User Domain part is stripped down using userPrincipalName in SMA firmware 12.1.0

03/26/2020 3 6086

DESCRIPTION:

In the firmware 12.1.0, we see that the User Domain part is stripped down through using userPrincipalName as the user name attribute

For Example, We see in the policy server logs: 

ssl1 ps 100004fb Debug 1 System AUTH: UNPW-AD :getDnAndGroupsAndAttribsOfUser(): userID: [testuser]
ssl1 012688 ps 100004fb Debug 1 System AUTH: UNPW-AD :getDnAndGroupsAndAttribsOfUser(): uidAttr: [userPrincipalName]
ssl1 012688 ps 100004fb Debug 1 System AUTH: UNPW-AD :getDnAndGroupsAndAttribsOfUser(testuser): search filter: [(userPrincipalName=testuser)]
ssl1 012688 ps 100004fb Verbose System AUTH: UNPW-AD :LDAP: searching with base: [dc=mycompany,dc=com], filter: [(userPrincipalName=testuser)]

Where ssl1 is the node name; testuser is the user name; mycompany.com is the user domain.

Expected result should be testuser@mycompany.com

This may cause Authentication failure

CAUSE:

Appliance Extraweb is stripping the domain part when user is trying to authenticate.

RESOLUTION:

When you have UserPrincipalName as username attribute for authentication, you need to configure the below CEM for Activesync/OA authentication to work.

Please follow the below process to apply the configuration extension on the Aventail Management Console.

1. Log in to AMC.
2. Click on Maintenance in the left-hand navigation menu.
3. In the URL, append "?advanced=1", and hit return.
4. Click on Configure under the new section Configuration extensions.
5. Click New
6. For the Key field, put in: EW_ASYNC_STRIP_DOMAIN
7. For the Value field, put in: false
8. Click OK.
9. Click Save,
10. Apply Changes (this will force an apply-all, making the changes take effect).
11. Click on Apply All and again Apply the Pending Changes.

ISSUE ID:

198231