topic Re: vSZ 5.1.x Administrators - Active Directory in SmartZone and Virtual SmartZone

vSZ 5.1.x Administrators - Active Directory

james_mcmillan_ — Fri, 17 Jan 2020 16:55:01 GMT

Hi

I have a vSZ (v5.1.2.0.302), and am trying to configure an AAA server for SmartZone Administrators. The manual doesn't seem to be giving me what I need - or at least, I'm not seeing the wood for the trees. I also have a couple of questions to follow..

I've configured an AAA AD server: Administrators -> Admins & Roles -> AAA:

Name: domain.local
Type: Active Directory
Realm: domain.local
Default Role Mapping: Off
IP address: 1.2.3.4
Port: 389
Windows Domain Name: dc=domain,dc=local

Test AAA is a success, but:

1. How do I actually add AD users or groups to 'Administrators'?
2. How can I add a second Domain Controller?
3. Port 389 is essentially LDAP in plain text - if I choose port 636 (LDAPS) - it fails. How do I secure comms to the Domain Controller?

New to the World of SmartZones, so forgive me for the basics..

Cheers, James

Re: vSZ 5.1.x Administrators - Active Directory

sanjay_kumar — Mon, 20 Jan 2020 05:50:46 GMT

Hi James,

Check the below steps:

1. You need to create a group for the access on the SZ under Administration --> Admins and Roles --> Click ‘Create’ Under Groups.
2. Create a local user on the "Available Users" step and add it in the "Selected Users".
3. Add the AD under Administration --> Admins and Roles --> AAA --> Create -->.
4. Map the domain name "training.com" (my lab domain name), under "Realm".
5. Enable "Default Role Mapping" and map the SZ User Group create along with along SZ local user created.
6. You need to map the domain and the AD users on the "Windows Domain Name".
7. Example for the domain training.com CN=Users,DC=training,DC=com
8. On the AD, fo to Run >> lpd.exe
9. Click on Connection >> Connect >> type localhost wits port 389.
10. Click on connection >> Bind >> Map the administrator user.
11. Click on View >> Tree >> add the base domain name. In my case it is CN=Users,DC=training,DC=com

Once done, test the authentication from the SZ>> Administration >> Admin and Roles >> AAA >>> Test AAA

Re: vSZ 5.1.x Administrators - Active Directory

sanjay_kumar — Mon, 20 Jan 2020 05:51:33 GMT

If you need to have more filters for the user groups, try using LDAP option on the SZ.

Re: vSZ 5.1.x Administrators - Active Directory

nickzourdos — Tue, 04 Feb 2020 16:57:01 GMT

I've followed your instructions and the AAA Server test returns "AAA testing: Success! Associated with Default Role Mapping [TestUser of TestGroup]".

The problem is that when I try to log in, I get an error that says "User is not assigned to an admin user group". The group's account security is set to default.

Re: vSZ 5.1.x Administrators - Active Directory

nickzourdos — Wed, 05 Feb 2020 20:09:13 GMT

FYI this has been identified as a bug in v5.1.2.0.302 and is reportedly fixed in v5.2.x

Re: vSZ 5.1.x Administrators - Active Directory

rob_bush — Fri, 28 Feb 2020 21:08:45 GMT

I just got off the phone with Ruckus to figure this out as well. For starters, the second answer given to you here is just weird/wrong, don't go that direction with running lpd.exe on the AD server.

What follows relates to release 5.2.0.0.699.

1. How do I actually add AD users or groups to 'Administrators'?

Review pages 426-427 of the Ruckus SmartZone 100 and Virtual SmartZone-Essentials Administrator Guide, 5.1.2. Where I got stuck though is they had a typo on the AD Group name you have to create which I'll highlight below.

So here's how it works, and if you ask me, this is retarded compared to the way ZoneDirector did it, but at least it gets us back to what we had before.

Under Administration -> Admins and Roles, do the following:

AAA Tab:
- Setup an AD entry just like you have listed above with Default Role Mapping off, port 389.

Administrators Tab:
- Create a local user on the SZ, for example call it "SuperAdmins". Put in some crazy long and difficult password as this will NEVER be used for actually signing. It doesn't even matter if you remember it afterwards.

Groups Tab:
- Create a group (Example call it "Super Admins Group" with all rights) and then assign the user you just created to this group (in this case, assign the user "SuperAdmins" to this group.)

Back on your AD server, do the following.
   - Create a group in AD called "Ruckus-WSG-User-[username]" (this is the typo on their docs, they have it listed as "Ruckus-WSG-[username]" which is wrong.)
      - As example, create the group "Ruckus-WSG-User-SuperAdmins"
   - Assign the users to this group that you want to have Super Admin Group access.

Back to your SZ, go to the AAA tab and test with a user, and it should be assigned the "Super Admin Group" (or whatever) Role.

2. How can I add a second Domain Controller?

- You can't for AD (currently.) You can for Radius, but not for AD. How fun!

3. Port 389 is essentially LDAP in plain text - if I choose port 636 (LDAPS) - it fails. How do I secure comms to the Domain Controller?

- You can't. We apparently lost that security feature in SZ. You can have TLS encryption when you use AD for standard user authentication such as to authenticate to a portal, but not for the Administrator login to the web site. Brilliant, right? All we can do is complain to gain this feature back.

Re: vSZ 5.1.x Administrators - Active Directory

peter_riederer_ — Mon, 03 Aug 2020 10:43:32 GMT

Thank you so much for this easy and simple explanation. Pity i didnt find your post earlier!

Re: vSZ 5.1.x Administrators - Active Directory

jesse_davis_771 — Tue, 18 Aug 2020 16:13:00 GMT

This comment should be starred and giving 200 thumbs up. Thank you so much for laying out those instructions so simply. The online knowledge base for VSZ has been so frustrating to dig though and it seems they have majorly over complicated these processes compared to how they worked on the ZD. THANK YOU!

Re: vSZ 5.1.x Administrators - Active Directory

kem — Tue, 23 Feb 2021 15:36:45 GMT

I found this topic accidentally and it reminded my unsuccessful fight for getting the AD-authentication working for management over a year ago for our vSZ cluster 5.1.2.0.302. I also had a ticket open then but it turned out that AD/LDAP is barely supported.

I would like to upgrade to 5.2 and then try once again if there are any changes and perhaps look for the above posts in this thread but I thought I'd put here some moments from the ticket as copy-paste's that I wrote then since I did some extensive testing to get it working and found "interesting" things. This is my first experience with Ruckus and it was a brand new setup.

1. The Administration\Admins and Roles\AAA server with type LDAP and the dialogue window has two mistakes:
1.1. "Admin Domain Name" is wrong, it is actually "Admin Distinguished Name" or shorter "Admin DN" as I saw here:

https://support.ruckuswireless.com/articles/000009128?_ga=2.49082158.94637583.1577430772-1372812910.1568182478

Re: vSZ 5.1.x Administrators - Active Directory

kem — Tue, 23 Feb 2021 15:42:14 GMT

Somebody possibly just wrote it longer but expanded it wrong. That was a big source of confusion for us when we tried to set it up initially so can you please forward this correction to the right place?
1.2. Search Filter has this explanation: "example: (objectClass=Person, show more...)" but what is this "show more" at the end? It isn't a link to a resource that would show more examples.

2. And the LDAPS problem: just didn't work and was confirmed not working, it is a Feature request instead.

3. Support for more characters in AD-related fields than just English. We are not an English-speaking country and we naturally use other characters too in OU and group names in AD.

Re: vSZ 5.1.x Administrators - Active Directory

kem — Tue, 23 Feb 2021 15:49:16 GMT

I just can't post normally, what's wrong? I try different ways and formatting and editing, then finally something works but there is error message "Failed to update comment, please try again."

So I add the crucial 4th point about the LDAPS as a photo of the text that I wanted to add.

The links in the above text are:

https://confluence.atlassian.com/kb/how-to-write-ldap-search-filters-792496933.html?_ga=2.99324574.1237091716.1577783121-469232227.1567420392

https://social.technet.microsoft.com/wiki/contents/articles/5392.active-directory-ldap-syntax-filters.aspx

Re: vSZ 5.1.x Administrators - Active Directory

aur_lien_barata — Tue, 24 Aug 2021 13:22:41 GMT

Do you know if this process work for 6.0 ?