Homeaccess Plus not Reading User Security Permissions

[LJPowell]

Hi wondering if anyone could help here. I have homeaccess + setup and have done for quite sometime now, however today I synced our Office365 with our AD and since then, homeaccess + doesn't seem to want to read our user security permissions anymore and will only display drives and homepage items that are assigned to "All", it also doesn't show any "Domain Admins" mappings.

 

Anyone have any idea why?

[LJPowell]

After a bit of research into the issue it seem to be ADFS 3.0 as HAP+ has limitations on how it can impersonate the user. Does anyone know if I can point HAP+ at a specific DC that does not have ADFS 3.0 enabled on it for HAP authentications?

[nickbro]

You shouldn't install ADFS on a DC, it's one of the specs from Microsoft. ADFS goes on a member server. It can go on the same server as HAP+

 

Instructions for that are:

 

Install ADFS Service

Get it to generate the Service Account

Using AD Users and Computers you need to then alter the service account's ServicePrincipalName attribute (Advanced features) adding: http/adfs adddress, host/adfs address

Manually install the Azure Active Directory Powershell Tools

Run Update-MSOLFederatedDomain I believe to get it to sort out the ADFS stuff.

 

Well that's how I just reinstalled ADFS anyhow.

 

 

Live I said, not best to run ADFS on a domain controller.

 

The other option is to edit the hosts file to point the domain at the other two DCs

[LJPowell]

Thanks for the response Nick. Was really hoping you would respond as you would undoubtedly know the best way to fix my issue.

 

So would you suggest changing the host file of the HAP+ server to point to the other domain controller? If so have you any idea on how to do that? Sorry I don't know how to add a domain controller reference to a host file.

[LJPowell]

Pointed the host file now to a specific domain controller (without ADFS, don't panic I'll move it off the other DC), but I'm still only getting items that are assigned to "All" appear and not actually the items assigned the users security group. Would it be because this DC is server 2016? I know it worked with a DC that was server 2012 R2 at least.

[nickbro]

I haven't had a change to test HAP+ with a DC running 2016 yet. That's my plan for over the summer when we finally decom the CC4 DCs. If I remember rightly the way asp.net connects to AD may not use DNS, but I could be wrong.

 

If you go to /hap/api/ad/roles/%username% in a browser, what does it come back with?

[LJPowell]

Hi Nick, thanks for posting with help however I've managed to sort out the problems so everything is all working fine again, and with server 2016 for both HAP+ and all the DC's on the network.

[nickbro]

brill, any idea how?

[LJPowell]

Hi Nick, I upgraded my DC's to 2016 over the past week and then I linked Office 365 into our AD... I then noticed the problem, so I suspect the problem was the Office 365 integration and not the moving over the DC's. However after thinking through it logically, the user was being recognized but the security groups wasn't, plus after pointing the HAP+ server to a specific DC I was still experiencing the same issue, so my mind fell on the 2016 install... After checking this a little more, I noticed one of my legacy DC's (2012 R2) was still in my sites and services and my new DC's was attempting to replicate to and from it, I promptly removed this and done a fresh replication and bingo! The users were recognizing the security groups once more. A quick dns/host file fix on the HAP+ server and then fix the setup.aspx access rights again and my HAP+ is all happy again.

 

Thanks again for your messages

[timbo343]

Is there a way to specify a specific DC in HAP? We have a mixture of 2019 and 2016 DCs and we are seeing this group issue.

 

Thanks

[nickbro]

You can try putting in the upn of the hapconfig the FQDN of the DC you want to use.

 

My domain at work is 2016 level though but we use WindowsAuthentication now and 10.6