Trouble using AD group

[Sunil Thazhathupurakkal]

I am having trouble using Active Directory group authentication. Users in the Domain Admins do not have any issues while users in all other groups are unable to login using their AD credentials.

Error Message

"Invalid username or password. Enter correct credentials and try again. To obtain a username or password, contact your security administrator."

I suspect some special permissions on AD are needed. Can anyone tell me what those permissions are?

[ChrisLynch]

Have you added the Directory Groups you need to the HP OneView appliance?  Did you specify the OU where the other AD Security Groups are located?  What version of the HP OneView appliance are you using?

[Sunil Thazhathupurakkal]

Yes. The groups and the user objects are in the same OU. I can search and add the groups as well. The verion of OneView is 1.10. These groups are real AD groups with real users and were working with OA.

Initially I thought of integration issues. However, users in the Domain Admins group are perfectly all right. I suspect rights issues mainly because the connect to AD step before I could search for groups worked only with a domain admin user account. And why everything is working well with OA?

[ChrisLynch · Accepted solution]

There are no special permissions needed or required to access non-Domain Admin accounts.  That is unless you have modified the default OU permissions that prevent the user you are trying to authenticate with by removing atleast the Read permission of the OU and child objects.

You stated you are using 1.10, but that's the major and minor release.  The original 1.10 release is 1.10.03, and we have published 2 patches since then: 1.10.05 and 1.10.07.  1.10.07 addresses a number of LDAP/AD authentication issues, and I would encourage you patch your appliance if you are running 1.10.05. 

You can see the exact version by going to the Top Level Menu (the HP OneView icon in the upper left), then select Settings.  In that screen, you can see the product version inthe Appliance panel:

[Sunil Thazhathupurakkal]

That might be the case.  This is the version 1.10.03-103740, Jun 26, 2014. 

[ChrisLynch]

There are no known LDAP/AD issues with 1.10.03.  1.10.05 was completely broken and one of the major reasons why the 1.10.07 patch was released.

And please refrain from posting or discussing unreleased or unannounced versions/products in this public forum.

[Sunil Thazhathupurakkal]

I don't know if HP is aware of the issues. But I have faced a couple of issues with 1.10.03. But with 1.10.07 update those issues are gone. Now I can add the AD groups using a non-domain admin user account. And all users in that group are able to log in.

My initial attempt to update got stuck at around 30%. The second one succeeded in an hour.

[ChrisLynch]

There are no known LDAP/AD issues with 1.10.03, unlike 1.10.05. Again, there are no special LDAP/AD permissions needed for security directory integration.

[Sunil Thazhathupurakkal]

Unfortunately we couldn't agree on this. But I am happy 1.10.07 is working well.

[MachV]

HP One View AD lookup appears to use DISPLAY NAME field from active directory when doing its auethentication lookup. If Display name does not match username login issues will occur and a failure message appears stating "Invalid username or password. Enter correct credentials and try again."

If you change the display name in AD to match the username the auethentication works without any problems.

This to me seems like a bug in the query Oneview is using to authenticate..

Hope this helps anyone who has this same issue. This behaviour still appears to be present in HPE OneView 5.00.01.