User Card API Lockdown & Kerberos Issues

[Paul-K]

Hi @nickbro

 

I have followed instructions from your videos for the User Card API lockdown and Kerberos setups. Both work internally if I use https:///hap but if I use the external address of https://www.schoolname.sch.uk/hap internally then kerberos authentication fails to work and automatically login and the User Card API gives me a 403 Access Denied. Any ideas on what would be causing this and where I should begin to look to resolve it. Is it something to do with reverse DNS lookups? if so do I need to enable this in my IIS config under the IP and domain restrictions? or is it to do with my main DC that deals with DNS.

[nickbro]

Yep reverse lookups, you may want to add internal DNS on your DNS server for your hap install, so internally it uses the internal IP, externally it uses the public ones then

[Paul-K]

Cheers Nick,

 

Hadn't even considered the simple option off adding a DNS entry. For anyone else wondering on this one:

 

1 - I added a DNS entry on our DNS server for the website hosting HAP+ and created the PTR record to

2 - Added the HAP website that I just created a DNS entry for to the proxy exception list

3 - My website has a plugin that doesn't like compatibility mode so I then enabled "Turn on Internet Explorer Standards mode for intranet" in GP, this stops IE loading intranet sites in compatibility mode. This policy can be found under "Computer Configuration - Policies - Administrative Templates - Windows Components - Internet Explorer - Compatibility View".

 

Big thanks as always to @nickbro