topic Re: Administrator access via Active Directory? in Unleashed

Administrator access via Active Directory?

dan_swartzendru — Sat, 05 Sep 2020 20:06:20 GMT

Is it possible to login to the web UI authenticated using AD? I can't seem to get it to work. I created a role, made sure it it had super admin box checked. In the AD config, I used the test button to give a user and password. Unleashed correctly printed out the various groups, including Administrators, and said the user would be assigned to that group. The role I created was called Administrators, and had 'Administrators' in the Group Attributes, so I *assumed* it would work, but instead I get a login error. I assume I'm missing a piece of the puzzle here, but no idea what. Any tips appreciated.

Re: Administrator access via Active Directory?

tony_heung — Mon, 07 Sep 2020 07:21:56 GMT

These links should help.

AAA Servers Overview
http://docs.ruckuswireless.com/unleashed/200.9/GUID-90F30281-43A5-437E-945B-1FC667F8577E.html

Configuring AAA Servers
http://docs.ruckuswireless.com/unleashed/200.9/GUID-3A38E3A9-A25B-43A3-A212-97A26C563D03.html

Testing Authentication Settings
http://docs.ruckuswireless.com/unleashed/200.9/GUID-D04C3E44-E84F-417A-A2DC-A14150F0B9D6.html

Map Admin Account to AD
http://docs.ruckuswireless.com/unleashed/200.9/GUID-810A8E41-4A10-42A5-B029-C4AA4162FC0C.html

Re: Administrator access via Active Directory?

dan_swartzendru — Mon, 07 Sep 2020 12:03:09 GMT

Okay, that was helpful. All set now, thanks!

Re: Administrator access via Active Directory?

dan_swartzendru — Mon, 07 Sep 2020 14:13:52 GMT

This is weird. I'm trying to post syslog snippets and the site keeps giving me captcha challenges and won't let me by. Hmmm. I'm not sure what the heck is going on, I had to elide almost all of the information from my syslog post, or I'd get stuck in a captcha loop 😞

Re: Administrator access via Active Directory?

dan_swartzendru — Mon, 07 Sep 2020 14:21:40 GMT

Re: Administrator access via Active Directory?

dan_swartzendru — Mon, 07 Sep 2020 14:27:14 GMT

Hmmm, interesting. I either found a bug, or something confusing. So, I have user 'Administrator' (set up during install). Local password is (example) 'foo'. 'Administrator' account under AD has password 'bar'. If I login as 'Administrator' and give 'bar', the log shows this: 2020-09-07T10:05:57-04:00 family-room-ap.druber.com syslog: pid=1577, AuthAdmin():admin login succeed, is_local_auth is 0 2020-09-07T10:05:57-04:00 family-room-ap.druber.com syslog: pid=1577, AuthAdmin():the user is not local auth,no need to promote password recovery feature!! (I am using remote syslog feature). The above is as expected. Now, the wrong/weird thing. I login as 'Administrator' using 'foo', and log shows: 2020-09-07T10:07:15-04:00 family-room-ap.druber.com syslog: pid=1577, AuthAdmin():admin login succeed, is_local_auth is 0 2020-09-07T10:07:15-04:00 family-room-ap.druber.com syslog: pid=1577, AuthAdmin():the user is not local auth,no need to promote password recovery feature!! e.g. even though the gave the local password (I have fallback box checked), it is still claiming not local authentication?

Re: Administrator access via Active Directory?

dan_swartzendru — Mon, 07 Sep 2020 14:28:02 GMT

So if there are any 'funny' characters in the post, I had to use the mode. Well then...

Re: Administrator access via Active Directory?

tony_heung — Mon, 07 Sep 2020 14:41:49 GMT

The syslog message "no need to promote password recovery feature" takes a number of factors to be generated, not necessarily all based on if it is local auth or not. I wouldn't based on this message alone and conclude the system has determined this is not local auth even using the local password. What if you setup with different admin username for AD while keep the Administrator username as local? Would you get the same result?

Re: Administrator access via Active Directory?

dan_swartzendru — Mon, 07 Sep 2020 14:56:36 GMT

One point of confusion: administrator happens to also be an AD user. So, I changed the local user to 'admin'. I then logged in via ssh:

Please login: admin
Password:
Welcome to Ruckus Unleashed Network Command Line Interface
ruckus>

admin login succeed, is_local_auth is 0

something is not right?

Re: Administrator access via Active Directory?

tony_heung — Mon, 07 Sep 2020 17:20:04 GMT

Understood. Basically the AD auth is working fine but you found it odd that the system returned the message saying it is local auth instead? Maybe it's time to log a ticket with support and so they can examine the log in more detail.

Re: Administrator access via Active Directory?

syamantakomer — Mon, 07 Sep 2020 17:26:44 GMT

Hi Dan,

Whatever user name and the password is configured under Admin & Service >> Administrator >> Preference >> Administrator Name/Password, is the only user which can access CLI of the Unleashed. This is as per design.

Let us know if you are observing different behavior.

Regards,
Syamantak Omer

Re: Administrator access via Active Directory?

dan_swartzendru — Mon, 07 Sep 2020 17:48:03 GMT

Yes, I am. 'dswartz' is my personal account in AD. See:

[root@centos-vsa1 ~]# ssh 10.0.0.18

Please login: dswartz
Password:
Welcome to Ruckus Unleashed Network Command Line Interface

Re: Administrator access via Active Directory?

dan_swartzendru — Mon, 07 Sep 2020 17:49:34 GMT

Tony, precisely. It seems weird it's telling me non-local when that clearly isn't the case. NB: I am not complaining with an issue here, just thought you might want to know something is off. I don't have paid contract, so is it even possible for me to open a ticket?

Re: Administrator access via Active Directory?

dan_swartzendru — Mon, 07 Sep 2020 17:56:38 GMT

Syamantak, you seem to be using a version of unleashed without the AAA support?

Re: Administrator access via Active Directory?

tony_heung — Tue, 08 Sep 2020 10:56:41 GMT

Thanks Dan for the info. I will talk to the engineering team in the next meeting.