802.1x - Authenticating users from two domains on one switch

Hi
Trying to figure out if there is a way to have a switch authenticate devices from two different domains
For example   Computer A is in Domain A  Computer B is Domain B
Computer A is connected to f0/1 computer B is connected to F0/2
I am thinking that i have to configure multiple Radius server entries  One for domain A and one for domain B and reduce the timeout if possible
Any ideas or solutions?
Thank you for your help..

What's your RADIUS server?
ISE 1.3 allows you to join it to multiple domains.
Even with ISE 1.2, you could join one AD domain and also use the identities from a second one via LDAP.
Multiple RADIUS server entries won't normally try the second one as long as the primary is responsive - a failed authentication counts as a legitimate response. You can setup round robin or least outstanding methods but that still doesn't give you the "check both to see if one gives me a good authentication" result.

Similar Messages

  • How to grant access to sharepoint for the user from different Domain

    Hi All
        I need to grant access to user from different domain. 
        Where I can able to view the users in people picker (different domain).
    Thanks in Advance.
    Raj

     Hi
    Trevor Seward
    Sorry to disturb
    you again.
      I am trying to restrict user from search from other domain, say we have domain A and Domain B, where I am trying to restrict all the user from domain B (Search users)for a site collection. I have found couple of stsadmin command to do so. but none
    of them works. Below are the commands I have tried
    STSADM.exe -o setproperty -pn peoplepicker-searchadforests -pv "domain:<Name>.domain" -url "http://Site URL"
    stsadm -o setproperty -pn peoplepicker-searchadcustomquery -pv “(canonicalName=<Name>.domain*)” -url "Site URL"
    we have two way trust.
    Can you suggest any solution.
    Thanks 
    Raj

  • Grant access to users from different Domains

    Hi,
    Recently my company was merged with another. All users from my company are setup in our Domain (DomainA). Sharepoint is able to see the users in this domain and grant access to the users as well. When the merger happened, we created a Group (Test - Sharepoint)
    in our AD to add groups from other companie's domain:DomainB, totally different Forest. There is a two way trust setup between these domains. The group Test-Sharepoint is "domain local" and it is able to see the groups/users from other domain: DomainB.
    The other users are now able to access our sharepoint environment once access is granted to DomainA\Test-Sharepoint.
    Problem came when we applied Audience targetting around few web parts. The users from DomainB who are added as object in DomainA\Test-Sharepoint (group in DomainA) are not able to see the web parts that have audience targeting for this group. Someone
    suggested that AD groups should be Global or Universal but that is not our case. Most of the groups in our AD are domain local and SP is able to see the users within it.
    Please suggest how we can resolve audience targeting issue?
    Regards, Kapil ***Please mark answer as Helpful or Answered after consideration***

    My apologies, yes that is correct you'll have to use Domain Local in this case. http://technet.microsoft.com/en-us/library/cc755692(v=WS.10).aspx
    Actually what you'll need to do is not use Groups in your domain at all, as the users are Foreign Security Principals. Instead, use a group in the trusted domain, or attributes of the users you intend to target directly.
    Trevor Seward
    Follow or contact me at...
    &nbsp&nbsp
    This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

  • LDAP query to fetch users from Two different OU

    I am looking for an AD query to get AD enabled users from two different OU Stores & ServiceOffice under root domain.
    Using below syntax to fetch it simultaneously but not succeeding. Please help me.
    (&(objectCategory=person)(|(ou=Stores)(ou=ServiceOffice)))

    Hi Thanks for the revert. Actly i am setting this syntax in application not running powershell script to fetch users.
    So i need query in Ldap filter format only...
    i.e.
    (&(objectCategory=person)(|(OU=Stores,DC=Mumbai,DC=Users,DC=ABC,DC=com)(ou=ServiceOffice,DC=Chennai,DC=users,DC=ABC,DC=com)))
    Please correct my above query.

  • Cannot prevent authenticated users from creating a blog on "My Page"

    I have a brand new Snow Leopard (10.6.1) 2.26 Ghz quad core Xserve with 12Gb RAM that will be used for web collaboration services. I've currently set up Wiki and Blog services with a group membership to allow creating wikis/blogs. The reason for this is for staff development purposes with the plan to add people into the group as they are trained. The process to set it all up was very simple, however, I'm having an issue preventing authenticated users from creating a personal blog. Although I can prevent the creation of wiki's to members of a group easily, any authenticated user on the server can log into "My Page" and will be able to create a blog. I've gone to server admin>choose the server>choose the "access" icon and set the column "for selected services below" (blog) to "allow only users and groups below" (the group) and it still doesn't prevent them from making a blog page. In WGM for the group on the "Basic" tab, the "enable the following services for this group" has only the choice of "none" and therefore since the site isn't showing as a choice, the Wiki, Blog, Calendar and Mailing List is grayed out. I've seen another thread that states in 10.6 that option for setting the service acl in the group settings of WGM is unavailable. Does anyone know a fix for my problem of security access for a "My Page" blog or is it a possible bug in Snow Leopard? Right now my only workaround is to remove the users access and enable it as they are trained. This isn't an ideal fix, however, because we have some users who want to limit their wiki or blog to authenticated users only, not public access. Any help will be greatly appreciated.
    Message was edited by: dstrollo.il

    Ran into this same issue.... Talked with a field engineer who confirmed the behavior. The question now is this a defect or "feature that does not work as as the audience desires". As I far can tell, the security setting for blogs in server admin does nothing at all. This has the potential to cause a few issues as you cannot limit who can have a blog.
    Message was edited by: jlindler

  • 10.6.1 Server - cannot prevent authenticated users from creating a blog

    I have a brand new Snow Leopard (10.6.1) 2.26 Ghz quad core Xserve with 12Gb RAM that will be used for web collaboration services. I've currently set up Wiki and Blog services with a group membership to allow creating wikis/blogs. The reason for this is for staff development purposes with the plan to add people into the group as they are trained. The process to set it all up was very simple, however, I'm having an issue preventing authenticated users from creating a personal blog. Although I can prevent the creation of wiki's to members of a group easily, any authenticated user on the server can log into "My Page" and will be able to create a blog. I've gone to server admin>choose the server>choose the "access" icon and set the column "for selected services below" (blog) to "allow only users and groups below" (the group) and it still doesn't prevent them from making a blog page. In WGM for the group on the "Basic" tab, the "enable the following services for this group" has only the choice of "none" and therefore since the site isn't showing as a choice, the Wiki, Blog, Calendar and Mailing List is grayed out. I've seen another thread that states in 10.6 that option for setting the service acl in the group settings of WGM is unavailable. Does anyone know a fix for my problem of security access for a "My Page" blog or is it a possible bug in Snow Leopard? Right now my only workaround is to remove the users access and enable it as they are trained. This isn't an ideal fix, however, because we have some users who want to limit their wiki or blog to authenticated users only, not public access. Any help will be greatly appreciated.

    Thanks for the suggestion, but that would prevent all users from creating personal blogs. I was hoping to be able to have a group of users that can create a personal blog outside of the blog attached to a wiki.

  • Can I have two Domain in one network?

    I have two Server in my office in same network.
    Server A is Active Directory / Domain Server. Certain user join domain and connect to this server.
    Server B is File Server. The other user just use Workgroup. But now this server want to Up Domain to be Domain Server.
    But user that connect to the domain Server A will not connect to domain server B and user connect to domain server B will not connect to domain server A.
    Is there any problem if I setup two domain in one network?
    Please Advise.

    Domains are logical structure of your network. Yes you can create two domains in the same network. One thing you should consider in this scenario is trusts between your domains. By default separate domains have not any trusts between each other and you should
    establish trust manually if you would like to have users in A authenticated in domain B.
    Regards.
    Mahdi Tehrani Loves Powershell
    Please kindly click on Propose As Answer or to mark this post as
    and helpfull to other poeple.

  • I have an iPhone 4, My itunes are from two differnt accounts; one from when I was under my dads account, and the other is my own. My question is would I be able to sync and update my itunes on my MacBook without having all the new music erased.

    I have an iPhone 4, My itunes are from two differnt accounts; one from when I was under my dads account when i was younger, and the other is my own which i currently use. My question is would I be able to sync and update my itunes on my MacBook without having all the new music erased. I have the icloud on my phone, but I just want to update my music on my laptop. Just nervous to, because it has happened to me before on a desktop computer  and it *****. Please help! Thanks.

    nevermind, i figuered it out

  • HT1449 how do you move all music from two computers into one itunes account?

    How do you move all music from two computers into one itunes account?

    An "iTunes account" is an online account you use for buying music, like a bank account.  An iTunes collection is the media you see when you open iTunes. Which do you mean?
    If it is two computers, it would also help to know where these are located. Are they on the same local network? If they are, try Home Sharing (and you have control of both and you aren't just trying to get music fro your computer to your friend's computer in another state).  If they are not, you'll have to use an external hard drive or flash drive.
    Is this on a PC? Your computer information says Windows but you posted this in the iTunes for Mac forum.

  • Delete from two tables in one statement

    Hi,
    Is there a way to delete from two tables in one statement?
    Actually I have two tables:
    1. Base table (id, name, age)
    2. Person table (id, city, street)
    The id in both tables is identical.
    I would like to delete using something like a join:
    Delete from base, person where id=2;
    Thanks
    dyahav

    Hi,
    If you want to delete records both at a time them your table must use ON DELETE CASCADE. See the below example.
    CREATE TABLE supplier
    ( supplier_id numeric(10) not null,
    supplier_name varchar2(50) not null,
    contact_name varchar2(50),
    CONSTRAINT supplier_pk PRIMARY KEY (supplier_id)
    CREATE TABLE products
    ( product_id numeric(10) not null,
    supplier_id numeric(10) not null,
    CONSTRAINT fk_supplier
    FOREIGN KEY (supplier_id)
    REFERENCES supplier(supplier_id)
    ON DELETE CASCADE
    In this example, we've created a primary key on the supplier table called supplier_pk. It consists of only one field - the supplier_id field. Then we've created a foreign key called fk_supplier on the products table that references the supplier table based on the supplier_id field.
    Because of the cascade delete, when a record in the supplier table is deleted, all records in the products table will also be deleted that have the same supplier_id value.
    Thank you.

  • How can I stop authenticated users from getting other user's information?

    We recently discovered that it is possible for authenticated users, via KMu2019s details view, to view details about the other users that have access to the same resource as you.  Our portal (7.0 sp15) is used for an external facing web site.  We have secured it against anonymous users but the problem still remains for authenticated users.  Here is an example:
    The KM folder documents\Public Documents has been assigned read permissions for the group Everyone.  An authenticated user can open the URL https://<host>/irj/go/km/navigation/documents/Public%20Documents and a list of folders are shown.  The user can then select the Details from the menu for one of the folders and the Details iview is displayed.  They then select the menu item Settings > Permissions and the users/groups/roles assigned to this folder are shown.  The user can then select a user and view that users name and email address or the user could select a group and view for each member of the group the user id, name, and email address which could then be used to help attack the site.
    So I thought it would be easy enough to disable the details view for all users but content managers or administrators but I seem to running into difficulty. 
    I tried disabling the Details KM command with limited success.  Even with it disabled, if you know the URL for the details component you can still access it.  So it seems the better option is to take away access to the details component.  It seems that the users are getting access to the Details iView from the standard eu_role.  If I remove the iView from this role then all user have no access to the Details in KM.  I tried to add the iView to another role that content managers would have but when logged in with a user that had that other role I still was not able to access the Details iView. 
    This SAP Help document [http://help.sap.com/saphelp_nw70/helpdata/en/47/f0f7415e639c39e10000000a155106/frameset.htm |http://help.sap.com/saphelp_nw70/helpdata/en/47/f0f7415e639c39e10000000a155106/frameset.htm ]discusses the eu_role(Standard User role) and it states that
    By default, the Everyone group is assigned to the Standard User role. If you choose to use the other every user roles instead, you need to remove these assignments from the Standard User role and apply them to the Every User Core and Control Center User roles.
      But, when I look at what groups the role is assigned to or what roles are assigned to the Everyone group they donu2019t appear to be linked contrary to what the documentation says.  So, what Iu2019m thinking here is that I can create a copy of this role and remove the Details iView from the original and then assign the copy to the content managers and administrators.  Doing this causes all users to lose access, even the content managers.
    I thought Iu2019d give the Security Zones a try to see if this could help me but when I take away rights from here it still allows access.
    Iu2019m stumped.  Iu2019m sure there is some key piece that eludes me.  What can I do to allow users read only access to some KM folders and files while preventing them from viewing the permission/user details?

    The only 3d party apps are Hazel...
    And that's your problem!
    From the Hazel site's description:
    Hazel watches whatever folders you tell it to, automatically organizing your files according to the rules you create.
    Hazel, is a prefPane so you must have some rule (or it supplied the rule as a default) to put pictures (jpg's) from your Desktop (folder) into your Pictures folder.
    Open your System Preferences and Hazel in there and either turn off Hazel or change or delete the appropriate rule covering this situation.

  • Read group membership for a user object and populate every group with matching user from another domain

    I have LON\JSmith in LON domain and DEL\JimSmith in DEL domain
    I would like to extract group memberships of LON\JSmith in LON domain and append matching by email (i.e. DEL\JimSmith) user object in every group in LON domain.
    for instance
    LON\JSmith and DEL\JimSmith is the same person and has same email address [email protected]
    LON\JSmith belongs to 3 groups - LON\localadmingroup;LON\univdesktop;LON\globalsurvey
    The outcome of the script should be
    LON\JSmith; DEL\JimSmith    should be in 3 groups - LON\localadmingroup;LON\univdesktop;LON\globalsurvey.
    How can i do it?
    Navgup

    Hi Navgup,
    Please refer to the script below, to query users in other domain by specifying the parameter "-Server" in the cmdlet "get-aduser", and also note I haven't tested the script below:
    import-module activedirectory
    get-adgroupmember "group"|foreach{
    $email=(get-aduser $_.samaccountname -properties *).EmailAddress#get the user email
    Get-ADUser -filter {EmailAddress -eq $email} -properties * -server DomainB.company.com|select samaccountname, memberof}#filter user name and group with the email in other domain
    To get users across domain, please also refer this blog:
    Adding/removing members from another forest or domain to groups in Active Directory:
    http://blogs.msdn.com/b/adpowershell/archive/2010/01/20/adding-removing-members-from-another-forest-or-domain-to-groups-in-active-directory.aspx?Redirected=true
    I hope this helps.

  • Send connector - e-mails from two domains to distinct anti-spam IPs

    I have an Exchange enviroment that has two domains. I want that e-mails sent from a domain do the relay to an anti-spam, and e-mails sent from another domain do the relay to another anti-spam.
    Example:
    I need to config send connector to send the e-mails from "test1.com" to IP 10.160.190.66 and from "test2.com" to IP 10.160.190.69
    How do I do?
    I need this because each domain uses distincts anti-spam
    Tks.

    Hi,
    Before going on, I would like to confirm the following information.
    What's the version of the Exchange?
    Whether the two domains have their own Exchange or share one Exchange?
    Thanks
    Allen

  • Issue using ADSI in powershell to load users from another domain into a group

    I am trying to load users into a domain local security group from another domain using ADSI and powershell. For users who have an existing foreign security principal I can load that without issue, but the users who do not have a foreign security principal
    I am unable to load.
    These work fine, assuming the group domain is fabrikam:
    $Group.psbase.invoke("Add",[ADSI]"LDAP://CN=$external_user_sid_who_has_a_FPN,CN=ForeignSecurityPrincipals,DC=fabrikam,DC=com")
    $Group.psbase.invoke("Add",[ADSI]"LDAP://$userDN,DC=fabrikam,DC=com")
    These does not:
    $Group.psbase.invoke("Add",[ADSI]"LDAP://CN=$externaluser_sid_who_does_not_have_a_FPN,CN=ForeignSecurityPrincipals,DC=fabrikam,DC=com")
    $Group.psbase.invoke("Add",[ADSI]"LDAP://<SID=$external_user_sid_who_does_not_have_a_FPN>")
    $Group.psbase.invoke("Add",[ADSI]"LDAP://<SID=$external_user_hex_sid_who_does_not_have_a_FPN>")
    Any help would be greatly appreciated.
    Thank you

    Thank you for your reply,
    I started with that thread and it ultimately recommends using the [ADSI]"LDAP://<SID=$hexsid>, this bind is not working for me. The page it points to for conversion of sid to hexsid is in VBS, but I have used the below powershell to duplicate its function.
    $sid = "S-1-5-21-2127521184-1604012920-1887927527-72713"
    $parts = $sid.Remove(0,6).Split("-")
    foreach ($part in $parts)
    $hex = ([Convert]::ToString($part, 16)).ToUpper()
    While ($hex.length -lt 8)
    $hex = "0" + $hex
    for ($i=1; $i -lt 5; $i++)
    $reverseEndian = $reverseEndian + $hex.substring($hex.length -2, 2)
    $hex = $hex.Remove($hex.length -2, 2)
    $hexSid = "0105000000000005" + $reverseEndian
    For example SID S-1-5-21-2127521184-1604012920-1887927527-72713 needs
    to be turned into raw hex sid 010500000000000515000000A065CF7E784B9B5FE77C8770091C0100 according to that article and
    then put in the ADSI bind like this: [ADSI ]"LDAP://<SID=010500000000000515000000A065CF7E784B9B5FE77C8770091C0100>". 
    When I put that bind in (with an actual sid and not an example sid) I get the following error:
    format-default : The following exception occurred while retrieving member "PSComputerName": "There is no such object on
    the server.
    + CategoryInfo : NotSpecified: (:) [format-default], ExtendedTypeSystemException
    + FullyQualifiedErrorId : CatchFromBaseGetMember,Microsoft.PowerShell.Commands.FormatDefaultCommand
    For users who are on another domain but already have a foreign principal name created, I can add them easily enough by converting their sid to the appropriate foreign principal name format. I haven't yet had any success adding someone who doesn't have a
    foreign principal name though, even after trying the solution referenced in the article.
    Thank you in advance for any help.

  • People Picker Showing Users From Both Domains

    We recently have begun setting up and laying out SharePoint 2010 Standard. It was brought to my attention that when using the search/browse function of the 'people picker' it is showing users from both the domains currently available on our network. Our
    current domain is a *.local domain and the old one which is no longer used for very much is a *.com domain. I have researched this issue and tried running the stsadm 'getproperty' and 'setproperty' commands. The 'getproperty' command for "peoplepicker-distributionlistsearchdomains",
    "peoplepicker-searchadforests", "searchadfilter", etc; always returns "<Property Exist="No" />" even after I have just run a set command and it reports that the command had run successfully. I read something
    about setting the stsadm -o setapppassword -password command, but I am unsure what this does to the current sharepoint configuration.
    Hopefully someone can help me fix this issue so that when people select browse/search only users from the *.local domain are shown.
    Thank you very much to anyone who can help me with this. I have been researching this issue for some time, but my knowledge regarding SharePoint is very limited, and I do not want to continue trying other more in-depth approaches I have found that may resolve
    this issue until I am better informed.

    This is normal when there is a trust between the domains. It is also normal if you previously added users from the .com domain to a SharePoint site as they'll be in the ULS logs.
    To resolve the first type of issue, where a trust does exist, run:
    stsadm -o setproperty -pn peoplepicker-searchadforests -pv "forest:domain.local" -url http://webAppUrl
    To resolve the second issue, run:
    $user = Get-SPUser -Identity "COMdomain\username" -Web http://webUrl
    Move-SPUser -Identity $user -NewAlias "LOCALdomain\username" -IgnoreSid
    Trevor Seward, MCC
    Follow or contact me at...
    &nbsp&nbsp
    This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

Maybe you are looking for