topic Re: User Identification - 4.1 LDAP - AD in General Topics

User Identification - 4.1 LDAP - AD

paulmeys — Mon, 14 Nov 2011 10:57:33 GMT

Hi,

I have upgraded to 4.1 and added a ldap-server profile to the config so the firewall does the query instead of the user-id-agent.

When I go to group-mappings settings ( under user-identification ) and select the tab 'Group Include List',
I can see the whole AD-tree-structure, but I cannot view the last part: the group itself.

Has anybody seen this behavior ?

Kind regards,

Paul

Re: User Identification - 4.1 LDAP - AD

supportOCA — Tue, 15 Nov 2011 00:18:20 GMT

Yes i saw the same behaviour. Support said it was a bug. To add the groups required i used the search feature above the LDAP tree. That seemed to work even though i could browse for the groups.

Also keep in mind with the LDAP config the domain name i need to use the NETBIOS domain name not the full DNS name.

Re: User Identification - 4.1 LDAP - AD

paulmeys — Tue, 15 Nov 2011 10:34:16 GMT

Yes!

Apparantly it's working when you search for the EXACT name for the group.

but:

The normal listing works when you make your base "deep" enough in the ldap-server-profile.

so yes, I think it is a bug 🙂

Kind regards,

Paul

Re: User Identification - 4.1 LDAP - AD

UKRB — Mon, 23 Jan 2012 10:46:09 GMT

I am seeing the exact same behaviour - I am typing in the group names exactly and I do get a match. Unfortunately when I go to the command line and do "show user group name <group name>" I can get all to work apart from Domain Users. This group just returns an empty list which has meant the rules previously based on that - namely web access, have failed. This has obviously upset a few people...

The group lookup issue is a dissapointing bug - surely a complete lack of testing on something quite important...