Onboard Administrator, C7000 chasis, Active Directory issue

[brice-a]

Overall Test Status Failed
Ping Directory Server Passed
Directory Server IP Address Not Run
Directory Server DNS Name Passed
Connect to Directory Server Passed
Connect using SSL Passed
Certificate of Directory Server Passed
User Authentication Passed
User Authorization Failed

Test user placeholder@domain.com authenticated.
Unable to authorize test user.
Some diagnostics FAILED for server server01
Tests complete.

For some reason I can authenticate, but I cannot get authorized. I'm attempting to use the domain admins group located in the standard users container for my group access. My search contexts appear to work if I authenticate? I'm not sure what the authorization issue is.

[Raghuarch]

is the domain admins group located in the standard users is listed under the OA directory Groups?

refer to Page 169:
http://h20000.www2.hp.com/bc/docs/support/SupportManual/c00705292/c00705292.pdf

[brice-a]

Yes, I have added a group named Domain Admins to the OA Directory Groups. This didn't seem to make a difference.

[Raghuarch]

Is your Search Context OK, is it pointed till the Groups where the user is present.
CN=Users, DC=Domain, DC=com or
if the group is in OU try:
OU=OU-Name, CN=Users, DC=Domain, DC=com

[brice-a]

I managed to get it working, finally. It works ok, aside from a weird issue when doing a test. If I use the UPN style login (userid@domain.com) the test errors and forces me to log out of OA. Otherwise it works fine, and I can even login using the UPN format. I'm satisfied with the result.

[Raghuarch]

Yes you are right... OA LDAP allows only one session at any point of time.
If you logged in already and test using the same user it logs out the logged in user.

Of you can try to Login with CLI session it allows only one LDAP session for the same user.

[brice-a]

Thanks for the help.

[Matt Ronsman]

Brice,

I am having the same issue. You never really say what you did to get this working. Care to share?

Thanx,
Matt

[brice-a]

Try logging in as the "Full Name" of the account vs using the user name. Don't use the 'test' function to see if it is working -- that is what I was doing wrong. Instead, just log out to test once you think you have the settings right. The 'test' your settings login does work for me now, but only if I use my full name vs the user name -- keep reading...

My full name is Joe Blow Admin vs jblow-a as my user name. Don't get me wrong jblow-a works to login, but it requires an activeX control to work. You're better off using the full name vs the actual user name since this is real LDAP not MS want-to-be LDAP. The password is the same either way.

[Ken Henault]

Can you give more detail on what ActiveX control you're referring too? Where can I get it?