Active Directory authentication, OS X network homes on Xserve

Hi
I'm looking for a general guide/tips for our deployment of OS X in our Windows network.
Everyone in our institution has an Active Directory account.
We also have an Xserve 10.4.4 running as an OD Master with 400 accounts for people who use Macs. It shares out OS X network home folders for these accounts. This means these people have a seperate AD and OD account.
We aim to get these users authenticating with AD on the Macs and seeing a network home that will ultimately be a combination of an OS X folder (Public, Sites) and a Windows folder (My documents etc.)
We can backup the data in their existing OS X home folders for them to pull into the new homes that will be created for them through AD authentication.
We can successfully bind the Xserve and client Macs to AD. We have a group of AD users in WGM. MCX preferences are enforced at computer level.
The big questions are:
How do we tackle the mapping of a (OS X/Windows combo) home folder stored on the Xserve for new Active Directory accounts when they are created?
What could we do with AD/OD current users existing Active Directory folders when they start to use AD to authenticate on the Macs (current OS X home data will be backed up and pulled in to new OS X accounts later) ?
Do we definately need Kerberos running on the Windows server ?
What would happen to an existing AD/Windows-only user with a Windows folder mapped to an SMB/Windows server share if they authenticated to OS X for the first time - local home creation (default/forced) ?
Any advice appreciated - we have Windows/Mac people working in harmony here and we're close to what we want!
Many Thanks

Try this (on the client computer):
Login locally using a user with administrator privileges.
Connect to your office's wireless network, save the credentials, and then make sure you check the "Connect automatically" checkbox.
Open a command prompt window and type the following command to find the profile name of your wireless network: netsh
wlan show profiles
Let's say the profile to use in the example is "office-network". Open regedit and
look for the key HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Create a new String Value (REG_SZ) at that location, and name it anything you want (i.e. WIFI_Connect), and enter the following command string: %comspec%
/c netsh wlan connect name="<profile name>" where profile name in our example would be "office-network".
Reboot the laptop for this to take effect.
If it still doesn't work or fails to connect to your office network at pre-logon, try enabling the following Local Group Policy (using gpedit.msc): Computer
Configuration\Policies\Administrative templates\System\Logon\Always wait for the network at computer startup and logon.
These step still require the wireless network to be your domain network as Windows can only Cache 50 credentials maximum.
Don't forget to mark the post that solved your issue as &quot;Answered.&quot; By marking the Answer you are enabling users with similar issues to find what helped you. Lewis Renwick - IT Professional

Similar Messages

  • BO XI 3.1 : Active Directory Authentication failed to get the Active Directory groups

    Dear all 
            In our environment, there are 2 domain (domain A and B); it works well all the time. Today, all the user belong to domain A are not logi n; for user in domain B, all of them can log in but BO server response is very slowly. and there is error message popup when opening Webi report for domain B user. Below are the error message: 
           " Active Directory Authentication failed to get the Active Directory groups for the account with ID:XXXX; pls make sure this account is valid and belongs to an accessible domain"
          Anyone has encountered similar issue?
       BO version: BO XI 3.1 SP5
       Authenticate: Windows AD
    Thanks and Regards

    Please get in touch with your AD team and verify if there are any changes applied to the domain controller and there are no network issues.
    Also since this is a multi domain, make sure you have 2 way transitive forest trust as mentioned in SAP Note : 1323391 and FQDN for Directory servers are maintained in registry as per 1199995
    http://service.sap.com/sap/support/notes/1323391
    http://service.sap.com/sap/support/notes/1199995
    -Ambarish-

  • Weblogic with Active Directory Authentication provider problem: DN for user ....: null

    I have a java application (SSO via SAML2) that uses Weblogic as a Identity Service Provider. All works well using users created directly in Weblogic. However, I need to add support for Active Directory. So, as per documentation:
    - I defined an Active Directory Authentication provider
    - changed it's order in the Authentication Providers list so that it comes first
    - set the control flag to SUFFICIENT and configured the Provider Specific; here's the concerned part in config.xml:
    <sec:authentication-provider xsi:type="wls:active-directory-authenticatorType">
            <sec:name>MyOwnADAuthenticator</sec:name>
            <sec:control-flag>SUFFICIENT</sec:control-flag>
            <wls:propagate-cause-for-login-exception>true</wls:propagate-cause-for-login-exception>
            <wls:host>10.20.150.4</wls:host>
            <wls:port>5000</wls:port>
            <wls:ssl-enabled>false</wls:ssl-enabled>
            <wls:principal>CN=tadmin,CN=wl,DC=at,DC=com</wls:principal>
            <wls:user-base-dn>CN=wl,DC=at,DC=com</wls:user-base-dn>
            <wls:credential-encrypted>{AES}deleted</wls:credential-encrypted>
            <wls:cache-enabled>false</wls:cache-enabled>
            <wls:group-base-dn>CN=wl,DC=at,DC=com</wls:group-base-dn>
    </sec:authentication-provider>
    I configured a AD LDS instance(Active Directory Lightweight Directory Services) on a Windows Server 2008 R2. I created users and one admin user "tadmin" which was added to Administrators members. I also made sure to set msDS-UserAccountDisabled property to FALSE.
    After restarting Weblogic I can see that the AD LDS's users and groups are correctly fetched in Weblogic. But, when I try to connect with my application, using Username:tadmin and Password:<...> it does not work.
    Here's what I see in the log file:
    <BEA-000000> <LDAP Atn Login username: tadmin>
    <BEA-000000> <authenticate user:tadmin>
    <BEA-000000> <getConnection return conn:LDAPConnection {ldaps://10.20.150.4:5000 ldapVersion:3 bindDN:"CN=tadmin,CN=wl,DC=at,DC=com"}>
    <BEA-000000> <getDNForUser search("CN=wl,DC=at,DC=com", "(&(&(cn=tadmin)(objectclass=user))(!(userAccountControl:1.2.840.113556.1.4.803:=2)))", base DN & below)>
    <BEA-000000> <DN for user tadmin: null>
    <BEA-000000> <returnConnection conn:LDAPConnection {ldaps://10.20.150.4:5000 ldapVersion:3 bindDN:"CN=tadmin,CN=wl,DC=at,DC=com"}>
    <BEA-000000> <getConnection return conn:LDAPConnection {ldaps://10.20.150.4:5000 ldapVersion:3 bindDN:"CN=tadmin,CN=wl,DC=at,DC=com"}>
    <BEA-000000> <getDNForUser search("CN=wl,DC=at,DC=com", "(&(&(cn=tadmin)(objectclass=user))(!(userAccountControl:1.2.840.113556.1.4.803:=2)))", base DN & below)>
    <BEA-000000> <DN for user tadmin: null>
    <BEA-000000> <returnConnection conn:LDAPConnection {ldaps://10.20.150.4:5000 ldapVersion:3 bindDN:"CN=tadmin,CN=wl,DC=at,DC=com"}>
    <BEA-000000> <javax.security.auth.login.FailedLoginException: [Security:090302]Authentication Failed: User tadmin denied
      at weblogic.security.providers.authentication.LDAPAtnLoginModuleImpl.login(LDAPAtnLoginModuleImpl.java:229)
      at com.bea.common.security.internal.service.LoginModuleWrapper$1.run(LoginModuleWrapper.java:110)
    So, I tried to look why do I have: <DN for user tadmin: null>. Using Apache Directory Studio I reproduced the ldap search request used in Weblogic and, sure enough, I get no results. But, changing the filter to only "(&(cn=tadmin)(objectclass=user))" (NOTICE, no userAccountControl), it works; here's the result from Apache Directory Studio:
    #!SEARCH REQUEST (145) OK
    #!CONNECTION ldap://10.20.150.4:5000
    #!DATE 2014-01-23T14:52:09.324
    # LDAP URL     : ldap://10.20.150.4:5000/CN=wl,DC=at,DC=com?objectClass?sub?(&(cn=tadmin)(objectclass=user))
    # command line : ldapsearch -H ldap://10.20.150.4:5000 -x -D "[email protected]" -W -b "CN=wl,DC=at,DC=com" -s sub -a always -z 1000 "(&(cn=tadmin)(objectclass=user))" "objectClass"
    # baseObject   : CN=wl,DC=at,DC=com
    # scope        : wholeSubtree (2)
    # derefAliases : derefAlways (3)
    # sizeLimit    : 1000
    # timeLimit    : 0
    # typesOnly    : False
    # filter       : (&(cn=tadmin)(objectclass=user))
    # attributes   : objectClass
    #!SEARCH RESULT DONE (145) OK
    #!CONNECTION ldap://10.20.150.4:5000
    #!DATE 2014-01-23T14:52:09.356
    # numEntries : 1
    (the "[email protected]" is defined as userPrincipalName in the tadmin user on AD LDS)
    As you can see, "# numEntries : 1" (and I can see as result the entry "CN=tadmin,CN=wl,DC=at,DC=com"  in Apache Directory Studio's interface); if I add the userAccountControl filter I get 0.
    I've read that the AD LDS does not use userAccountControl but "uses several individual attributes to hold the information that is contained in the flags of the userAccountControl attribute"; among those attributes is msDS-UserAccountDisabled which, as I said, I already set to FALSE.
    So, my question is, how do I make it work? Why do I have "<DN for user tadmin: null>" ? Is it the userAccountControl ? If it is, do I need to do some other configuration on my AD LDS ? Or, how can I get rid of the userAccountControl filter in Weblogic?
    I didn't seem to find it in config files or in the interface: I only have "User From Name Filter: (&(cn=%u)(objectclass=user))", there's no userAccountControl.
    Another difference I noticed is that, even though in Weblogic I have set ssl-enabled flag to false, in the logs I see ldaps and not ldap ( I'm not looking to setup something production-ready and I don't want SSL for the moment ).
    Here are some other things I tried but did not change anything:
    - the other "msDS-" attributes were not set so I tried initializing them to some value
    - I tried other users defined in AD LDS, not tadmin
    - in Weblogic I added users that were imported from AD LDS in Roles and Policies> Realm Roles > Global Roles > Roles > Admin
    - I removed all userAccountControl occurrences that I found in xml files in Weblogic (schema.ms.xml, schema.msad2003.xml)
    Any thoughts?
    Thanks.

    I managed to narrow it down: the AD LDS does not support the userAccountControl.
    Anyone knows how I can configure my Active Directory Authentication Provider in Weblogic so that it does not implicitly use userAccountControl as filter?
    <BEA-000000> <getDNForUser search("CN=wl,DC=at,DC=com", "(&(&(cn=tadmin)(objectclass=user))(!(userAccountControl:1.2.840.113556.1.4.803:=2)))", base DN & below)> 

  • Unable to find user list in Active Directory Authenticator

    Hi all,
    I am using weblogic 10.3 and want to configure ActiveDirectory Authenticator for my weblogic application. We have one managed srever under admin server . I have configured a Active Directory Authenticator named "ADAuthenticator" and made following changes as per the below values:
    I set the control flag to "OPTIONAL" .
    Security Realms-->myrealm-->Providers-->ADAuthenticator-->Provider Specific
    UserName Attribute : ServiceBEA
    Principal : ServiceBEA
    Host : xxxxxx
    User Search Scope : subtree
    Group From Name Filter : (&(ServiceBEA=%g)(objectclass=group))
    Credential : xxxxxx
    Confirm Credential : xxxxxx
    User From Name Filter : (&(ServiceBEA=%u)(objectclass=user))
    Static Group Name Attribute : ServiceBEA
    User Base DN : values provided as per requirement
    Port : 389
    User Object Class : user
    Use Retrieved User Name as Principal : checked
    Group Base DN : same values as per User Base DN
    Static Group Object Class : group
    Group Membership Searching : unlimited
    Max Group Membership Search Level : 0
    These are my AD settings. After doing this i click on save and then activate changes and then restarted the admin server.
    But the problem is when i login to weblogic console to check the user list under "User and Group" i am unble to find any Active Directory users.
    I don't know where i made the mistake. Can some make me out of this trouble.
    Any help is highly appreciated.
    Thanks in advance !

    Hi Sean,
    Actually we have already a Active Directory with username "ServiceBEA" in our windows server. So i used this "ServiceBEA" as UserName Attribute in weblogic console while creating a Active Directory Authenticator.
    You mean to say that we should go for "sAMAccountName" or what? If that is the case then i have also tested with following values, but still no luck.
    UserName Attribute : sAMAccountName
    Principal : ServiceBEA
    Host : xxxxxx
    User Search Scope : subtree
    Group From Name Filter : (&(sAMAccountName=%g)(objectclass=group))
    Credential : xxxxxx
    Confirm Credential : xxxxxx
    User From Name Filter : (&(sAMAccountName=%u)(objectclass=user))
    Static Group Name Attribute : sAMAccountName
    User Base DN : values provided as per requirement
    Port : 389
    User Object Class : user
    Use Retrieved User Name as Principal : checked
    Group Base DN : same values as per User Base DN
    Static Group Object Class : group
    Group Membership Searching : unlimited
    Max Group Membership Search Level : 0
    Please advise what to be place in case of User Name Attribute.
    Any help is highly appreciated.
    Thanks in advance !

  • Active Directory Authentication in Weblogic 8.1

    Hi,
    We want to do authentication from Microsoft Active Directory using weblogic 8.1.
    I have created a Active directory and
    configured weblogic from console to use it. But it is still not working. Your
    help with these question would be highly
    appreciated.
    1. Is there anyone in group who have tried this before. Please let me know how
    to proceed.
    2. Is there any tool by which I can get to know the different attribute asked
    for configuration in Weblogic?
    3. I am not able to login to my application after configuration. Is there any
    other way to come to know whether it is working
    or not?
    There could be plethora of reason but nothing which can come to my mind. Everything
    seems to be configured correctly. Here is
    portion of my config.xml related with authentication:
    <FileRealm Name="wl_default_file_realm"/>
    <PasswordPolicy Name="wl_default_password_policy"/>
    <Realm FileRealm="wl_default_file_realm" Name="wl_default_realm"/>
    <Security GuestDisabled="false" Name="vendavo-dev"
    PasswordPolicy="wl_default_password_policy"
    Realm="wl_default_realm" RealmSetup="true">
    <weblogic.security.providers.authentication.DefaultAuthenticator
    ControlFlag="SUFFICIENT"
    Name="Security:Name=myrealmDefaultAuthenticator" Realm="Security:Name=myrealm"/>
    <weblogic.security.providers.authentication.DefaultIdentityAsserter
    ActiveTypes="AuthenticatedUser"
    Name="Security:Name=myrealmDefaultIdentityAsserter" Realm="Security:Name=myrealm"/>
    <weblogic.security.providers.authorization.DefaultRoleMapper
    Name="Security:Name=myrealmDefaultRoleMapper" Realm="Security:Name=myrealm"/>
    <weblogic.security.providers.authorization.DefaultAuthorizer
    Name="Security:Name=myrealmDefaultAuthorizer" Realm="Security:Name=myrealm"/>
    <weblogic.security.providers.authorization.DefaultAdjudicator
    Name="Security:Name=myrealmDefaultAdjudicator" Realm="Security:Name=myrealm"/>
    <weblogic.security.providers.credentials.DefaultCredentialMapper
    Name="Security:Name=myrealmDefaultCredentialMapper" Realm="Security:Name=myrealm"/>
    <weblogic.management.security.authentication.UserLockoutManager
    Name="Security:Name=myrealmUserLockoutManager" Realm="Security:Name=myrealm"/>
    <weblogic.management.security.Realm
    Adjudicator="Security:Name=myrealmDefaultAdjudicator"
    AuthenticationProviders="Security:Name=myrealmDefaultAuthenticator|Security:Name=myrealmDefaultIdentityAsserter|Security:Name
    =myrealmADAuthenticator"
    Authorizers="Security:Name=myrealmDefaultAuthorizer"
    CredentialMappers="Security:Name=myrealmDefaultCredentialMapper"
    DefaultRealm="true" DisplayName="myrealm"
    Name="Security:Name=myrealm"
    RoleMappers="Security:Name=myrealmDefaultRoleMapper"
    UserLockoutManager="Security:Name=myrealmUserLockoutManager"/>
    <weblogic.security.providers.pk.DefaultKeyStore
    Name="Security:Name=myrealmDefaultKeyStore" Realm="Security:Name=myrealm"/>
    <weblogic.security.providers.authentication.ActiveDirectoryAuthenticator
    ControlFlag="SUFFICIENT" Credential="{3DES}hvEo4sy7g1E="
    DisplayName="ADAuthenticator" FollowReferrals="false"
    GroupBaseDN="ou=ou=Groups,dc=devdc,dc=com" Host="venper5"
    Name="Security:Name=myrealmADAuthenticator"
    Principal="vendev" Realm="Security:Name=myrealm" UserBaseDN="ou=Users,dc=devdc,dc=com"/>
    </Security>
    First, of all is it possible to use Active Directory authentication in Weblogic
    without writing any custom code. If yes, how?
    Thanks in advance,
    Amit Tyagi

    Amit,
    We have successfully used WLS 8.1 sp1 with AD - but not without our share of ups
    and downs though.
    |
    |
    1) First, make sure you are sending right LDAP queries to AD. To verify this,
    we used free 3rd party LDAP browser from Softerra. There is also java based free
    browser from Univ of Michigan. Personally, I like Softerra's LDAP browser better.
    Play with your LDAP settings using this and make sure AD is returning the right
    data.
    |
    2) AD has some default settings that makes it return only the top 1000 users.
    Use ntdsutil.exe to modify these default settings
    |
    3) AD needs to have the right set of users and groups. To configure this, refer
    to WLS docs. This is very well documented in WLS docs. Also refer to this article
    http://dev2dev.bea.com/products/wlportal/whitepapers/wlp70_MSADS.jsp as additional
    reference
    |
    4) Also, there are some bugs with 8.1 portal sp1 and AD. It cannot take more than
    one Authentication provider. sp2 is supposed to have fixed it. For sp1 we used
    another product AD/AM (AD in Application Mode) in combination with MIIS server.
    But if you are using sp2, you shouldn't be worry about this.
    |
    5) In your providers, you might want to get rid of the DefaultAuthentication provider,
    once you are able to establish a connection with your ActiveDirectoryAuthentication
    provider. The DefaultAuthentication provider causes some problems and does not
    let ActiveDirectoryAuthentication provider to behave properly. We haven't fully
    investgated the root of this prob. When we deleted DefaultAuthentication provider,
    everything worked normally - so we didn't really care that much :-)
    |
    6) Make sure you have your JAAS options set to OPTIONAL initially and make sure
    your are able to authenticate talk to your AD.
    |
    These are the ones I could think of. Hope this helps..
    Regards,
    Anant
    "Amit" <[email protected]> wrote:
    >
    Hi,
    We want to do authentication from Microsoft Active Directory using weblogic
    8.1.
    I have created a Active directory and
    configured weblogic from console to use it. But it is still not working.
    Your
    help with these question would be highly
    appreciated.
    1. Is there anyone in group who have tried this before. Please let me
    know how
    to proceed.
    2. Is there any tool by which I can get to know the different attribute
    asked
    for configuration in Weblogic?
    3. I am not able to login to my application after configuration. Is there
    any
    other way to come to know whether it is working
    or not?
    There could be plethora of reason but nothing which can come to my mind.
    Everything
    seems to be configured correctly. Here is
    portion of my config.xml related with authentication:
    <FileRealm Name="wl_default_file_realm"/>
    <PasswordPolicy Name="wl_default_password_policy"/>
    <Realm FileRealm="wl_default_file_realm" Name="wl_default_realm"/>
    <Security GuestDisabled="false" Name="vendavo-dev"
    PasswordPolicy="wl_default_password_policy"
    Realm="wl_default_realm" RealmSetup="true">
    <weblogic.security.providers.authentication.DefaultAuthenticator
    ControlFlag="SUFFICIENT"
    Name="Security:Name=myrealmDefaultAuthenticator" Realm="Security:Name=myrealm"/>
    <weblogic.security.providers.authentication.DefaultIdentityAsserter
    ActiveTypes="AuthenticatedUser"
    Name="Security:Name=myrealmDefaultIdentityAsserter" Realm="Security:Name=myrealm"/>
    <weblogic.security.providers.authorization.DefaultRoleMapper
    Name="Security:Name=myrealmDefaultRoleMapper" Realm="Security:Name=myrealm"/>
    <weblogic.security.providers.authorization.DefaultAuthorizer
    Name="Security:Name=myrealmDefaultAuthorizer" Realm="Security:Name=myrealm"/>
    <weblogic.security.providers.authorization.DefaultAdjudicator
    Name="Security:Name=myrealmDefaultAdjudicator" Realm="Security:Name=myrealm"/>
    <weblogic.security.providers.credentials.DefaultCredentialMapper
    Name="Security:Name=myrealmDefaultCredentialMapper" Realm="Security:Name=myrealm"/>
    <weblogic.management.security.authentication.UserLockoutManager
    Name="Security:Name=myrealmUserLockoutManager" Realm="Security:Name=myrealm"/>
    <weblogic.management.security.Realm
    Adjudicator="Security:Name=myrealmDefaultAdjudicator"
    AuthenticationProviders="Security:Name=myrealmDefaultAuthenticator|Security:Name=myrealmDefaultIdentityAsserter|Security:Name
    =myrealmADAuthenticator"
    Authorizers="Security:Name=myrealmDefaultAuthorizer"
    CredentialMappers="Security:Name=myrealmDefaultCredentialMapper"
    DefaultRealm="true" DisplayName="myrealm"
    Name="Security:Name=myrealm"
    RoleMappers="Security:Name=myrealmDefaultRoleMapper"
    UserLockoutManager="Security:Name=myrealmUserLockoutManager"/>
    <weblogic.security.providers.pk.DefaultKeyStore
    Name="Security:Name=myrealmDefaultKeyStore" Realm="Security:Name=myrealm"/>
    <weblogic.security.providers.authentication.ActiveDirectoryAuthenticator
    ControlFlag="SUFFICIENT" Credential="{3DES}hvEo4sy7g1E="
    DisplayName="ADAuthenticator" FollowReferrals="false"
    GroupBaseDN="ou=ou=Groups,dc=devdc,dc=com" Host="venper5"
    Name="Security:Name=myrealmADAuthenticator"
    Principal="vendev" Realm="Security:Name=myrealm" UserBaseDN="ou=Users,dc=devdc,dc=com"/>
    </Security>
    First, of all is it possible to use Active Directory authentication in
    Weblogic
    without writing any custom code. If yes, how?
    Thanks in advance,
    Amit Tyagi

  • WLS 7.0 Active Directory authenticator - problems starting managed server (Solaris 8)

    Has anyone managed to setup a WLS 7.0 Active Directory authenticator and booted
    a managed server using the node manager? I can boot the server without the AD
    authenticator and I can also boot the server using a script and successfully authenticate
    through AD. My AD control flag is set to OPTIONAL and I have also setup a default
    authenticator to boot weblogic - the control flag here is set to SUFFICIENT. This
    configuration works fine with weblogic running on W2K, but not on Solaris (it
    looks like the control flag is being ignored). Errors as follows
    ####<Oct 1, 2002 1:59:08 PM BST> <Info> <Logging> <mymachine> <server01> <main>
    <kernel identity> <> <000000> <FileLo
    gger Opened at /opt/app/live/appserver/domains/test/NodeManager/server01/server01.log>
    ####<Oct 1, 2002 1:59:09 PM BST> <Info> <socket> <mymachine> <server01> <main>
    <kernel identity> <> <000415> <System
    has file descriptor limits of - soft: 1,024, hard: 1,024>
    ####<Oct 1, 2002 1:59:09 PM BST> <Info> <socket> <mymachine> <server01> <main>
    <kernel identity> <> <000416> <Using e
    ffective file descriptor limit of: 1,024 open sockets/files.>
    ####<Oct 1, 2002 1:59:09 PM BST> <Info> <socket> <mymachine> <server01> <main>
    <kernel identity> <> <000418> <Allocat
    ing: 3 POSIX reader threads>
    ####<Oct 1, 2002 1:59:19 PM BST> <Critical> <WebLogicServer> <mymachine> <server01>
    <main> <kernel identity> <> <0003
    64> <Server failed during initialization. Exception:weblogic.security.service.SecurityServiceRuntimeException:
    Problem instantiating
    Authentication Providerjavax.management.RuntimeOperationsException: RuntimeException
    thrown by the getAttribute method of the Dynam
    icMBean for the attribute Credential>
    weblogic.security.service.SecurityServiceRuntimeException: Problem instantiating
    Authentication Providerjavax.management.RuntimeOper
    ationsException: RuntimeException thrown by the getAttribute method of the DynamicMBean
    for the attribute Credential
    at weblogic.security.service.PrincipalAuthenticator.initialize(PrincipalAuthenticator.java:186)
    at weblogic.security.service.PrincipalAuthenticator.<init>(PrincipalAuthenticator.java:236)
    at weblogic.security.service.SecurityServiceManager.doATN(SecurityServiceManager.java:1506)
    at weblogic.security.service.SecurityServiceManager.initializeRealm(SecurityServiceManager.java:1308)
    at weblogic.security.service.SecurityServiceManager.loadRealm(SecurityServiceManager.java:1247)
    at weblogic.security.service.SecurityServiceManager.initializeRealms(SecurityServiceManager.java:1364)
    at weblogic.security.service.SecurityServiceManager.initialize(SecurityServiceManager.java:1107)
    at weblogic.t3.srvr.T3Srvr.initialize1(T3Srvr.java:703)
    at weblogic.t3.srvr.T3Srvr.initialize(T3Srvr.java:588)
    at weblogic.t3.srvr.T3Srvr.run(T3Srvr.java:276)
    at weblogic.Server.main(Server.java:31)
    ####<Oct 1, 2002 1:59:19 PM BST> <Emergency> <WebLogicServer> <mymachine> <server01>
    <main> <kernel identity> <> <000
    342> <Unable to initialize the server: Fatal initialization exception
    Throwable: weblogic.security.service.SecurityServiceRuntimeException: Problem
    instantiating Authentication Providerjavax.management.
    RuntimeOperationsException: RuntimeException thrown by the getAttribute method
    of the DynamicMBean for the attribute Credential
    weblogic.security.service.SecurityServiceRuntimeException: Problem instantiating
    Authentication Providerjavax.management.RuntimeOper
    ationsException: RuntimeException thrown by the getAttribute method of the DynamicMBean
    for the attribute Credential
    at weblogic.security.service.PrincipalAuthenticator.initialize(PrincipalAuthenticator.java:186)
    at weblogic.security.service.PrincipalAuthenticator.<init>(PrincipalAuthenticator.java:236)
    at weblogic.security.service.SecurityServiceManager.doATN(SecurityServiceManager.java:1506)
    at weblogic.security.service.SecurityServiceManager.initializeRealm(SecurityServiceManager.java:1308)
    at weblogic.security.service.SecurityServiceManager.loadRealm(SecurityServiceManager.java:1247)
    at weblogic.security.service.SecurityServiceManager.initializeRealms(SecurityServiceManager.java:1364)
    at weblogic.security.service.SecurityServiceManager.initialize(SecurityServiceManager.java:1107)
    at weblogic.t3.srvr.T3Srvr.initialize1(T3Srvr.java:703)
    at weblogic.t3.srvr.T3Srvr.initialize(T3Srvr.java:588)
    at weblogic.t3.srvr.T3Srvr.run(T3Srvr.java:276)
    at weblogic.Server.main(Server.java:31)

    Solved the problem. The 'domain root' directory specified in the remote start configuration,
    must contain a copy of the file 'SerializedSystemIni.dat' that was created along
    with the domain, in order to boot when an AD authenticator is configured. If an
    AD authenticator is not configured, no file is required. This was not a platform
    specific issue; on Win2K I had configured the 'domain root' remote start parameter
    to point to an existing domain root and not a new directory.
    "Andrew Walker" <[email protected]> wrote:
    >
    Has anyone managed to setup a WLS 7.0 Active Directory authenticator
    and booted
    a managed server using the node manager? I can boot the server without
    the AD
    authenticator and I can also boot the server using a script and successfully
    authenticate
    through AD. My AD control flag is set to OPTIONAL and I have also setup
    a default
    authenticator to boot weblogic - the control flag here is set to SUFFICIENT.
    This
    configuration works fine with weblogic running on W2K, but not on Solaris
    (it
    looks like the control flag is being ignored). Errors as follows
    ####<Oct 1, 2002 1:59:08 PM BST> <Info> <Logging> <mymachine> <server01>
    <main>
    <kernel identity> <> <000000> <FileLo
    gger Opened at /opt/app/live/appserver/domains/test/NodeManager/server01/server01.log>
    ####<Oct 1, 2002 1:59:09 PM BST> <Info> <socket> <mymachine> <server01>
    <main>
    <kernel identity> <> <000415> <System
    has file descriptor limits of - soft: 1,024, hard: 1,024>
    ####<Oct 1, 2002 1:59:09 PM BST> <Info> <socket> <mymachine> <server01>
    <main>
    <kernel identity> <> <000416> <Using e
    ffective file descriptor limit of: 1,024 open sockets/files.>
    ####<Oct 1, 2002 1:59:09 PM BST> <Info> <socket> <mymachine> <server01>
    <main>
    <kernel identity> <> <000418> <Allocat
    ing: 3 POSIX reader threads>
    ####<Oct 1, 2002 1:59:19 PM BST> <Critical> <WebLogicServer> <mymachine>
    <server01>
    <main> <kernel identity> <> <0003
    64> <Server failed during initialization. Exception:weblogic.security.service.SecurityServiceRuntimeException:
    Problem instantiating
    Authentication Providerjavax.management.RuntimeOperationsException:
    RuntimeException
    thrown by the getAttribute method of the Dynam
    icMBean for the attribute Credential>
    weblogic.security.service.SecurityServiceRuntimeException: Problem instantiating
    Authentication Providerjavax.management.RuntimeOper
    ationsException: RuntimeException thrown by the getAttribute method of
    the DynamicMBean
    for the attribute Credential
    at weblogic.security.service.PrincipalAuthenticator.initialize(PrincipalAuthenticator.java:186)
    at weblogic.security.service.PrincipalAuthenticator.<init>(PrincipalAuthenticator.java:236)
    at weblogic.security.service.SecurityServiceManager.doATN(SecurityServiceManager.java:1506)
    at weblogic.security.service.SecurityServiceManager.initializeRealm(SecurityServiceManager.java:1308)
    at weblogic.security.service.SecurityServiceManager.loadRealm(SecurityServiceManager.java:1247)
    at weblogic.security.service.SecurityServiceManager.initializeRealms(SecurityServiceManager.java:1364)
    at weblogic.security.service.SecurityServiceManager.initialize(SecurityServiceManager.java:1107)
    at weblogic.t3.srvr.T3Srvr.initialize1(T3Srvr.java:703)
    at weblogic.t3.srvr.T3Srvr.initialize(T3Srvr.java:588)
    at weblogic.t3.srvr.T3Srvr.run(T3Srvr.java:276)
    at weblogic.Server.main(Server.java:31)
    ####<Oct 1, 2002 1:59:19 PM BST> <Emergency> <WebLogicServer> <mymachine>
    <server01>
    <main> <kernel identity> <> <000
    342> <Unable to initialize the server: Fatal initialization exception
    Throwable: weblogic.security.service.SecurityServiceRuntimeException:
    Problem
    instantiating Authentication Providerjavax.management.
    RuntimeOperationsException: RuntimeException thrown by the getAttribute
    method
    of the DynamicMBean for the attribute Credential
    weblogic.security.service.SecurityServiceRuntimeException: Problem instantiating
    Authentication Providerjavax.management.RuntimeOper
    ationsException: RuntimeException thrown by the getAttribute method of
    the DynamicMBean
    for the attribute Credential
    at weblogic.security.service.PrincipalAuthenticator.initialize(PrincipalAuthenticator.java:186)
    at weblogic.security.service.PrincipalAuthenticator.<init>(PrincipalAuthenticator.java:236)
    at weblogic.security.service.SecurityServiceManager.doATN(SecurityServiceManager.java:1506)
    at weblogic.security.service.SecurityServiceManager.initializeRealm(SecurityServiceManager.java:1308)
    at weblogic.security.service.SecurityServiceManager.loadRealm(SecurityServiceManager.java:1247)
    at weblogic.security.service.SecurityServiceManager.initializeRealms(SecurityServiceManager.java:1364)
    at weblogic.security.service.SecurityServiceManager.initialize(SecurityServiceManager.java:1107)
    at weblogic.t3.srvr.T3Srvr.initialize1(T3Srvr.java:703)
    at weblogic.t3.srvr.T3Srvr.initialize(T3Srvr.java:588)
    at weblogic.t3.srvr.T3Srvr.run(T3Srvr.java:276)
    at weblogic.Server.main(Server.java:31)

  • Active Directory Authentication and permissions for user group in APEX 4.0

    Hello,
    I am new to oracle APEX and I have searched the forum for active directory authentication for a user group and I am really confused about all the different threads. Can anyone please provide me the steps to follow; in order to implement AD authentication for a user group in Oracle APEX 4.0.
    These are the threads which i was looking at to get an idea like how AD authentication works but its really confusing for me.
    Help with Authentication (APEX_LDAP.AUTHENTICATE)
    Re: LDAP Authentication Via Groups
    Thanks,
    Tony

    You need to give it more than 30 minutes before bumping your own post. This is not an official support channel, so you need to be patient and wait for people to read, think and respond.

  • Active Directory Authentication, AFP Home Folders in the wrong place!

    Hi,
    I've had this problem off and on... that is, it comes and goes, so I'm not really able to effectively troubleshoot it. My setup is this:
    -Xserve G5, Mac OS X Server 10.4.7
    -OD Master bound to AD for authentication
    -Hosts AFP and SMB shares, all stored on Xserve RAID
    On the RAID, I have a folder called Users (/Volumes/XserveRAID/Users) that is shared via AFP. The system Users folder (/Users) is not shared. In fact, nothing at all on the root drive is shared. All share points are on /Volumes/XserveRAID/. All Mac users' home directory profiles are pointed to \\servername\Users\username (in Active Directory Users and Computers application on our domain controller). Their home directories mount automatically when they log into their client machines (also bound to AD).
    The problem is this; at seemingly random times, a user's home folder will all of a sudden be created in /Users on the server, and it will not use the /Volumes/XserveRAID/Users/ folder. I will clean out /Users every now and again, but the errant home folders show back up. The only folder that should be in /Users is the local admin.
    Since /Users is not even shared, how is it doing this? Why is it that sometimes the /Volumes/XserveRAID/Users share is used (I know this because there are users' files in their folders in the proper place) and sometimes it's going to /Users? Any ideas? Thanks in advance!!
    Going slightly mad,
    Jason

    Hi there,
    Just wanted to share my make-due solution.
    I have setup the automount sharepoint at "/Data/Home".
    When I logged in or tried to use createhomedir in terminal, nothing happened but users could login (even though there was no home folder on the sharepoint for them).
    I have created the Home Folders manually "/Data/Home/username" and then logged in again. When I did this it created two folders in the home dir:
    -Desktop
    -Library
    The other icons related to the home dir on the Dock remain big "?" 's.
    So I manually added them and assigned them the propper rights.
    Now users can log in without any problems, network home folders are working.
    So essentially I got thing s to work, luckily I have only a hand full of Mac Users, Imagine having a user base in the hundreds !
    Thinking about this really makes me want to know how I can fix this problem, I have a make shift solution but this really isn't the way to go. When I use the createhomedir command, it says "creating homedir on servername.domain.net" and it seems to be busy for like 20 - 30 secs, but after that nothing has changed.
    I've checked all possible locations on the server (i thought maybe it might have made local accounts on server by accident, but it didn't.)
    If anyone has ANY idea, please share.
    Thx!!
    Have a nice day

  • Windows server firewall blocking active directory authentication?

    I'm having problems with authenticating macs on our windows 2003 server domain. When windows firewall is activated, mac clients(10.4) can no longer login. I've tried opening a number of ports e.g.TCP/UDP 53. UDP 464. but no luck. Any ideas which ports are necessary for the AD plugin to work properly?
    Thanks.
    macpro   Mac OS X (10.4.8)   1gb ram

    Why are you enabling Windows firewall on a domain controller?
    My recommendation is to turn it off and protect your entire site with a hardware firewall. The ports you need to open up are the very ones you should be blocking from the world to prevent attacks.
    Short of that:
    http://www.microsoft.com/downloads/details.aspx?FamilyID=c2ef3846-43f0-4caf-9767 -a9166368434e&displaylang=en
    User Login and Authentication
    A user network logon across a firewall uses the following:
    • Microsoft-DS traffic (445/tcp, 445/udp)
    • Kerberos authentication protocol (88/tcp, 88/udp)
    • Lightweight Directory Access Protocol (LDAP) ping (389/udp)
    • Domain Name System (DNS) (53/tcp, 53/udp)
    Computer Login and Authentication
    A computer logon to a domain controller uses the following:
    • Microsoft-DS traffic (445/tcp, 445/udp)
    • Kerberos authentication protocol (88/tcp, 88/udp)
    • LDAP ping (389/udp)
    • DNS (53/tcp, 53/udp)
    Access File Resource
    File access uses SMB over IP (445/tcp, 445/udp).
    Perform a DNS Lookup
    To perform a DNS lookup across a firewall ports 53/tcp and 53/udp must be open. DNS is used for name resolution and supports other services such as the domain controller locator
    ...

  • Getting AADSTS50020 error on microsoft login page when using Azure Active Directory Authentication

    We have implemented Azure Ad single sign on using auto generated code from Visual studio 2013 with organization account authentication and its working fine.
    The problem is when user is logged in in azure management portal with his live account and in other tab he try to open our app, then he directly gets below error on Microsoft login page.
    Additional technical information:
    Correlation ID: 78e13474-6f92-40ec-b463-91e36a6dae84
    Timestamp: 2015-04-14 12:27:20Z
    AADSTS50020:
    User account '[email protected]' from external
    identity provider 'live.com' is not supported for application
    'https://xxxxx.onmicrosoft.com/xxxx'. The account needs to
    be added as an external user in the tenant. Please sign out and sign in
    again with an Azure Active Directory user account.
    It works fine if I log out from management portal. Is there any way to resolve this issue without forcing user to log out from live account(management portal)?

    I assume you created a web application using VS2013 which uses the WS-Federation protocol.
    The behavior that you are seeing is expected Single-sign-on because you are logged in using the live account in the management portal.
    For WS-Federation, there is no current way for a caller to specify they want to force a fresh login, so the behavior is always the equivalent of LoginBehavior.Normal.
    The user will need to either sign-out or use an in-private session in the browse.
    If you switch to openID connect(sample at
    https://github.com/AzureADSamples/WebApp-OpenIDConnect-DotNet) and use the “prompt=login” query paramerter in the sign in request, this will force a fresh login.

  • Active Directory + Resource action to delete home directory

    Hi all,
    I am trying to delete home directory from the disk physically after the user is deleted from AD. I followed the link http://docs.sun.com/app/docs/doc/820-6551/bzbuc?a=view and implemented the delete resource action as mentioned in the link.
    here are the steps i followed (For testing, I mentioned delete >> C:\test.txt to see if it deletes the text file)
    1. Enter delete after action in the Identity Manager User Attribute column of the resource’s schema map.
    2. In the Attribute Type column, select string.
    3. In the Resource User Attribute column, enter IGNORE_ATTR. Leave the Required, Audit, Read Only, and Write Only columns unchecked.
    4. Add this to the Deprovision Form user form after the </Include> tag:
    <Field name= ’resourceAccounts.currentResourceAccounts[AD].attributes.
    delete after action’>
    <Expansion>
    <s>AfterDelete</s>
    </Expansion>
    </Field>
    5. Create the following XML file and import into Identity Manager. (Change file paths according to your environment.)
    <?xml version=’1.0’ encoding=’UTF-8’?> <!DOCTYPE Waveset PUBLIC
    ’waveset.dtd’ ’waveset.dtd’>
    <Waveset>
    <ResourceAction name=’AfterDelete’>
    <ResTypeAction restype=’Windows Active Directory’ timeout=’6000’>
    <act>
    echo delete >> C:\test.txt
    exit
    </act>
    </ResTypeAction>
    </ResourceAction>
    </Waveset>
    6. Edit the XML for the Active Directory resource and add information to the “delete after action” schema mapping. Here is an example of a complete schema mapping for this resource with the new additions. (You will be adding the views-related information.)
    <AccountAttributeType id=’12’ name=’delete after action’ syntax=’string’
    mapName=’IGNORE_ATTR’ mapType=’string’>
    <Views>
    <String>Delete</String>
    </Views>
    </AccountAttributeType>
    To test, I deleted a user from AD and I was expecting the file c:\test.txt to be deleted as it invokes the Resource action after delete. Has anyone been successful in deleting the home directory from drive after the user is deleted. Any pointers or help
    Thanks,
    Ani

    Hi Gaurav,
    I have to implement Resource Action functionality for Solaris system. I followed the link http://download.oracle.com/docs/cd/E19225-01/820-6551/bzbuc/index.html and the first message of this thread. I am using 8.1 IDM.
    But unfortunately I can’t trigger any bash commands on the resource like echo deleting of user wiht next name - $WSUSER_accountId >> /tmp/resultFile.txt.
    There are any errors on log file.
    Can you share your work configuration and steps to reproduce?
    I have done next but Resource Action doesn’t triggered:
    1. My Action:
    <?xml version='1.0' encoding='UTF-8'?>
    <!DOCTYPE Waveset PUBLIC 'waveset.dtd' 'waveset.dtd'>
    <Waveset>
    <ResourceAction name='AST-ResAct-SOL-AfterDelete'>
    <ResTypeAction restype='Solaris' timeout='6000'>
    <act>
    #!/usr/bin/bash
    echo deleting of user wiht next name - $WSUSER_accountId >> /tmp/resultFile.txt
    exit 0
    </act>
    </ResTypeAction>
    </ResourceAction>
    </Waveset>
    2. Added next line to “Deprovision Form”
    <Field name='resourceAccounts.currentResourceAccounts[SOLARIS 10].attributes.delete after action'>
    <Expansion>
    <s>AST-ResAct-SOL-AfterDelete</s>
    </Expansion>
    </Field>
    3. Added a new attribute mapping on the resource:
    <AccountAttributeType id='12' name='delete after action' syntax='string' mapName='IGNORE_ATTR' mapType='string'>
    </AccountAttributeType>
    4. Assigned role (this role provisioned resource to user) to user, delete user from resource via Deprovision IDM page. But my Action commands didn’t trigger on resource.
    Thanks’ in advance!

  • Web-controller Active Directory authentication

    We have a 10.5.7 xserve as our Podcast Producer server. The server is tied to Active Directory for authentication. I just recently installed the web controller. When I authenticate with a local server account, I get in just fine. But, when I try to authenticate to the web controller with an AD account it fails.
    Now I know that since 10.5.6 in Podcast Capture I have had to select "single sign-on" in the app's preferences. Does anyone know if there is something similar in the web controller?

    I figured it out. May not be the perfect solution, but it works until 10.5.8.
    In /Library/Preferences/com.apple.pcastserverd.plist
    Find the following:
    <key>httpauthtype</key>
    <array>
    <string>basic</string>
    <string>digest</string>
    <string>kerberos</string>
    </array>
    Change to:
    <key>httpauthtype</key>
    <array>
    <string>basic</string>
    </array>
    Restart PCP:
    sudo launchctl unload /System/Library/LaunchDaemons/com.apple.pcastserverd.plist
    sudo launchctl load /System/Library/LaunchDaemons/com.apple.pcastserverd.plist
    Log into your server with an AD account at https://server.domain:8143

  • Oracle database and Windows Active directory authentication

    Hello,
    Our developers have created a couple of web apps which look at our oracle database. Presently they use the APPS user and the user/password is hard coded into the config files.
    Is it possible to authenticate these using Windows Active Directory instead? Is it possible to use AD authentication for all developer access to the database?
    I'm trying to research this on the web but getting very confused. Would a lot of work be involved to get this up and running?
    Is anyone able to offer and advise?
    Thank you very much
    Sarah

    I don't have experience in joining a Linux system with Windows AD, and it generally does not sound like the best idea to me, but since Oracle Enterprise Linux is a clone of Red Hat Enterprise Linux, the solution you are looking for could be called Winbind.
    Perhaps the following links are useful:
    http://spiralbound.net/blog/2007/04/11/rhel-winbind-authentication-against-active-directory
    http://www.linuxmail.info/active-directory-integration-samba-centos-5/
    http://magazine.redhat.com/2007/11/12/tips-and-tricks-how-can-i-configure-winbind-to-synchronize-user-and-group-ids-across-multiple-red-hat-enterprise-linux-hosts-on-active-directory-accounts/

  • Windows Active Directory Authentication

    Hi Experts,
    I have an enterprise application running in a clustered environment. The jars are diployed in jboss and wars in tomcat servers. The requirement is to authenticate users with thier Windows username/password with active directory itself and depending upon their roles give access to various functionalities in the application. Could someone guide on how the windows authentication should be done?
    Thanks

    We were able to successfully enable the Windows AD Authentication.
    Section 4 would be on the SIA's or server tier. Sections 5,6,and 7 would be for the Java Web app server or web tier.
    We got an error when trying to enable SSO though.
    The server encountered an internal error (com.wedgetail.idm.sso.ProtocolException: com.wedgetail.idm.spnego.server.SpnegoException: GSSException: Failure unspecified at GSS-API level (Mechanism level: com.dstc.security.kerberos.KerberosException: Successfully matched service principal "account@domian_name" but not key type (18) + KVNO (32) in this entry: Principal: [1] account@domain_name TimeStamp: Wed Dec 31 19:00:00 COT 1969 KVNO: -1 EncType: 23 Key: 16 bytes, fingerprint = [......] )) that prevented it from fulfilling this request.
    We disabled the SSO for the time being, but the Windows AD works fine.

  • Active Directory - Authentication Problem

    Hi Guys,
    I'm seeing something really weird in my Environment.
    For example, we have two users as example below in our Active Directory:
    jonesp - Paul Jones
    jonesph - Phillip Jones
    These users can't login into any Mac connected in Active Directory, on PCs the login goes fine.
    But when I renamed the login jonesp to jonespa, both users can login in the Macs.
    Anyone have this issue too? There is a KB telling about this behavior?
    This happens on Macs running 10.7.* and 10.8.*.
    Thanks

    Sorry CT,
    The problem isn't with Active Directory, this only happens on Macs.
    The problem doesn't happens with Windows and Linux, only on Macs.
    Anyway thanks for your help.
    Regards

Maybe you are looking for

  • How do I delete a Library from Final Cut Pro 10.1?

    I created a new Library in FCP 10.1 but now I can't delete it (option to delete it in the menu is grayed out).  I know you have to have at least one Library but there is another Library so that isn't the problem.  Thoughts? Thanks, Paul

  • SAXException using XML driver

    Hi all, When I use the Xml driver on a XML file that has namespace specified within, I got this error : java.sql.SQLException: A SAXException was caught while reading the model saying The markup in the document preceding the root element must be well

  • Profit calculation variations COGS

    I found that in SAP B1 the profit calculation varies and it depends on where you look and the different settings allowed. For instance: I am talking about the calculation method of COGS: 1. In System Initialisation/Document Setting one can set the wo

  • Google Earth Plugin doesn't work on Firefox. But it works on other browsers such as Google Chrome.

    Google Earth plugin always says "There was a problem with the Google Earth Plugin. Please try reloading the page. If that doesn't help, you can re-install the Google Earth Plugin using this link." However, other browsers such as Google Chrome does no

  • ORA-01428: argument '0' is out of range

    Hi, in 10g R2 , I created (code found in David Kurtz article) a function as follows but when use it I receive an error : SQL> CREATE OR REPLACE FUNCTION h2i (p_hash_value NUMBER) RETURN VARCHAR2 IS   2  l_output VARCHAR2(10) := '';   3  BEGIN   4  FO