Role mapping broke when appending domain to username

[SF_Dan_]

Setup:

SA6500 System Version
7.2R4 (build 21697)

Pulse version 3.0.4.25005

Problem:

The user realm is currently configured to use Identikey for Authentication and LDAP(Active Directory) for Directory/Attribute. I have role mapping based on active directory groups. The problem is when the user appends the domain to their username role mapping no longer functions.

Example -

User name = ABC

Domain = domain.loc

Works - User enters their username ABC and their password+token and role mapping works fine.

Doesn't work - User enters their username+domain([email protected]) and password+token and Active Directory group role mapping does not work.

Logs when working:

As you can see it authenticates successfully and then moves on to getting directory information. In the screenshot below when using the username with domain appended you will see it stops at the "Requesting more sign-in prompts"

Logs when broke -

The user will get connected with the last default role but all other role rules based on active directory group memberships do not work. Any help would be appreciated.

Thanks,

Dan

[SF_Dan_]

Thanks, SVK, that worked perfect!

[SF_Dan_]

Update:

I may be on to something, in my authentication server I see I am filtering users using sAMAccountName=<USERNAME>. The sAMAccountName attribute does not contain the @domain.loc so that may be why it is not working. I am still troubleshooting and testing but still welcome input.

thanks,

Dan

[SF_Dan_]

The above post is indeed the problem. If I tell it to use userPrincipalName instead of sAMAccountName it works when appending the domain but then doesn't work when not appending it. This is a problem as we have some people that append the domain and some that do not.

Is there any other variables or logic you can use in the ldap user filter?

thanks,

Dan

[SVK_ · Accepted solution]

Hi Dan,

in case if you want to use either the Samaccountname or userprincipalname the filter that you should be configuring under LDAP auth server instance under finding user entries is

(|(userprincipalname=<USER>)(sAMAccountName=<user>))

Refer the following KB and this should help you

http://kb.pulsesecure.net/kb16686

Regards,

SVK