HAp 10.5 authenticated user issue

[sboelitz]

Hi guys,

 

got an issue where "My Files" wont show shared drives that are limited by groups in AD. I have checked using the API /HAP/api/ad/roles/username but am only seeing ["Authenticated Users"] I can actually change the username to anything and it will show the same even if it's not a user in AD.

 

Any ideas how to get his working so we can get drives to show based on what AD group they are in?

 

As a bit of back ground info

 

HAP is on a server 2012 R2

The AD is server 2003

If the group is set to all users can see the drives fine.

[nickbro]

hmm, looks like the system isn't able to parse your AD infrastructure properly, did you change username to your username? e.g. /HAP/api/ad/roles/nick

[sboelitz]

Hi Nick, yes so I can change username to my username or any random gibberish and it still just says ["Authenticated Users"]

[nickbro]

Hmm, ok, something with your AD setup isn't working as it should. Can you copy your AD config section from the hapConfig.xml file? Minus the username/password/key bits

[sboelitz]

The AD config Is below ive replaced sensitive deails wih ****'s

 

[nickbro]

Looks all ok to me, odd. Can you confirm your UPN is the FQDN of your domain, e.g. my domain is crick, but it's UPN is crick.internal. Don't use a server specific FQDN

[sboelitz]

Hi yea we are using the UPN for our domain however the UPN is for a child domain as we have multiple domains for different sites.

[nickbro]

HAP+ doesn't work well with multiple domains, that may be the issue here, you may need to setup a HAP+ for each child domain.

[sboelitz]

at the moment HAP is only setup to one child domain, we have tired moving it to the parent domain but ha didn't work so have moved I back to the child domain but still has the same issue.

[nickbro]

Can't quite figure out why it can't pull the AD data out, that's most odd

[sboelitz]

Yea been working on it for a few weeks now and am just puzzled, I can see the groups in the AD from HAP when setting permissions etc it just cant seem to read the membership of the users/groups for actually applying the permissions. I have made the HAP account a full domain and enterprise admin and have tried using my admin account as well.

[Alanth]

Hi sboelitz,

 

Any resolution to this, have the same here when we moved to 2012r2 domain HAP lost the ability to pull user groups. tried may solutions provided here to no avail.

 

regards, Alan

[SethAluma]

It works for me on a 2012 R2 domain. I do, however need to re-enter the domain account password every time i go to the config page, otherwise it can't get domain info.

[Alanth]

Hi SethAluma,

 

What do you get with the following https://hap-server/hap/api/ad/roles/%username% . should get a response of what groups the user belongs to

 

Regards, Alan

[SethAluma]

Yes, I have a full list of the user's groups when I do that.

Mine's installed on a domain-joined 2012 R2 machine with 2012R2 DCs, but I just noticed it's only on Windows Server 2008 R2 domain functional level.

 

What do you get when you go to https://hapserver/HAP/setup.aspx, re-enter the domain information on the Active Directory tab, and click the "Students group" box? it should display your domain OUs, etc.

[Alanth]

Yeah, i don't all i get is ["Authenticated User"]. starting to look like it might not be compatible with 2012r2 domain functional level (only).

 

i have no problem with setup.aspx i can see the ou listings and can select them. the setup was not changed but when we migrated to svr 2012r2 domain that's when the show tile's to specific user groups broke. I will tap in to see if the domain is backwards compatible 2008r2.

 

strange how i can see the ou's though..

 

just checked and its 200r2 level, well not that then.

 

Alan

Edited June 7, 2016 by Alanth

[Hawes29]

We are experiencing the same issue with two of our child domains, the third works fine. We are running Server 2012R2 on all the domains and have installed separate instances of HAP10.5 on each.

 

On the two HAP instances which doesn’t seem to read the AD group permissions, we can list the OU’s successfully when clicking on the “Students Group” box.

If we select ALL, instead of the individual AD groups the shared drives are listed.

 

I have compared the working Hapconfig.xml files between the working and the none working instances and can’t see any differences from the setup.

 

If anyone has any more ideas which haven’t been suggested above, they would be greatly appreciated.

[Alanth]

Hi SethAluma,

 

Sorry for the delay, HAP has no problem pulling OU / Groups. Unfortunately i still get [Authenticated Users]. the second school i work at i built a new DC 2012R2 and have no problem running HAP

 

Regards, Alan H

[timbo343]

Did anyone get anywhere with this? We've been hit with this too and i've been driving me crazy for days!

 

Would be great if someone could post the fix on here.

 

We are using 10.5 with a forest and Domain at 2016 level running 2016 DCs.

 

The HAP is on a 2012R2 server and a test version is on 2016. Both having issues.

Edited January 31, 2019 by timbo343