Showing results for 
Search instead for 
Did you mean: 

SA6500-FIPS running IVE 6.4r1 Kerberos issue

Occasional Contributor

SA6500-FIPS running IVE 6.4r1 Kerberos issue

We have just configured our 6.4r1 OS using a Active Directory/Windows NT auth server.  This has been running fine for a few weeks now and allowing users to authenticate against the AD based on group lookups.

However today the SA's were rebooted and since the reboot users are unable to log in.  Tracing the issue it appears that the computer location being requested/sent by Junipers is incorrect.  Our computers are stored in CN=computers, dc=company,dc=domain,dc=com (as an example!)

On a TCPDump the Juniper is trying to access OU=CN=computers, dc=company,dc=domain,dc=com, which of course is invalid, and being rejected by the AD.

If I remove the CN= from CN=computers, then Juniper requests ou=computers, dc=company,dc=domain,dc=com - basically it is sticking the ou= on the front of the syntax.

Any ideas?

Production: Clustered SA6500-FIPS running 6.5r2
Development: Single SA2000 running 7.1r1