Search the Community

Hello, We've been running HAP for a while now and its been a great upgrade over other portals in previous years, so thank you to the team that made it. Were running single sign on with kerberos here and its all running fine, one of the feature points is that it checks the IP address of the client machine via the "InternalIPs" variable. I was wondering if it was possible to bypass this feature or have it turned off? My issue is that in South Australia we have a government mandated administration network that has one directional traffic flow and its own separate auth domain. We create kerberos tickets on these admin machines from the domain HAP resides in, however HAP cannot talk back to the network segment these clients originate from (Im assuming this to be my problem). Essentially anyone on this IP range cannot perform single sign on to HAP, other items from our realm e.g exchange, IIS websties, sharepoint, sign on without issue on this network segment. My understanding is that this is to prevent SSO for external hosting? We sit behind a reverse proxy/firewall that does AD auth and creates a kerberos ticket for the user as well. It would also be great for that identity to function as well, im assuiming the solution to be the same for both segments. Would this perhaps be a configurable on/off feature request item? Any advice would be welcomed in making our users lives easier

Hi, We use the YHGFL SMS vpn solution in our schools but I am unable to address the server by host name in a couple of our schools running Server 2012 R2 environments. Connection to vpn is successful but when trying to access drives mapped by \\hostname\Share fails with the following error. "The system detected a possible attempt to compromise security. Please ensure that you can contact the server that authenticated you"- I can access without issue by IP address only but I do not wish to use ip mappings in these schools A bit about the environment - single server 2012R2 DFL and FFL. Clients running Windows 7 with a host file entry for the server - server runs infrastructure services, ADDS, dhcp, dns, file and print etc. I stumbled across an article that suggested opening port 88 (udp & tcp) on the server firewall - this has been done - I also noticed that group policy updates etc fail due to lack of connectivity to the server and that the vpn adaptor uses an ip on a 24 bit subnet where as the schools are on 21bit. I digress, posting this in hopes that someone has seen and fixed this problem or one of the tech bod's at Y & H have the answer? Thanks in advance, Chris (MINT)

We have recently promoted a 2019 Server to be a domain controller but it won't authenticate access to our EMC VNX datastore which we believe only supports RC4 Kerberos - is there anyway to enable RC4 Kerberos in Server 2019 as it appears to have been removed? (Using the IIS Crypto tool we can see the 2019 server does not have any RC4 ciphers) Access to the EMC VNX datastore works from 2012 and 2016 DC's. Access from the 2019 server to all other devices on the network also work (we can see these using AES encryption via the klist utility) I can see no documentation suggesting any changes around Kerberos in server 2019

Hi guys, I am currently in the process of configuring 3x Apple XServes in a mixed domain, hence in a "magic triangle". This terminology in itself makes me chuckle as it makes one wonder if whatever goes in there is lost forever and untraceable The main "bridge" server is setup in the data centre and is configured as the Open Directory Master. Its sole purpose is to push out Managed Preferences to the 2 further remote servers which are configured as Open Directory replica's. The servers are bound to Active Directory (using the AD plugin). User Groups have been configured on the ODM under LDAP and Active Directory groups have been placed inside the User Groups to push out the Managed Preferences. Kerberos has been disabled as per the recommendations for a "magic triangle configuration" from Apple. Using this setup I can log in to the domain using Active Directory credentials fine. Users' Home Folders are automatically mapped on the Dock via the AD settings which is great. Managed Preferences are being pushed out fine. Enough of the info and on to the question: In the Managed Preferences I have configured the Network settings to point the proxies to our Windows ISA Server and Port. For some reason (and I may be wrong), I presumed that when logging the Mac's on to the Windows Domain it would use Kerberos Authentication from the Windows Servers; hence there would be no further need to authenticate against the proxy servers. This is obviously not the case as every time I launch Safari, I am presented with an authentication dialog to connect to the proxy servers. 1) Is Safari kerberised? 2) Why do I have to keep authenticating with the proxy servers? 3) How do you use Single Sign-On? 4) Has anyone got the internet working through a proxy using Single Sign-On? Thanks in advance guys, Steve