxy[12128]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="x.x.x.x" dstip="" user="mprado" statuscode="407" cached="0" profile="REF_HttProBlockUsersProfi (Blocked Users Profiles)" filteraction=" ()" size="4630" request="0x8aa75d0" url="crl.microsoft.com/.../CodeSignPCA2.crl" exceptions="av,fileextension" error=""
    2012:09:26-12:23:02 fla01-proxy httpproxy[12128]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0x8aa78a0" function="auth_adir_getsid_callback" file="auth_adir.c" line="518" message="winbindd request failed ()"
    2012:09:26-12:23:02 fla01-proxy httpproxy[12128]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="x.x.x.x" dstip="" user="mprado" statuscode="407" cached="0" profile="REF_HttProBlockUsersProfi (Blocked Users Profiles)" filteraction=" ()" size="4624" request="0x8aa78a0" url="crl.microsoft.com/.../WinPCA.crl" exceptions="av,fileextension" error=""
    2012:09:26-12:23:02 fla01-proxy httpproxy[12128]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0x8a1a028" function="auth_adir_getsid_callback" file="auth_adir.c" line="518" message="winbindd request failed ()"
    2012:09:26-12:23:02 fla01-proxy httpproxy[12128]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="x.x.x.x" dstip="" user="mprado" statuscode="407" cached="0" profile="REF_HttProBlockUsersProfi (Blocked Users Profiles)" filteraction=" ()" size="4626" request="0x8a1a028" url="mscrl.microsoft.com/.../mswww(5).crl" exceptions="av,fileextension" error=""
    2012:09:26-12:23:02 fla01-proxy httpproxy[12128]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0x8a1a730" function="auth_adir_getsid_callback" file="auth_adir.c" line="518" message="winbindd request failed ()"
    2012:09:26-12:23:02 fla01-proxy httpproxy[12128]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="x.x.x.x" dstip="" user="mprado" statuscode="407" cached="0" profile="REF_HttProBlockUsersProfi (Blocked Users Profiles)" filteraction=" ()" size="4681" request="0x8a1a730" url="ctldl.windowsupdate.com/.../disallowedcertstl.cab
Reply
  • 0
    Here is the web filtering log and our users are getting the authentication pop-up.

    The one thing I keep reading on this forum is to reboot the Astaro to restart the winbindd which I will
    give it a try later in the day.

    2012:09:26-12:23:01 fla01-proxy httpproxy[12128]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0x8aa7030" function="auth_adir_getsid_callback" file="auth_adir.c" line="518" message="winbindd request failed ()"
    2012:09:26-12:23:01 fla01-proxy httpproxy[12128]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="x.x.x.x" dstip="" user="mprado" statuscode="407" cached="0" profile="REF_HttProBlockUsersProfi (Blocked Users Profiles)" filteraction=" ()" size="4635" request="0x8aa7030" url="crl.microsoft.com/.../microsoftrootcert.crl" exceptions="av,fileextension" error=""
    2012:09:26-12:23:02 fla01-proxy httpproxy[12128]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0x8aa75d0" function="auth_adir_getsid_callback" file="auth_adir.c" line="518" message="winbindd request failed ()"
    2012:09:26-12:23:02 fla01-proxy httpproxy[12128]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="x.x.x.x" dstip="" user="mprado" statuscode="407" cached="0" profile="REF_HttProBlockUsersProfi (Blocked Users Profiles)" filteraction=" ()" size="4630" request="0x8aa75d0" url="crl.microsoft.com/.../CodeSignPCA2.crl" exceptions="av,fileextension" error=""
    2012:09:26-12:23:02 fla01-proxy httpproxy[12128]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0x8aa78a0" function="auth_adir_getsid_callback" file="auth_adir.c" line="518" message="winbindd request failed ()"
    2012:09:26-12:23:02 fla01-proxy httpproxy[12128]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="x.x.x.x" dstip="" user="mprado" statuscode="407" cached="0" profile="REF_HttProBlockUsersProfi (Blocked Users Profiles)" filteraction=" ()" size="4624" request="0x8aa78a0" url="crl.microsoft.com/.../WinPCA.crl" exceptions="av,fileextension" error=""
    2012:09:26-12:23:02 fla01-proxy httpproxy[12128]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0x8a1a028" function="auth_adir_getsid_callback" file="auth_adir.c" line="518" message="winbindd request failed ()"
    2012:09:26-12:23:02 fla01-proxy httpproxy[12128]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="x.x.x.x" dstip="" user="mprado" statuscode="407" cached="0" profile="REF_HttProBlockUsersProfi (Blocked Users Profiles)" filteraction=" ()" size="4626" request="0x8a1a028" url="mscrl.microsoft.com/.../mswww(5).crl" exceptions="av,fileextension" error=""
    2012:09:26-12:23:02 fla01-proxy httpproxy[12128]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0x8a1a730" function="auth_adir_getsid_callback" file="auth_adir.c" line="518" message="winbindd request failed ()"
    2012:09:26-12:23:02 fla01-proxy httpproxy[12128]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="x.x.x.x" dstip="" user="mprado" statuscode="407" cached="0" profile="REF_HttProBlockUsersProfi (Blocked Users Profiles)" filteraction=" ()" size="4681" request="0x8a1a730" url="ctldl.windowsupdate.com/.../disallowedcertstl.cab
Children
No Data