topic Re: Windows authentication in Network Access Control

Windows authentication

lni1 — Sun, 10 Mar 2019 23:38:24 GMT

We are trying to authenticate against a AD group, instead of authenticating with AD it gives the following message and places the users in the default group, any ideas ?

RDS 08/10/2009 23:54:03 P 0786 3192 0x0 Found local user MSNET\ibis5471

RDS 08/10/2009 23:54:03 E 5800 3192 0x0 Failed to get group info about user:MSNET\ibis5471 - CSAuth client has passed userID with invalid id info

Re: Windows authentication

mchin345 — Mon, 17 Aug 2009 23:26:06 GMT

It is a known issue that ACS does look ups based on the outer id instead of the inner id when the outer identity is a username. For whatever reason, when the outer identity is anonymous, ACS correctly does its lookups based on the inner identity.

It is entirely possible this is why fast-reconnect also fails. I saw the following entries in the RDS.log that correspond to the reported fast-reconnect error in the Failed Attempts log.

Re: Windows authentication

Robert.N.Barrett_2 — Wed, 19 Aug 2009 15:09:14 GMT

It is normal ACS behavior for AD users to show up in the local users database once they have authenticated. This is a caching feature that is enabled by default(and can be disabled).

Are users being allowed access, but these messages are showing up in the logs?

Re: Windows authentication

lni1 — Fri, 21 Aug 2009 05:33:54 GMT

I disabled the whole setup to Windows AD,

so the authentication should fail, still the authentication for the devices are valid, they are in the default group (0).

The default group (0) is off limits for everybody, but still these users enter via this group, how is this possible ?

Re: Windows authentication

Jagdeep Gambhir — Fri, 21 Aug 2009 08:28:41 GMT

You can create a mapping and map default group with no access group.

Re: Windows authentication

lni1 — Fri, 21 Aug 2009 08:42:56 GMT

I already did that, it still enters the default group (0),could it be a problem with my link to AD ?

Re: Windows authentication

Jagdeep Gambhir — Fri, 21 Aug 2009 12:37:32 GMT

Does that user belongs to multiple group in AD?

Re: Windows authentication

lni1 — Wed, 26 Aug 2009 06:15:39 GMT

Yes, it belongs to multiple groups in AD, but for the moment the whole AD setup is offline, but still users enter via the group 0.