topic Re: Problem with Group Mapping Settings in General Topics

Problem with Group Mapping Settings

hamza_ineos — Mon, 18 Sep 2017 11:09:52 GMT

Hello

i get this message when i try to add Active directory user "Error: Failed to connect to 172.16.17.5(172.16.17.5):389"

i already enter the ldap information on the ldap profil

Re: Problem with Group Mapping Settings

Mick_Ball — Mon, 18 Sep 2017 11:58:29 GMT

bind looks wrong, it needs to be the distinguished name for the AD server.

CN=administrateur,OU=xxx?,DC=pa,DC=ma

you will get this information from AD, user attributes, DistinguishedName.

Re: Problem with Group Mapping Settings

hamza_ineos — Mon, 18 Sep 2017 13:54:30 GMT

i try with this also with no result

Re: Problem with Group Mapping Settings

Mick_Ball — Mon, 18 Sep 2017 14:13:54 GMT

from CLI..

show user group-mapping state all

and post output.

also from CLI, can you ping 172.16.7.5

Re: Problem with Group Mapping Settings

hamza_ineos — Mon, 18 Sep 2017 14:38:11 GMT

Re: Problem with Group Mapping Settings

BPry — Mon, 18 Sep 2017 14:57:02 GMT

@hamza_ineos,

You still don't have an OU in your Bind DN which is kind of odd to me. From my knowledge of AD (which isn't awesome) you need to include the OU that this account belongs to.

Re: Problem with Group Mapping Settings

Mick_Ball — Mon, 18 Sep 2017 15:01:40 GMT

can you post the attribute "distinguished name" for administrateur from within AD..

also... is 172.16.17.2 the management or trusted interface.

Re: Problem with Group Mapping Settings

hamza_ineos — Mon, 18 Sep 2017 15:25:07 GMT

Thank you brother

i found the solution for this problem, you can see it in the picture

Re: Problem with Group Mapping Settings

Mick_Ball — Mon, 18 Sep 2017 15:45:24 GMT

OK "brother" thats a bit cryptic, so can we assume you changed LDAP to use the custom interface 1/2 and not the default management interface.

Re: Problem with Group Mapping Settings

Mick_Ball — Mon, 18 Sep 2017 15:59:21 GMT

oops sorry... just noticed you are sending all traffic to AD server via 1/2, not just LDAP.