External Authentification

[Anonymous]

I have issue with external authentification in Active Directory (10.3 SP2). I mapping AD User Group to ADMIN role. Group name at Russian language, but I see entitlement in UI correctly. I try use English name group - not solve issue. After this user can login to UI, but not have access to any appliance (Device 10.10.0.x host LogCollector is unreachable) and then try access to Investigation tab - receive message "Failed to retrieve meta keys" Somebody have this issue?

[huanzhou1]

Did you create the device user?

SA UI need to map to device user.

http://sadocs.emc.com/0_en-us/199_10.2_User_Guide/10_Admin_Tasks/10_Manage_Security/Add_Device_Users_(SP2)

[Anonymous]

Need create (replicate) each domain user on each appliance? I do this for one user (mapped to group administrator at appliance) and then try logon but nothing changes. I don't think this official way to use Domain Authentification. If appliance connect with Analytics Server without SSL - password domain users will not be secure.

[huanzhou1]

you have the option to enable the the ssl for all the appliances.

for the device user are you using external? if yes, you need enable pam.

[Anonymous]

SSL not work at all device by default. I not have SSL connect with (Log) Decoder/Concentrator. What I should do to use SSL at all device?

Need enable PAM? I use external authentication with Active Directory...

[huanzhou1]

For the device users if you use netwitness, then you should be able to connect, i don't have any issue.

What i mean is if you need you can enable for all the devices.

Device users also can use AD authentication but use PAM.

Thank you.

[Anonymous]

I use this guide: https://sadocs.emc.com/0_en-us/095_10.3_User_Guide/20_System_Security_and_User_Management/00_Security_Config_Checklist/C…

1. Create user d.smith and choise external authentication, gpoup administrators.

2. Сonfigure PAM Module (Kerberos) in my Log Concentrator (all 4 steps).

3. Try connect from user d.smith via UI and recive message:

You are not authorized for this device.

[huanzhou1]

for the device users, can you use netwitness auth first see whether can connect or not? I don't have this issue, and can you check log? does it say wrong password?

[Anonymous]

If I use netwitness authentication at device - all work fine. But is not solution for me. Need use external authentication from Active Directory. What logs need to see when I use external authentication?

[Anonymous]

Good Morning Hubba900,

For external auth to work it is correct that each machine needs PAM installed and configured correctly.  Do you have a krb5.conf in your /etc?

If so make sure that all your domains are setup correctly in the file. 

Mine looks like this.

[seandko@avsesa-rsasa-log-p01 etc]$ cat krb5.conf

[logging]

default = FILE:/var/log/krb5libs.log

kdc = FILE:/var/log/krb5kdc.log

admin_server = FILE:/var/log/kadmind.log

[libdefaults]

dns_lookup_realm = true

dns_lookup_kdc = true

ticket_lifetime = 24h

renew_lifetime = 7d

forwardable = true

default_realm = STAFF.xxxx.COM

[realms]

STAFF.xxxx.COM = {

  kdc = 10.x.x.x

  admin_server = 10.x.x.x

}

[domain_realm]

staff.xxxx.com = STAFF.xxxx.COM

.staff.xxxx.com = STAFF.xxxx.COM