This message was deleted.
# citrix-netscalers
Slackbot
08/02/2023, 5:14 PMThis message was deleted.
d
Dima
08/02/2023, 5:27 PMThis is what comes up in aaadebug: cascade_authorization 0-0: Authorization failed for all confiugured servers
r
Ryan Gallier
08/02/2023, 6:07 PMwhat auth group are you putting that user in?
d
Dima
08/02/2023, 6:13 PMim not using individual users, adding a group to superuser
Dima
08/02/2023, 6:14 PMand it looks like its not extracting groups when comparing aaadebug with the one from the working netscaler
Dima
08/02/2023, 6:19 PMjust tested with individual user and it seems to work. so something with group or group exctraction
r
Ryan Gallier
08/02/2023, 6:22 PMI made a group called ADC-Admins, and put that group in superuser, and i have radius return ADC-Admins to put the AD user in that group
d
Dima
08/02/2023, 6:22 PMI am not using Radius
Dima
08/02/2023, 6:22 PMldap authentication
r
Ryan Gallier
08/02/2023, 6:24 PMahhh, ok. Sorry, just trying provide what I have working. 🙂
d
Dima
08/02/2023, 6:25 PMmakes sense. I have the same ldap config working on 3 other devices. something is diff on this one and I cant find what exactly
r
Ryan Gallier
08/02/2023, 6:31 PMyeah, that's odd
d
Dima
08/02/2023, 6:53 PMok looks like the search fileter is an issue. Without it everything works. I think it does not like the group being in different OU from user accounts. But again.. this is not a problem on other similar devices 🤷♂️
r
Ryan Gallier
08/02/2023, 6:58 PMYeah, that's an odd one.
d
Dima
08/02/2023, 7:04 PMso to close this, I changed the base dn on the LDAP server page to just root ad and then added a search filter to check group membership. that way other accounts wont be able to logon.
m
Mike Streetz (O_P)
08/02/2023, 9:21 PMbe careful with setting the base dn to the root because if your AD is large you will get timeouts
👍 1
Mike Streetz (O_P)
08/02/2023, 9:23 PMYou can add 1.2.840.113556.1.4.1941 to the Search Filter so it searches through nested groups. Without this, users will need to be direct members of the filtered group.
👍 1
Mike Streetz (O_P)
08/02/2023, 9:23 PMd
Dima
08/02/2023, 10:09 PMthanks @Mike Streetz (O_P) lots of good info. I did notice with base dn at the root that logons to the management console slowed down by 1-2 seconds. As far as the group membership its not nested in my case but great to know. I am still curious why the same identical filter works on my onprem gateways but does not on the Azure one. All devices are running the same ver. The only diff the on prem have been around longer and have been upgraded from lower versions.
m
Mike Streetz (O_P)
08/02/2023, 10:10 PMare the azure ones pointing to on prem AD?
d
Dima
08/02/2023, 10:10 PMyea to exact same LB pool
m
Mike Streetz (O_P)
08/02/2023, 10:11 PMthat is weird then
Mike Streetz (O_P)
08/02/2023, 10:11 PMit might be timing out?
Mike Streetz (O_P)
08/02/2023, 10:11 PMhave you tried doing a aaad.debug while logging in?
d
Dima
08/02/2023, 10:13 PMI did and lots of output but nothing that really jumps at me except on the working devices it eventually listed groups the user was a member of. and on the azure one it kept logging cascade_authorization 0-0: Authorization failed for all confiugured servers
Dima
08/02/2023, 10:13 PMbut in both cases it contacted DC's with no issues
c
Chai
08/16/2023, 2:54 PMits been two weeks but still... I wanted to test 14.1 ADC firmware and ended up in same error when I tried to import license file with nsroot account. I have created another local account and added it to super user group. With that account I am able to perform all operations without any issues. Not able to modify nsroot permissions.
2 Views