Solved!
Go to SolutionI
ITSystemAnalyst
11 Posts
0
7739
March 6th, 2014 08:00
SRM - LDAP Authentication/AD
Hi,
I'm having trouble with the LDAP authentification available in SRM v6.3. Even after having configured the "server.xml" file located in "\opt\APG\Web-Servers\Tomcat\Default\conf" with the AD informations I have, the AD authentification doesn't seem to work.
I've heard that if you want to use an AD account in SRM, you have to create first this account in SRM, assign it a role, and a profile and then try to log in with this account. Is that right?
Unfortunately, the existing logs in Centralized Management aren't making any mention of the problem. It just says that attempt to login to realm with the AD account has failed. There is no more information about this fail, so I don't get it... Am I missing something?
Here is the part of my "server.xml" file concerning the LDAP Authentification:
connectionURL="ldap://IP-of-my-Primary-AD-Server:389"
alternateURL="ldap://IP-of-my-Secondary-AD-Server:389" connectionName="CN=ServiceAccountToBrowseAD,OU=Organization01,OU=Organization02,
DC=mycompany,DC=com"connectionPassword="Password-of-ServiceAccountToBrowseAD"
userSearch="(sAMAccountName={0})"
userBase="OU=OrganizationUser01,DC=mycompany,DC=com"
referrals="follow"
derefAliases="always"
userSubtree="true" />
After having completed this file, I restart all the SRM services (just to be sure everything is ok) and I try to log in using an account located in the OU "OrganizationUser01" of my AD (the account with which I try to log in has been previously created in SRM with default profile, and all the roles that exist in SRM).
2731
1
Posted March 6th, 2014 08:00
With SRM v3 you currently have to add each AD user as a local user via the GUI. A password is not necessary. Then you must assign a profile adding the OU, DC string into the “External Members” tab.
Engineering are working on a bulk import tool to make the import of many AD users easier, but at this time it is not available.
Simon Thompson
Snr Delivery Specialist, Global Professional Services Delivery
EMC Computer Systems (UK) Limited,
Business Address: EMC Tower, Great West Road, Brentford, TW8 9AN
2731
0
Posted March 7th, 2014 01:00
Firstly many thanks for your help on this issue.
I've just tried what you advised me but it's not working yet.
I've created a profile named "AD Profiles" and I've added the OU,DC string into the "External Members" tab (as shown on the screenshot bellow) and I've assigned this profile to the user with which I'm trying to log in (the user exists in the OU,DC defined).
Is this configuration mapping with my "server.xml" file? I may have missed something.
Do you have any idea of the availability of the bulk import tool?
Thanks again for your help!
2731
0
Posted March 7th, 2014 02:00
I can't authenticate with my user, but when I do a request on my AD using dsget command:
dsget user "CN=MyUser,OU=OrganizationUser01,DC=mycompany,DC=com"
I get the informations on my user, so I guess the AD string is ok. Or maybe it's a syntax error and SRM is expecting for another syntax?
The user created in SRM should be named as the CN or as the samid?
Thanks for the information on the bulk import utility!
2731
0
Posted March 7th, 2014 02:00
What error do you get?
If the user cannot authenticate then the AD OU string may be incorrect
If the user can authenticate, but gets a blank dashboard then AD authentication is working but the user is not authorized properly in SRM.
There is currently no estimate for when the bulk import utility will be available. It is being tested in engineering.
Simon Thompson
Snr Delivery Specialist, Global Professional Services Delivery
EMC Computer Systems (UK) Limited,
Business Address: EMC Tower, Great West Road, Brentford, TW8 9AN
2731
0
Posted March 7th, 2014 03:00
When you added the local user into SRM, did you define a password? If so, remove it and retry. If you can’t authenticate into SRM then the AD string you put into SRM is not working.
Simon Thompson
Snr Delivery Specialist, Global Professional Services Delivery
EMC Computer Systems (UK) Limited,
Business Address: EMC Tower, Great West Road, Brentford, TW8 9AN
2731
0
Posted March 7th, 2014 06:00
No I did not define a password.
So it might be the wrong AD string. I will investigate on this side and keep you updated.
Many thanks for your help.
2731
0
Posted March 7th, 2014 08:00
This may be a simple question
, but does the ID that you are logging into SRM with match the value in the sAMAccountName parameter in AD for that user? Since the 'userSearch' parameter is configured to search values in sAMAccountName, the user created in SRM should be named the same as the sAMAccountName parameter value for that AD user.
A nice tool for troubleshooting these types of issues is MS Active Directory Explorer. It's free and you can download it from: http://technet.microsoft.com/en-us/sysinternals/bb963907.aspx
I have found AD Explorer to helpful in testing/troubleshooting bind user credentials, SRM user credentials, and to explore the AD store itself.
2731
0
Posted March 10th, 2014 01:00
I've just checked and the ID that I'm logging into SRM with matches the value in the sAMAccontName parameter in AD for my user and the user created in SRM is named the same as the sAMAccountName parameter value for my AD user.
I'll continue to investigate using the MS Active Directory Explorer, to check if I haven't missed something. Thanks for the link of the tool. I will keep you update if I find any solution to my issue.
2731
0
Posted March 10th, 2014 02:00
I've checked again with the MS tool and nothing seems wrong, I don't get it and logs are not very helpful!
Is there any log that can help me to solve this issue?
Actually, the logs are only showing that my user can't connect to SRM but nothing else (and particularly not why it fails to authenticate!)
Is there any parameter to set in config files to enhance the logs level?
gawanb
21 Posts
3865
0
Posted March 11th, 2014 09:00
No worries. We can definitely help whenever there is a webex session. And just to confirm. You have disabled the local authentication right ? I dont see you have used a combined REALM, so in that case, local authentication REALM has to be commented using the XML commenting tags. Otherwise LDAP wont work.
- Brijesh