Hello,
We've a problem with SSO not working:
When the proxy is set on our terminal server, all requests go to fallback settings.
It's irrelevant if i use the IP of the astaro or forcing KERBEROS by using FQDN.
In the webfilter-log it shows the block-entry with username specified and that it uses fallback-filter-settings.
The Webfilter is in transparent mode on the basic settings but we've created a proxy-setting which filters out everything coming from our terminal-server.
The filter is set to be apllied to all users from the AD-backend in a first basic step.
Later it should also filter on group memberships.
I've set up the astaro mainly as described here:
https://support.astaro.com/support/i...ss_with_AD-SSO
Differences:
I don't use a domain-admin for the authentication-server. it's a simple domain-user in the users group.
My BaseDN is clean.
Access to AD-DC goes through a secondary firewall, but i monitored all ports during the setup process and set them allowed and it doesn't make a difference when i set all ports to allowed even in both directions.
When doing the test-authentication in the server setup it works.
When trying to authenticate on the user-portal it fails and generates an entry in the authentication log with denied even if i use the user that works in auth-server-setup.
When trying pass-through i get no entry in auth-log.
All times the log on the secondary firewall shows one access to ldap-port on DC and it's allowed.
Client-Auth is set to be allowed from the terminal-server and for all users from the AD-backend.
Automatic user creation is enabled for web-filter, client-auth and user-portal.
AD-DC and TerminalServer are both WindowsServer 2008R2.
DNS-route is set, hostname of the astaro is with domain-extension and registered in the domain-dns.
First thanks for reading through all this.
Hope someone knows a trick...
We've a problem with SSO not working:
When the proxy is set on our terminal server, all requests go to fallback settings.
It's irrelevant if i use the IP of the astaro or forcing KERBEROS by using FQDN.
In the webfilter-log it shows the block-entry with username specified and that it uses fallback-filter-settings.
The Webfilter is in transparent mode on the basic settings but we've created a proxy-setting which filters out everything coming from our terminal-server.
The filter is set to be apllied to all users from the AD-backend in a first basic step.
Later it should also filter on group memberships.
I've set up the astaro mainly as described here:
https://support.astaro.com/support/i...ss_with_AD-SSO
Differences:
I don't use a domain-admin for the authentication-server. it's a simple domain-user in the users group.
My BaseDN is clean.
Access to AD-DC goes through a secondary firewall, but i monitored all ports during the setup process and set them allowed and it doesn't make a difference when i set all ports to allowed even in both directions.
When doing the test-authentication in the server setup it works.
When trying to authenticate on the user-portal it fails and generates an entry in the authentication log with denied even if i use the user that works in auth-server-setup.
When trying pass-through i get no entry in auth-log.
All times the log on the secondary firewall shows one access to ldap-port on DC and it's allowed.
Client-Auth is set to be allowed from the terminal-server and for all users from the AD-backend.
Automatic user creation is enabled for web-filter, client-auth and user-portal.
AD-DC and TerminalServer are both WindowsServer 2008R2.
DNS-route is set, hostname of the astaro is with domain-extension and registered in the domain-dns.
First thanks for reading through all this.
Hope someone knows a trick...