Eclipse.net Active Directory (AD) and phone app

[Jona]

Hi all,

We host our own instance of eclipse.net internally and use active directory so that users don't need their own login.

 

We're trying to deploy a link to their iphone, etc app but according to Microlib knowledgebase the app doesn't support AD username and passwords if using the app because the password is too "encrypted". Is that true?

 

I'm really struggling to get useful advice from their support department, they keep trying to up-sell us to their hosted package.

 

Any help much appreciated....

 

Thanks

Jona

[enjay]

I was told the app only worked on their hosted version.

[glennda]

I was told the app only worked on their hosted version.

 

That was also my understanding when I did a move to the Cloud last year - although we still tied into using AD creds using the IE add-on.

[knightrider]

I was told the app only worked on their hosted version.

 

Yeah I was also told this. If you do find a work around please do share.

 

Knightrider

[enjay]

I'm guessing the app has the MLS website coded into it, so I don't think you'll find a workaround unless you can find a way to make your Eclipse database publicly-accessible and then change the line in the app's code to reflect that address...

[robk]

It can be done! You need to ensure your mls install has no proxy auth or anything similar set up, then mls add your site to the database for a central imls app. Ad integration is slightly tricky as they username cannot have the domain name prefix on it.

 

Both myself and @john now have it working.

[john]

Indeed it can be done, Rob and I worked with MLS to get it going, however it is not officially supported by MLS when you self-host they will do what they can (which was good and full commendation to the team) but did take some poking.

 

Key issues is it just will not work correctly being reverse proxied or NAT'd in some cases it gets sulky so you need a dedicated IP for it.

 

No security, no SSL etc... so keep it clean and simple.

 

Username needs to be as rob put clean and tidy, Internal and External host name need to match so if you call it library.school.internal V books.school.county.sch.uk externally you will need to modify IIS to make it the external name internally etc....

 

So it can be done but messy and needs some fiddling of IIS and other bits.

[Jona]

Thanks for the replies guys, much appreciated! You seem to have had a better experience of MLS support than I've had thus far, perhaps I just got them on a bad day......

 

Domain name should be fine as we use the same domain name internally and externally with split horizon DNS, it is currently library.schoolname.com internally so with just an additional A record in the external zone that should be fine.

 

You reckon it needs a full public interface and not just port forwarding of 80 and 443?

 

Assume from your comments that SSL isn't going to be possible?

 

Could either of you share what Authentication modes you are using in both IIS (Site -> Security) and Eclipse (Configuration -> Authentication)?

 

Thanks

Jona

[robk]

Port forward should be fine, just no reverse proxies, tag etc.

 

Iis auth is set to anon. Mls auth is auto I think.

 

There is a kb article on the mls website, that details the process, but support are likely to tell you it's not possible.

[enjay]

There is a kb article on the mls website, that details the process, but support are likely to tell you it's not possible.

 

You see, that annoys me. I can understand why they might not want to support it, but if they publish an article, they should tell customers who ask "it is fiddly, and we won't support you, but other people have found that it can be done". I would then have read the article and decided for myself whether it was worth it.

[Jona]

For reference the KB article 2022 and accompanying PDF seem to be the best reference from MLS that this might be possible....

 

The main key thing that seems to be missing from that is that the front page of your eclipse.net install needs to load the front page (and/or http://libraryserver.schooladdress.com/services/library.svc) without any authentication requirement.

 

I can make that work currently the only problem then seemed to be with the combination of MLS and IIS auth settings I tested. If you logged in using the on-page form it wouldn't show you as logged in until you manually refreshed the page. The AJAX style login "ticker" just continued to spin forever.

[Jona]

Hi all,

So I now have the app working. However when I try and login with a AD user I get the error "The operation couldn't be completed SLDataLoaderErrorDOmain error -1000.". No part of our domain name is in the login just a simple username. If anyone has got the iMLS App authenticating against Active directory I'd be really greatful for any pointers....

[robk]

In the eclipse management screen does the ad username have a domain prefix? If so remove it and see if that fixes it.

[denzal2k4]

We are currently running the gauntlet with MLS support being told its not supported as a self hosted solution, have done everything they have asked so far, and the page is accessible externally, but having issues getting them to link us into the database, I've even mentioned to them that I think they need to link our url in their database, we show up in the list on the app but it says its not enabled for us, I'm getting to the stage where I may have to send a blunt email, pointing out that I know why they are being difficult as they want to host it for us but we aren't interested!! Anyone have any tips for getting the job done sooner as i'm getting it in the ear from the librarian!!

[bennz]

We are currently running the gauntlet with MLS support being told its not supported as a self hosted solution, have done everything they have asked so far, and the page is accessible externally, but having issues getting them to link us into the database, I've even mentioned to them that I think they need to link our url in their database, we show up in the list on the app but it says its not enabled for us, I'm getting to the stage where I may have to send a blunt email, pointing out that I know why they are being difficult as they want to host it for us but we aren't interested!! Anyone have any tips for getting the job done sooner as i'm getting it in the ear from the librarian!!

 

I set this up some time ago for an Eclipse school, you have to make sure your site is accessible and that the URL eclipse is on matches the service when you browse to it http://yourdomain.co.uk/services/library.svc if that's all ok send some login details and the URL to MLS Support and they have to enable it on their servers.

 

As the library wanted single sign on with AD I had to setup two sites in IIS one for windows authentication (Internal SSO) and one anonymous for external app use.

[MLSInstallations]

We are currently running the gauntlet with MLS support being told its not supported as a self hosted solution, have done everything they have asked so far, and the page is accessible externally, but having issues getting them to link us into the database, I've even mentioned to them that I think they need to link our url in their database, we show up in the list on the app but it says its not enabled for us, I'm getting to the stage where I may have to send a blunt email, pointing out that I know why they are being difficult as they want to host it for us but we aren't interested!! Anyone have any tips for getting the job done sooner as i'm getting it in the ear from the librarian!!

 

 

Hi Denzal, by reading what you've posted it seems that we do need to enable it on our side, if you email me over some details at [email protected] i'll get the ball rolling for you and create an escalation, please bare in mind that this can take some time to complete.

 

unfortunately you cannot set up AD Linking with the APP as it's an external process, it's imposible to do, every user that uses iMLS has to have their own username and password created which can be their AD info but that doesn't mean it's linked to the AD.

thank you.

Edited November 5, 2014 by MLSInstallations

[MLSInstallations]

I set this up some time ago for an Eclipse school, you have to make sure your site is accessible and that the URL eclipse is on matches the service when you browse to it http://yourdomain.co.uk/services/library.svc if that's all ok send some login details and the URL to MLS Support and they have to enable it on their servers.

 

As the library wanted single sign on with AD I had to setup two sites in IIS one for windows authentication (Internal SSO) and one anonymous for external app use.

 

This is also correct and thank you bennz you are quite knowledgable about our systems which is always helpful.

 

With setting up the seperate sites in IIS this is for the older version of ASP, with silverlight instead of 2 sites you only need 1 site and a virtual directory for this now.

[denzal2k4]

I've been informed that a ticket has now been created which is in open escalation for your team to look at with regards to linking the URL to the Academy on the app. If it doesn't get anywhere in a couple of days I'll send you another request. Thanks for your response.

[Edu-IT]

Internally, what security have you set on the IIS site to keep SSO working internally?

[bennz]

Internally, what security have you set on the IIS site to keep SSO working internally?

 

I have a default install of eclipse under the default website in IIS called MLS.NET, I have authentication on the default website and the MLS.NET sub set to anonymous disabled and windows enabled. The eclipse installation that this points to has the configuration tools website tab set to Windows. The MLS.NET site is an internal site only and this allows SSO to work.

 

For app use I have another site setup on its own called Eclipse this is external and points to a different installation folder (copy of the original) the only difference is the eclipse config tool has its website tab set to None and the site in IIS has Windows authentication disabled and anonymous enabled. This site is only accessed via the App and for the librarian when she decides to work from home.

 

Note the above is for version 12.3 we tried it in the newer version and the only difference is IIS only handles the authentication so you don't have to have a duplicate installation with different settings in the configuration tool. This seemed to work fine for the short time we had it and reverted back to 12.3 for other reasons.

[denzal2k4]

We don't have it setup for SSO as the students have a different logon for eclipse.

[denzal2k4]

This is now working, thanks very much!

[ITGuyNW]

Sorry to bring up an old thread but we are banging our heads against a brick wall trying to get AD integration with Eclipse.

 

Anyone got a guide to get it working properly?

 

We've installed all plugins, allowing through proxy, using IE11, directory services info inputted but when we run the AD tools program it seems like it doesn't want to know! Does the information in 'Directory Services' need to be in a certain format?