Products
Solutions
Partners
Support
Company
Try Now
Pulse Secure Community
Help
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 

AD 2008 and Groups issue

Michael_kadmiel_
Occasional Contributor
‎03-12-2009 02:18:PM
‎03-12-2009 02:18:PM

AD 2008 and Groups issue

We are now in the middle of Implementing role mappings based on AD Global security groups under the the CN=Domain Users.

In the role mapping I chose groups and was able to search for and ad the groups. If found them with out a problem. However, It wouldn't allow a member of any of the groups to login.

I had to create a role mapping based on username. If anyone has any Ideas I'd be greatly appreciative. I know that 6.4 is coming out end of this month, but I'm sure I'm not the only one who's had a problem.

Thanks

Michael :smileyhappy:

Kudos!
0 Kudos
9 REPLIES 9
Mrkool_
Super Contributor
‎03-12-2009 03:20:PM
‎03-12-2009 03:20:PM

Re: AD 2008 and Groups issue

what does the policy trace show?
0 Kudos
Michael_kadmiel_
Occasional Contributor
‎03-12-2009 11:16:PM
‎03-12-2009 11:16:PM

Re: AD 2008 and Groups issue

Hi Thanks for answering. The policy tracer shows the following:

Info
PTR23328
2009/03/13 07:31:37 - michael(iveadmin)[] - User "michael" starting sign-in to realm iveadmin
Info
PTR23333
2009/03/13 07:31:37 - michael(iveadmin)[] - Sign-in prompt username = "michael"
Info
PTR23370
2009/03/13 07:31:37 - michael(iveadmin)[] - Attempting to authenticate user "michael" with auth server "mead01-LDAP"
Info
PTR23344
2009/03/13 07:31:37 - [84.229.114.30] - michael(iveadmin)[] - Authentication successful to auth server "mead01-LDAP"
Info
PTR10270
2009/03/13
07:31:37 - [84.229.114.30] - michael(iveadmin)[] - Checking membership
to static group CN=iveadmin,CN=Users,DC=me-corp,DC=lan
Info
PTR23382
2009/03/13 07:31:37 - [84.229.114.30] - michael(iveadmin)[] - User is not member of group 'iveadmin'
Info
PTR23345
2009/03/13
07:31:37 - [84.229.114.30] - michael(iveadmin)[] - Retrieved directory
information from auth server "mead01-LDAP"
Info
PTR23344
2009/03/13
07:31:37 - [84.229.114.30] - michael(iveadmin)[] - Authentication
successful to auth server "[Unknown Server]"
Info
PTR10209
2009/03/13 07:31:37 - [84.229.114.30] - michael(iveadmin)[] - Realm iveadmin running 1 mapping rules for user michael
Info
PTR10305
2009/03/13 07:31:37 - [84.229.114.30] - michael(iveadmin)[] - Variable user = "michael"
Info
PTR10305
2009/03/13 07:31:37 - [84.229.114.30] - michael(iveadmin)[] - Variable password = "****"
Info
PTR10305
2009/03/13 07:31:37 - [84.229.114.30] - michael(iveadmin)[] - Variable userName = "michael"
Info
PTR10305
2009/03/13 07:31:37 - [84.229.114.30] - michael(iveadmin)[] - Variable protocol =
Info
PTR10305
2009/03/13 07:31:37 - [84.229.114.30] - michael(iveadmin)[] - Variable realm = "iveadmin"
Info
PTR10305
2009/03/13 07:31:37 - [84.229.114.30] - michael(iveadmin)[] - Variable loginTime = Fri Mar 13 07:31:37 2009
Info
PTR10305
2009/03/13 07:31:37 - [84.229.114.30] - michael(iveadmin)[] - Variable userAttr.cn = "Domain Users"
Info
PTR10305
2009/03/13 07:31:37 - [84.229.114.30] - michael(iveadmin)[] - Variable userAttr.sAMAccountName = "Domain Users"
Info
PTR10305
2009/03/13 07:31:37 - [84.229.114.30] - michael(iveadmin)[] - Variable groups =
Info
PTR10305
2009/03/13 07:31:37 - [84.229.114.30] - michael(iveadmin)[] - Variable loginURL = "*/"
Info
PTR10305
2009/03/13 07:31:37 - [84.229.114.30] - michael(iveadmin)[] - Variable loginHost = "secure.mobileye.com"
Info
PTR10305
2009/03/13 07:31:37 - [84.229.114.30] - michael(iveadmin)[] - Variable networkIF = "external"
Info
PTR10305
2009/03/13 07:31:37 - [84.229.114.30] - michael(iveadmin)[] - Variable userDN.CN = "Domain Users"
Info
PTR10305
2009/03/13 07:31:37 - [84.229.114.30] - michael(iveadmin)[] - Variable userDN.CN = "Users"
Info
PTR10305
2009/03/13 07:31:37 - [84.229.114.30] - michael(iveadmin)[] - Variable userDN.DC = "me-corp"
Info
PTR10305
2009/03/13 07:31:37 - [84.229.114.30] - michael(iveadmin)[] - Variable userDN.DC = "lan"
Info
PTR10305
2009/03/13
07:31:37 - [84.229.114.30] - michael(iveadmin)[] - Variable userDNText
= "CN=Domain Users,CN=Users,DC=me-corp,DC=lan"
Info
PTR10305
2009/03/13 07:31:37 - [84.229.114.30] - michael(iveadmin)[] - Variable [email protected] = "michael"
Info
PTR10305
2009/03/13 07:31:37 - [84.229.114.30] - michael(iveadmin)[] - Variable [email protected] = "****"
Info
PTR10305
2009/03/13 07:31:37 - [84.229.114.30] - michael(iveadmin)[] - Variable [email protected] = "Domain Users"
Info
PTR10305
2009/03/13 07:31:37 - [84.229.114.30] - michael(iveadmin)[] - Variable [email protected] = "Users"
Info
PTR10305
2009/03/13 07:31:37 - [84.229.114.30] - michael(iveadmin)[] - Variable [email protected] = "me-corp"
Info
PTR10305
2009/03/13 07:31:37 - [84.229.114.30] - michael(iveadmin)[] - Variable [email protected] = "lan"
Info
PTR10305
2009/03/13
07:31:37 - [84.229.114.30] - michael(iveadmin)[] - Variable
[email protected] = "CN=Domain Users,CN=Users,DC=me-corp,DC=lan"
Info
PTR10305
2009/03/13 07:31:37 - [84.229.114.30] - michael(iveadmin)[] - Variable group.iveadmin = false
Info
PTR10305
2009/03/13 07:31:37 - [84.229.114.30] - michael(iveadmin)[] - Variable [email protected] = "Domain Users"
Info
PTR10305
2009/03/13
07:31:37 - [84.229.114.30] - michael(iveadmin)[] - Variable
[email protected] = "Domain Users"
Info
PTR10305
2009/03/13 07:31:37 - [84.229.114.30] - michael(iveadmin)[] - Variable [email protected] =
Info
PTR10305
2009/03/13 07:31:37 - [84.229.114.30] - michael(iveadmin)[] - Variable cacheCleanerStatus = false
Info
PTR10218
2009/03/13 07:31:37 - [84.229.114.30] - michael(iveadmin)[] - No match on rule 'groups = 'iveadmin''
Info
PTR10207
2009/03/13 07:31:37 - [84.229.114.30] - michael(iveadmin)[] - Realm iveadmin did not map user michael to any roles
Info
PTR23334
2009/03/13 07:31:37 - [84.229.114.30] - michael(iveadmin)[] - Sign-in rejected. Reason: NoRoles
Info
PTR10104
2009/03/13
07:32:07 - [84.229.114.30] - admin(Admin Users)[.Administrators] -
michael:iveadmin - Policy Tracing turned off

Michael

0 Kudos
pkc_
Contributor
‎03-17-2009 02:11:AM
‎03-17-2009 02:11:AM

Re: AD 2008 and Groups issue

Hi,

According to the log, it looks like the device doesn't get the correct list of groups.

Could you please check if the groupsworks fine if you use LDAP instead of active directory ? (with the same server).

0 Kudos
Michael_kadmiel_
Occasional Contributor
‎03-17-2009 03:47:AM
‎03-17-2009 03:47:AM

Re: AD 2008 and Groups issue

The server you see in the logs is already a LDAP server type. We did this because we understood that 2008 is not supported until end of 03/09.

Is there a possibility we are using the filters incorrectly?

we have the base dn set dc=me-corp,dc=lan

filter cn=Domain Users

I set nesting to 3, where the groups we are looking for are in the cn=Users container. If i go to server catalog and search, I find them as cn=iveadmin,cn=Users,dc=me-corp,dc=lan.

0 Kudos
pkc_
Contributor
‎03-17-2009 05:13:AM
‎03-17-2009 05:13:AM

Re: AD 2008 and Groups issue

In the config I'm using, the group filter is set as below :

cn=<GROUPNAME>

Can you try this with 0 as nested group level ?

You can also run a network trace vs port 389 to gte the detail of the ldap request that is sent.

Some tools like ldapsearch or an ldapbrowser on windows can also be useful.

0 Kudos
PVP_
Occasional Contributor
‎03-18-2009 02:46:PM
‎03-18-2009 02:46:PM

Re: AD 2008 and Groups issue

The trace suggests User is not member of group 'iveadmin' . If the user is, can you check if the iveadmin is a Primary Group for this user, Can you make some other group a Primary group and try again?

Thanks.

0 Kudos
Michael_kadmiel_
Occasional Contributor
‎03-18-2009 11:46:PM
‎03-18-2009 11:46:PM

Re: AD 2008 and Groups issue

thanks for the reply,

the user is a member of serveral groups. I thought about that at one point and in fact set his primary group to iveadmin.

I got the same results. I thought maybe I hadn't set the nested depth. So i did to 4 but it didn't make any difference. Has anyone succeeded to do this with AD2008?

I understand that 6.4 is out in 2weeks (I hope ) and there should be support for AD2008.

0 Kudos
PVP_
Occasional Contributor
‎03-19-2009 07:06:AM
‎03-19-2009 07:06:AM

Re: AD 2008 and Groups issue

6.4 does have the support for AD 2008 on the SA device as AD Authentication Instance. But I have seen positive reports of LDAP Auth Instance against AD 2008 work pre 6.4.

In my previous comment, I meant to "NOT HAVE" iveadmin as the primary group for the user. LDAP group lookup fails for PrimaryGroup and one has to use LDAP Attribute PrimaryGroupID . KB2527 on Juniper support site will help for the LDAP Attribute setup.

Thanks.

0 Kudos
stine_
Super Contributor
‎03-21-2009 09:15:PM
‎03-21-2009 09:15:PM

Re: AD 2008 and Groups issue

I have an IVE (6.3r3) authenticating against Windows Server 2008, I have been unable to make it work using an account other that administrator, but it does work. Here is my config. It allows for user password resets via the IVE (one failing is that in order for you to use <username> and <password> in terminal services, the user must log off and back on after changing their password)

Name: AUTH-SERVER-NAME
LDAP Server: my2k8ad.mysubdomain.mydomain.mytld

LDAP Port: 636
LDAP Server Type: Active Directory
Connection:
Unencrypted x LDAPS Start TLS

Connection Timeout: 15
Search Timeout: 60

Authentication required?

x Authentication required to search LDAP

Admin DN: cn=administrator,cn=users,dc=mysubdomain,dc=mydomain,dc=mytld
Password: ********

Finding user entries

Base DN: dc=mysubdomain,dc=mydomain,dc=mytld
Filter: samaccountname=<username>

Determining group membership

Base DN: dc=mysubdomain,dc=mydomain,dc=mytld
Filter: cn=<GROUPNAME>

Member Attribute: memberOf
x Reverse group search
Nested Group Level: 4
Nested Group Search:
x Search all nested groups

stine

JNCIA-ER

0 Kudos
© 2017 Pulse Secure, LLC. Use of this website assumes acceptance of our Legal Notices and Privacy Policy. Pulse Secure has updated its Privacy Policy effective June 28, 2017.