Re: AD Auth for standalone ISA in DMZ

As stated in the error, you can't use LDAP for access rules.
If you want to authenticate internal accounts fro access rules, RADIUS is
your only non-Windows option.
--
Jim Harrison (ISA SE)

This posting implies no warranty and confers no rights.
http://catb.org/~esr/faqs/smart-questions.html



<doug.masters@xxxxxxxxx> wrote in message
news:1183038088.944513.315330@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Thanks Jim! I unchecked that box (trust me, it's easier than dealing
with the network boys!)

I was able to create my user set with the <domain>\<group> I want to
use, but when I try to add them to the access rule I get the
following: "The authentication method (LDAP) selected for user set
<user set> is not valid for an access rule. The rule cannot be saved
until you change the authentication method of select a different user
set."


On Jun 27, 7:16 pm, "Jim Harrison \(ISA SE\)"
<jmh...@xxxxxxxxxxxxxxxxxxxx> wrote:
"Use Global Catalog box is checked" - this means that you need TCP:3268
open
through the firewall; not
TCP:389.http://www.microsoft.com/technet/security/smallbusiness/topics/Server...
--
Jim Harrison (ISA SE)

This posting implies no warranty and confers no
rights.http://catb.org/~esr/faqs/smart-questions.html

<doug.mast...@xxxxxxxxx> wrote in message

news:1182955938.166927.305380@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
On Jun 25, 5:19 pm, doug.mast...@xxxxxxxxx wrote:

Standalone ISA 2006, single nic, in a DMZ. I need to configure ISA
to poll AD to see if a user is allowed access to the internet or
not. The network boys tell me that they have port 389 open between
my ISA server and my DC's.

The information I'm finding is about using LDAP to authenticate
incoming traffic, and I want to authenticate outbound traffic.

OK, I didn't provide much info, so let me add more about what's been
done and what's been tested.

1. The Network boys finally got 389 open, previously I could not
telnet on port 389 to the DC's and now I can.

2. System Policy #1 (Authentication Services) has been enabled. I
created a Computer Set for the DC's and applied them to the
destination of the System Policy.

3. Under Specify RADIUS and LDAP Servers, I created an LDAP Server
Set with the two DC's, the FQDN is entered, the Use Global Catalog box
is checked, and a valid username & password are entered. The
login Expression to <domain>\* and LDAP Server Set is set.

4. When I try to create a new User Set, I choose the LDAP Server Set
I created and enter the group name of the AD Group that is allowed
internet access. After clicking OK I get a username/password prompt,
after entering that I get the error "None of the configured LDAP
servers are available for verifying the user."

What, if anything, am I missing?


.

Relevant Pages

  • Gnome - autofs nfs home directories
    ... Thanks to the help I got in this list my LDAP authentication now works ... get authenticated by the LDAP server and autofs ... Everything works fine providing a user doesn't log on to two machines at ...
    (Fedora)
  • Re: Sun Java System Directory Server Authentication
    ... Note that I'm not picking on you, I largely following your reasoning and that I don't agree ... The same goes for LDAP, at the core each LDAP server handles the LDAP protocol, but that ... Solaris LDAP to handle NTLM authentication. ... network "authentication" as used when binding against an LDAP server is meant to 1) validate ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: USE of ADFS
    ... For pure LDAP authentication, ... controller in the forest to authenticate a user in ANY domain in the forest. ... unless you specify that domains ldap server. ...
    (microsoft.public.windows.server.active_directory)
  • Re: pam_ldap and password management and rsh/ssh without password
    ... > authentication that doesn't require a password will fail. ... > that accounts may be expired (via ldap). ... pam_ldap has to actually be able to bind to the ldap server as the user ... disadvantage to this is that then the clients are managing the password ...
    (comp.unix.solaris)
  • Re: Directory Services, LDAP or similar
    ... In other projects, we managed the user authentication by creating tables that define all users and its allowed capacities, then the application queryies that data to verify if a user has access to some feature or not. ... The above ID and password are sent to the service at login time. ... They are using Novell eDirectory at the enterprise level; yes it's LDAP. ... We already do that for three different DB servers; ...
    (borland.public.delphi.non-technical)