i configured as first authentication Radius.
The second authentication is LDAP.
On the realm the directory/attribute = LDAP
I put into the Authentication server to following settings:
user filter base dn ou=<groupname> DC=<domain name>
filter = saMAccountName=<USER>
member attribute = member
Search all groups
I make a role mapping based on a LDAP group lets take portalusers
When I log in with a user (who's member of the group portalusers) It works fine.
When I log in with an other user (who is also member of the group portaluser). I got no roles applied.
I test it with only LDAP authentication, then It works fine.
Does anyone seen this before?
When I change the user filter from filter = saMAccountName=<USER> to cn =<USER> I got the same issue
Solved! Go to Solution.
The problem was the following. There LDAP is realy **bleep**ed! For some users whe must do a samAccountname and for the other memberOf
What I did, with Juniper Support was to make userattributes
The problem for this was, I didn;t have a userattribute MemberOf.
We made the userattribute and configured custom expressions
With testing for a lot of users and everything works fine
When I do a policy trace, I see the user isn't a member of the AD group. But he is a member of that group.......
When I look into the policy trace I see the Juniper tries to do the first username to authenticatie on LDAP. After it, The Juniper tries to authenticate the second username on LDAP. So yes he tries also to authenticate with the second username
The user is a direct member of the goup portalusers
So this wasnt an issue of one user can login and another can't it was that if a user is specified "usernam is" LDAP login worked great. But my issue was that I could not specify groups. Anywho, I figured out what the issue was.
Quit simple really.
In role mapping I overlooked the update button. Silly design and silly me really.
So when you creat a new role and click the drop down to select "Rule is based on:" and click "Group Memebership" you have to click update button to view available groups and from there you can create groups. : ' )
As long as your LDAP look ups are working your DN info should populate.