HAP+ - My Files

[Jawloms]

We're having difficulty with "Mappings". The only way we can get a drive mapping to appear is by giving "All" to "Enable read to" and "Enable write to". If we try using any groups from AD then the mappings don't appear. I'm not convinced it's talking to AD properly, but it must be for people to be able to log in. Any thoughts? Any files would be helpful for me to post?

 

Thank you

 

Stuart

[nickbro]

Which version of HAP+?

 

You may need to manually enter 2000 AD Names into the hapConfig.xml file.

 

It should be EnableReadTo=All EnableWriteTo=All. HAP+ will then use NTFS permissions. What you what to limit is the ShowTo attribute

[Jawloms]

We're running the latest version. I'm struggling to find any real documentation about the exact structure of the hapconfig.xml file and everything you can do with it. Do you know if there is any?

 

You are right in that the NTFS permissions prevent access to those who shouldn't have it, but it would be nice to make the "Teachers Shared" drive not appear when the students log in.

 

Thank you.

[fairm010]

Then use ShowTo=$StaffSecurityGroup. Thats what I use and it works.

 

This is my staff shared area that doesnt show to children.

 

\\server2\StaffOnly$

Edited September 11, 2014 by fairm010

[Jawloms]

Presumably the name in the quotes after ShowTo is the AD group? If it is, it still isn't working for me. Everyone still gets to see the links.

 

This is what I have;

 

\\server1\Staff\StaffShare\Teachers Share

[fairm010]

I know Nick said not to but I use the Read and Write to attributes and the drive is hidden. Try

 

\\server1\Staff\StaffShare\Teachers Share

 

1. Unless you use quotas on the staff shared area (I Dont) use drivespace in usage mode. Also you had a space in the path, not sure if by accident?

[fairm010]

Also I don't have a space in any of my shared folder mappings. Try a folder without IE StaffShare

[Jawloms]

The spaces are meant to be there. I have also tried other mappings which don't have spaces just to rule it out and it makes no difference.

 

I have also just noticed that when an admin logs in, they don't get the admin options.

[nickbro]

Use the api call to see what roles to use /hap/api/ad/roles/{username}

[nickbro]

Domain Admins are the only admins by default, if you need more either enter usernames or group names (use the api call above to get list of correct names to use)

[Jawloms]

Sorry - completely lost me on that one. I do what?

[nickbro]

In a browser, go to HAP+, login. Then at the top put in /hap/api/ad/roles/%yourusername%. It'll display a JSON array of roles you are in

[Jawloms]

So I went to - https://fxa-hap-001/hap/api/ad/roles/shadmin and it displayed;

 

{"FirstName":null,"SiteName":null,"Token1":null,"Token2":"System.DirectoryServices.DirectoryServicesCOMException (0x8007052E): The user name or password is incorrect.\u000d\u000a\u000d\u000a at System.DirectoryServices.DirectoryEntry.Bind(Boolean throwIfFail)\u000d\u000a at System.DirectoryServices.DirectoryEntry.Bind()\u000d\u000a at System.DirectoryServices.DirectoryEntry.get_AdsObject()\u000d\u000a at System.DirectoryServices.PropertyValueCollection.PopulateList()\u000d\u000a at System.DirectoryServices.PropertyValueCollection..ctor(DirectoryEntry entry, String propertyName)\u000d\u000a at System.DirectoryServices.PropertyCollection.get_Item(String propertyName)\u000d\u000a at System.DirectoryServices.AccountManagement.PrincipalContext.DoLDAPDirectoryInitNoContainer()\u000d\u000a at System.DirectoryServices.AccountManagement.PrincipalContext.DoDomainInit()\u000d\u000a at System.DirectoryServices.AccountManagement.PrincipalContext.Initialize()\u000d\u000a at System.DirectoryServices.AccountManagement.PrincipalContext.get_QueryCtx()\u000d\u000a at System.DirectoryServices.AccountManagement.Principal.FindByIdentityWithTypeHelper(PrincipalContext context, Type principalType, Nullable`1 identityType, String identityValue, DateTime refDate)\u000d\u000a at System.DirectoryServices.AccountManagement.UserPrincipal.FindByIdentity(PrincipalContext context, String identityValue)\u000d\u000a at HAP.AD.User.get_UserP()\u000d\u000a at HAP.AD.User.Authenticate(String username, String password)\u000d\u000a at HAP.AD.API.UserGET(String username, String password)","Token2Name":null,"Username":null,"isValid":false}

[nickbro]

ok, that isn't working correctly then :S

[jamin100]

So I went to - https://fxa-hap-001/hap/api/ad/roles/shadmin and it displayed;

 

{"FirstName":null,"SiteName":null,"Token1":null,"Token2":"System.DirectoryServices.DirectoryServicesCOMException (0x8007052E): The user name or password is incorrect.\u000d\u000a\u000d\u000a at System.DirectoryServices.DirectoryEntry.Bind(Boolean throwIfFail)\u000d\u000a at System.DirectoryServices.DirectoryEntry.Bind()\u000d\u000a at System.DirectoryServices.DirectoryEntry.get_AdsObject()\u000d\u000a at System.DirectoryServices.PropertyValueCollection.PopulateList()\u000d\u000a at System.DirectoryServices.PropertyValueCollection..ctor(DirectoryEntry entry, String propertyName)\u000d\u000a at System.DirectoryServices.PropertyCollection.get_Item(String propertyName)\u000d\u000a at System.DirectoryServices.AccountManagement.PrincipalContext.DoLDAPDirectoryInitNoContainer()\u000d\u000a at System.DirectoryServices.AccountManagement.PrincipalContext.DoDomainInit()\u000d\u000a at System.DirectoryServices.AccountManagement.PrincipalContext.Initialize()\u000d\u000a at System.DirectoryServices.AccountManagement.PrincipalContext.get_QueryCtx()\u000d\u000a at System.DirectoryServices.AccountManagement.Principal.FindByIdentityWithTypeHelper(PrincipalContext context, Type principalType, Nullable`1 identityType, String identityValue, DateTime refDate)\u000d\u000a at System.DirectoryServices.AccountManagement.UserPrincipal.FindByIdentity(PrincipalContext context, String identityValue)\u000d\u000a at HAP.AD.User.get_UserP()\u000d\u000a at HAP.AD.User.Authenticate(String username, String password)\u000d\u000a at HAP.AD.API.UserGET(String username, String password)","Token2Name":null,"Username":null,"isValid":false}

 

Did you solve this as that's what I get also?

[nickbro]

Make sure you are using the latest version of HAP+ v10.4. It's part of the latest HAP.AD.dll

[sboelitz]

Any luck with this I'm having a similar issue and running 10.5 i tried running the /hap/api/ad/roles/username and get the result ["Authenticated Users"] but it seems that anything using AD groups doesn't work.

[nickbro]

If you're just getting authenticated users when going to that API call HAP+ isn't able to get any membership information for that user.

[sboelitz]

Thanks for the quick reply, and sorry if I seem to have hijacked the thread a little but not sure if these issues could be related in some way.

 

HAP should be able to access this information as the domain account it uses is a domain admin (for test purpose only) I cant see any reason it wouldn't be able to get this info, we are on a 2003 domain and HAP is on server 2012 R2.

[timbo343]

If you're just getting authenticated users when going to that API call HAP+ isn't able to get any membership information for that user.

 

Sorry to bring up an old post but I'm getting this too... how on earth do we solve it?

[nickbro]

Upgrading to v10.6's HAP.AD dll should solve the issue, it did for me