Next Generation FirewallNext-generation firewall for SMB, Enterprise, and Government
Security ServicesComprehensive security for your network security solution
Capture Security applianceAdvanced Threat Protection for modern threat landscape
Network Security ManagerModern Security Management for today’s security landscape
Cloud Edge Secure AccessDeploy Zero-Trust Security in minutes
Secure Mobile AccessRemote, best-in-class, secure access
Wireless Access PointsEasy to manage, fast and secure Wi-FI
SwitchesHigh-speed network switching for business connectivity
Email SecurityProtect against today’s advanced email threats
Cloud App SecurityVisibility and security for Cloud Apps
Cloud Firewall (NSv)Next-generation firewall capabilities in the cloud
Capture ClientStop advanced threats and rollback the damage caused by malware
Content Filtering ClientControl access to unwanted and unsecure web content
Next Generation FirewallNext-generation firewall for SMB, Enterprise, and GovernmentSecurity ServicesComprehensive security for your network security solutionCapture Security applianceAdvanced Threat Protection for modern threat landscapeNetwork Security ManagerModern Security Management for today’s security landscapeCloud Edge Secure AccessDeploy Zero-Trust Security in minutesSecure Mobile AccessRemote, best-in-class, secure accessWireless Access PointsEasy to manage, fast and secure Wi-FISwitchesHigh-speed network switching for business connectivityEmail SecurityProtect against today’s advanced email threatsCloud App SecurityVisibility and security for Cloud AppsCloud Firewall (NSv)Next-generation firewall capabilities in the cloudCapture ClientStop advanced threats and rollback the damage caused by malwareContent Filtering ClientControl access to unwanted and unsecure web contentBrowse Knowledgebase by Category
03/26/2020 
3 
9131
DESCRIPTION:
In the firmware 12.1.0, we see that the User Domain part is stripped down through using userPrincipalName as the user name attribute
For Example, We see in the policy server logs:
ssl1 ps 100004fb Debug 1 System AUTH: UNPW-AD :getDnAndGroupsAndAttribsOfUser(): userID: [testuser]
ssl1 012688 ps 100004fb Debug 1 System AUTH: UNPW-AD :getDnAndGroupsAndAttribsOfUser(): uidAttr: [userPrincipalName]
ssl1 012688 ps 100004fb Debug 1 System AUTH: UNPW-AD :getDnAndGroupsAndAttribsOfUser(testuser): search filter: [(userPrincipalName=testuser)]
ssl1 012688 ps 100004fb Verbose System AUTH: UNPW-AD :LDAP: searching with base: [dc=mycompany,dc=com], filter: [(userPrincipalName=testuser)]
Where ssl1 is the node name; testuser is the user name; mycompany.com is the user domain.
Expected result should be testuser@mycompany.com
This may cause Authentication failure
CAUSE:
Appliance Extraweb is stripping the domain part when user is trying to authenticate.
RESOLUTION:
When you have UserPrincipalName as username attribute for authentication, you need to configure the below CEM for Activesync/OA authentication to work.
Please follow the below process to apply the configuration extension on the Aventail Management Console.
Please contact SonicWALL technical support at 1-888-793-2830 if you have any questions. It is adviced to make this change with the guidance of the technical support.
Note: Applying this change will cause all the services to be restarted. Please schedule a window for this change.
ISSUE ID:
198231
