Troubleshooting Authentication

Configuration guides, troubleshooting and practical advice for AZTCOFW.

Articles

9 results

Active Directory Group Membership

Depending on how the Active Directory groups were made, the way they are specified may be different for things like Authentication Containers and/or Extended Query. For example, a traditional user group in AD is exposed

Bind Credentials

If Anonymous binds are not being used, the username supplied can be the short name (e.g. DOMAIN\User for AD) or a full LDAP specification for a user (e.g. CN=administrator,CN=Users,DC=example,DC=com). Tip: If the full DN

Connection-Related Issues (non-SSL)

Make sure that the LDAP server is listening on the expected port, and that connectivity to the LDAP server’s network is functional. Performing a packet capture filtered on the LDAP server’s IP address and port will help

Connection-Related Issues (SSL)

By far the most troublesome connection issues people have are with LDAP+SSL (ldaps) because it is so secure in how it operates. Hostname Required When connecting to LDAP with SSL, the hostname given for the server is als

DN and Related Settings

First, ensure the base DN and similar settings match those configured on the LDAP server. Check the LDAP server for more information. For Base DN , it’s typical to use the root of the LDAP tree but typically Entire Subtr

Extended Query

The most common mistake with Extended Query is that the given directive fails to include both the item to be searched as well as how, such as: memberOf=CN=VPNUsers,CN=Users,DC=example,DC=com Note that in the above exampl

Troubleshooting via Packet Captures

Packet captures can be invaluable for diagnosing errors as well. If an unencrypted method (RADIUS, LDAP without SSL) is in use, the actual password being used may not be visible but enough of the protocol exchange can be

Troubleshooting via Server Logs

Authentication failures are typically logged by the target server (FreeRADIUS, Windows Event Viewer, etc), assuming the request is making it all the way to the authentication host. Check the server logs for a detailed e

Troubleshooting “promiscuous mode enabled” Log Messages

The following log messages are recorded when a utility has placed the network card into “promiscuous mode”: Feb 10 01:41:58 kernel: vr0: promiscuous mode disabled Feb 10 01:41:57 kernel: vr0: promiscuous mode e