Extreme Control Machine + User authentication fails

[SDR]

​
Hi,

This Topic is a a follow up to

Although, I hopefully configured everything as advised and discussed in above thread,   

Machine + User authentication fails. (Machine auth ONLY works fine, now!)

Below is a screenshot of  the EvaluationTool result:

I don´t see the mistake….

[SDR]

Good morning all,

I´m quite desperate. I now have remote access and verified everything + also checked with the Eval-Tool + LDAP-Test-Feature.

Without success.

As shown in an earlier Screenshot, the Eval tool claims, that the Host “MV-xxx.de” does not have LDAP-attributes defined in the LDAP Host Group “End System Groups AD machines”.

Verifying this with LDAP-Test : see below:

So, there IS such an entry.

What I am confused about: This entry is found as “dNSHostName”.

According to ealier mentioned guide, “objectcategory” is defined as attribute for the group.

 However, changing this to dnsNostName does not work either.

I checke configuration vs. guide several times…..don´t find the mistake.

Hope you can point out the issue….

[Miguel-Angel_RO]

Stefan,

Are you meeting all the requirements for the LDAP groups?

See documentation:

Mig

[StephanH]

Hello Stefan,

as I wrote above. If you have two rules with two different checks (is not and is), this is the point you have to investigate first. 

In the LDAP test tool use the user search for rules matching an user and the host search for rules matching the host.

You can check which LDAP rule is used via the Eval tool (second tab = 2. Authentication evaluation).

As result you will receive the groups you user/device is in.

If you play arround with these settings you will have a good understanding what happen during the ldap checks in NAC.

[SDR]

Hello Stephan, Mig,

sorry for delay due to private reasons.

@Miguel-Angel RODRIGUEZ-GARCIA : I thought, you understood my use case, as you gave me several hints, how to get mor close to the solution. Sorry for not beeing detailed enough.

@StephanH : You are right. I followed the linked procedure to realize customers wish:

1. Authenticate Windows CLIENT based on machine being in the AD.
2. Authenticate Windows USER on Windows CLIENT based on machine AND User being in the AD. 
3. Reject Non-domain machine.

According to the documents and you assistance here we managed, that

TOP 1) “Authenticate Windows CLIENT based on machine being in the AD.” works.

TOP 2) does not yet work - as documented by my screenshots.

With regards to   @StephanH  “Are you 100% sure that the maschine is in the expacted AD group?”my anwer is: “I am nearly 100% sure”,….

As we have no remote access to the environment at the moment, I cannot test/verify again.

However, pls clearify what/how to test. 

I have to verify once again

• if the Host (written exactly like thrown out in the EVAL tool) is found in LDAP-Test (which section? User search? Host search?
• if the User (written exactly like thrown out in the EVAL tool) is found in LDAP-Test (which section? User search? Host search?

As soon as I have the result, i´ll post a screenshot.

Thanks + sorry for confusion, again

Stefan

[Miguel-Angel_RO]

That wasn’t my understanding…

SDR, It would be nice to clarify the exact use case and method you are trying to achieve.

Mig