topic Active Directory integration issue - group query issue in HPE OneView

Active Directory integration issue - group query issue

MRoushdy84 — Sun, 28 Mar 2021 11:27:42 GMT

Hello,

I'm able to add Active Directory as a directory for authentication, but when I add a group, it faisl to query with the following error, and I've double checked with our AD admin that no policies are applied to restrict querieing.

I'm sure that I'm providing the group path in a correct format, but it seesm to be altered if I'm not mistaken, even using a domain admin account didn't fix it.

THank you,

Re: Active Directory integration issue - group query issue

ChrisLynch — Mon, 29 Mar 2021 14:44:55 GMT

Hello and welcome to the HPE OneView forums.

The error message you mentioned is not within your post. Can you also please provide the version of HPE OneView you have as well?

Re: Active Directory integration issue - group query issue

MRoushdy84 — Tue, 30 Mar 2021 06:54:43 GMT

Hello,

I couldn't attach a screenshot. Here's the error message:

Invalid search input [OU=Server without \"Intrusion Prevention Policy\",OU=Gosi-servers,DC=Gosi,DC=ins], was provided with the input. Provide a valid search input and try again.

OneView Version: 2020.01.25.00

Thank you,

Re: Active Directory integration issue - group query issue

MRoushdy84 — Tue, 30 Mar 2021 10:21:28 GMT

The OneView version is: 5.00.01-0410269

Re: Active Directory integration issue - group query issue

ChrisLynch — Tue, 30 Mar 2021 17:33:35 GMT

You can post pictures by using the camera icon. You have to first upload the image, then attach it to the post.

That said, this looks to be an issue with your use of the " marks in the OU name. I tested this behavior on a 6.00 appliance in my lab and was able to reproduce this. And this is only when you browse for the group. As a workaround, either provide the full Distinguished Name of the group, New-OVLdapGroup PowerShell Cmdlet, or the REST API.

Re: Active Directory integration issue - group query issue

MRoushdy84 — Wed, 31 Mar 2021 06:34:38 GMT

here hyou go

Re: Active Directory integration issue - group query issue

ChrisLynch — Wed, 31 Mar 2021 16:00:17 GMT

Can you help me understand the exact steps you are taking to get to this screenshot? If you are using an OU Distinguished Name for the BaseDN when you are adding an external authentication directory, that is incorrect. A BaseDN is in the format of dc=sub-domain,dc=domain1,dc=top-level-domain. An example would be dc=contoso,dc=com.

Re: Active Directory integration issue - group query issue

MRoushdy84 — Thu, 01 Apr 2021 09:18:09 GMT

I'm able to add a directory successfully, and the format I use is DC=domain,DC=LOCAL (for example), but when I query any group, to grant it permissions, it fails to query groups with the error I sent. I get the same error accross all of our OneView servers, and I also checked the firewall, nothing is blocked.

Re: Active Directory integration issue - group query issue

ChrisLynch — Thu, 01 Apr 2021 19:48:55 GMT

The issue is with the double quote marks in the OU name. I have been able to reproduce this. And it only happens when browsing for the group. We are looking at fixing this in a future OneView release.