Products

Solutions

Resources

Partners

Community

Blog

About

QA

Ideas Test

New Community Website

Ordinarily, you'd be at the right spot, but we've recently launched a brand new community website... For the community, by the community.

Yay... Take Me to the Community!

Welcome to the DNN Community Forums, your preferred source of online community support for all things related to DNN.
In order to participate you must be a registered DNNizen

HomeHomeDNN Open Source...DNN Open Source...Provider and Extension ForumsProvider and Extension ForumsAuthenticationAuthenticationAD configuration frustration - authentication intermittantAD configuration frustration - authentication intermittant
Previous
 
Next
New Post
1/20/2009 3:00 PM
 

This has gotten to be an extremely frustrating issue for us.  I've attempted just about every suggestion in the forums and have followed the documentation but the AD authentication is simply not working properly; nor will it replicate any group memberships or AD objects.  The users initial profile is completed fine (first, last, city, state, etc.) but no extended properties are replicated.  If a users AD password is changed, it works fine on their next login to the site (for the most part... see below) so their base AD info is getting synchronized to DNN.

Using DNN 4.8.4, AD version 1.0.4.   Directory connection configuration OK.  Intranet users ONLY, no extranet access.

When directory authenticated users go to (for example) http://portal.domain.com they constantly get prompted/re-prompted with a Win login. In some cases, they key in their credentials and login to the site. In other cases, the Win prompt pops over and over and over again and eventually they get a partially built page but are still not logged in.  If the users go to the 'short name' of the site "http://portal/" in MOST cases, they are logged in automatically but quite often, they are not.  Part of the issue is due to the FQDN not existing in their local intranet zone in IE6 (locked down/not user changeable).  In IE7, this issue was addressed so either the short name or the FQDN logs them in automatically MOST of the time, but not consistantly.  If they clear their browser settings (cookies, temp files, etc.) then occassionaly, they are able to login again but often experiencing the same Win popup either once or continuously.

Also, if I, using IE7, connect to the site, I get authenticated fine but after browsing around a bit, eventually one of the links on the site will cause the Windows login prompt to pop up again repeatedly.  Only closing all my browser sessions, clearing all settings and going back to the site will fix it. 

Anonymous is off for only the one WindowsSignin.aspx file. Impersonation is set to false.  If set to true and using a working service ID in the web.config (which we don't really want to do anyway), then ALL users get prompted for a Windows login and it will NOT authenticate them to the site.

Someone please shed some light on this issue for me. I've got several folks pestering me to get this fixed for them and there seems to be no one setting that yields consistent results.

Thanks.

 
New Post
1/21/2009 1:26 AM
 

When you say extended properties aren't replicated what extended properties are you talking about? There's a chance that they aren't as there's a finite list of properties that are checked (mainly the most common ones). I can post the whole list here tomorrow if you want me to but I don't have the provider code handy at the moment.

Group memberships not working...I just want to check before I go further....do the Roles exist in DNN that match the AD security groups already?

Win Logon pop-up...there's nothing we can do about that one. That's a network configuration and I'm guessing that it's handled by group policy in your situation. Whomever handles group policy in your domain should be able to put a wild-card listing so that any computer on the domain has any URLs that belong to the domain in its Intranet or Trusted sites list (the URL that needs to be entered is http://*.domain.com).

As for continuous logon pop-ups showing up....Is there anything extra running on your domain computers that might be blocking the information that's being passed? I'm thinking 3rd party firewall programs like Zone-Alarm or anti-virus program that is blocking the passing of user credentials (Norton used to be horrid about that).

 
New Post
1/26/2009 1:52 PM
 

Mike Horton wrote

When you say extended properties aren't replicated what extended properties are you talking about? There's a chance that they aren't as there's a finite list of properties that are checked (mainly the most common ones). I can post the whole list here tomorrow if you want me to but I don't have the provider code handy at the moment.

I've added several new fields to the user profile such as EmployeeID, ManagerID, etc. that exactly match the AD objects; I assumed these could be replicated in addition to group memberships but I may be mistaken on that.  If there are specific properties that CAN be obtained that are not in the current profile; yes, I'd like to see the list if that wouldn't be too much trouble.

Mike Horton wrote

Group memberships not working...I just want to check before I go further....do the Roles exist in DNN that match the AD security groups already?

Yes, the security roles exactly match the AD groups.  What I wasn't certain about is whether or not Public Role and/or Auto Assignment needed checking.  In fact, users that ARE members of the AD groups are being REMOVED from the matching DNN role rather than being added...

Mike Horton wrote

Win Logon pop-up...there's nothing we can do about that one. That's a network configuration and I'm guessing that it's handled by group policy in your situation. Whomever handles group policy in your domain should be able to put a wild-card listing so that any computer on the domain has any URLs that belong to the domain in its Intranet or Trusted sites list (the URL that needs to be entered is http://*.domain.com).

As for continuous logon pop-ups showing up....Is there anything extra running on your domain computers that might be blocking the information that's being passed? I'm thinking 3rd party firewall programs like Zone-Alarm or anti-virus program that is blocking the passing of user credentials (Norton used to be horrid about that).

The odd thing about the Login popup is that it occurs in an inconsistent fashion, most users get logged in fine.  Yes, there is a wildcard listing for both IE6 and IE7 for the local intranet zone but it functions 60-70% in IE6 and about 90% in IE7.  Regardless, the popup is the main irritation for those users who are not getting logged in. Here are some clues for different 'solutions' that work in some cases, that may help:

If user A is getting prompted repeatedly with the login popup (their valid, already in use credentials will NOT authenticate them into DNN), I can go into DNN and reset the users password. They can now go to the site and be auto-logged in  with their domain credentials; however, if I check their account status, it shows the last login days ago, not today.

If user B is getting prompted repeatedly (their valid, already in use credentials will NOT authenticate them into DNN), and they clear the browser settings and restart their browser, they go to the site and are logged in.  At some point however, they get intermittantly prompted for the windows login again.

If user C is getting prompted, they key in their credentials into the login box and it works. They continue on into the DNN site and are logged in.

I used A, B and C as examples because the 'solutions' are not consistent. It varies across the domain.  We have NUMEROUS other web based apps that are referencing the AD that work flawlessly... it is ONLY DNN that is experiencing this behavior.

Any ideas?

 
New Post
1/26/2009 1:58 PM
 

I should mention also that this MAY be related to the 'Remember Login' checkbox on the DNN login page. I recall from talking to a few of the users that they HAD selected that having previously gotten to the site in a 'not logged in' status.   Is it possible that this selection is contributing to the problem? If so, can it be turned off?

Also, could this be related to the Host>Authenticated Cacheability setting being 'Public' and would changing it NoCache, Private, Server, SaverAndNoCache or ServerAndPrivate have any positive effect???

 
New Post
1/26/2009 4:11 PM
 

Remember login shouldn't make a difference but I'll do some testing to verify that.

The security roles do not need anything special checked. You might want to consider trying the 01.00.05 beta release (http://dnn.gmss.org until it clears the DNN Release Tracker) as there were some problems with role synchronization in the .04 release (the most common complaint was that users weren't being removed from roles when they no longer belonged to the group).

For the differences that users are seeing when trying to get logged into DNN..... I'm at a loss on that. The only thing I can suggest is looking at IIS logs and the DNN Eventviewer to see if you can see any kind of pattern for each group. (BTW the last login date is fixed in the .05 release).

I'm going to paste the code for the properties that are pulled from the AD for the DNN profile. From it you should be able to figure out what fields are populated. The ability to change what's pulled is on the future enhancement list.

Sub FillUserInfo(ByVal UserEntry As DirectoryEntry, ByVal UserInfo As UserInfo)With UserInfoFalse

.Username = UserInfo.Username

.Membership.Approved =

True

.Membership.LastLoginDate =

 

Date.NowIf Not (Utilities.CheckNullString(UserEntry.Properties(Configuration.ADSI_EMAIL).Value) = "") Then

.Email = Utilities.CheckNullString(UserEntry.Properties(Configuration.ADSI_EMAIL).Value)

 

End If

 

If .Email = "" Then

.Email = Utilities.TrimUserDomainName(UserInfo.Username) & _adsiConfig.DefaultEmailDomain

 

End If

 

If Not (Utilities.CheckNullString(UserEntry.Properties(Configuration.ADSI_CNAME).Value.ToString) = "") Then

.CName = Utilities.CheckNullString(UserEntry.Properties(Configuration.ADSI_CNAME).Value.ToString)

 

End If

 

If Not (Utilities.CheckNullString(UserEntry.Properties(Configuration.ADSI_DISPLAYNAME).Value) = "") Then

.DisplayName = Utilities.CheckNullString(UserEntry.Properties(Configuration.ADSI_DISPLAYNAME).Value)

 

End If

 

If .DisplayName = "" Then

.DisplayName = .CName

 

End If

 

If Not (Utilities.CheckNullString(UserEntry.Properties(Configuration.ADSI_DISTINGUISHEDNAME).Value.ToString) = "") Then

.DistinguishedName = Utilities.CheckNullString(UserEntry.Properties(Configuration.ADSI_DISTINGUISHEDNAME).Value.ToString)

 

End If

 

If Not (Utilities.CheckNullString(UserEntry.Properties(Configuration.ADSI_ACCOUNTNAME).Value.ToString) = "") Then

.sAMAccountName = Utilities.CheckNullString(UserEntry.Properties(Configuration.ADSI_ACCOUNTNAME).Value.ToString)

 

End If

 

If Not (Utilities.CheckNullString(UserEntry.Properties(Configuration.ADSI_CNAME).Value) = "") Then

.Profile.FirstName = Utilities.CheckNullString(UserEntry.Properties(Configuration.ADSI_FIRSTNAME).Value)

 

End If

 

If Not (Utilities.CheckNullString(UserEntry.Properties(Configuration.ADSI_LASTNAME).Value) = "") Then

.Profile.LastName = Utilities.CheckNullString(UserEntry.Properties(Configuration.ADSI_LASTNAME).Value)

 

End If

 

If Not (Utilities.CheckNullString(UserEntry.Properties(Configuration.ADSI_STREET).Value) = "") Then

.Profile.Street = Utilities.CheckNullString(UserEntry.Properties(Configuration.ADSI_STREET).Value)

 

End If

 

If Not (Utilities.CheckNullString(UserEntry.Properties(Configuration.ADSI_CITY).Value) = "") Then

.Profile.City = Utilities.CheckNullString(UserEntry.Properties(Configuration.ADSI_CITY).Value)

 

End If

 

If Not (Utilities.CheckNullString(UserEntry.Properties(Configuration.ADSI_REGION).Value) = "") Then

.Profile.Region = Utilities.CheckNullString(UserEntry.Properties(Configuration.ADSI_REGION).Value)

 

End If

 

If Not (Utilities.CheckNullString(UserEntry.Properties(Configuration.ADSI_POSTALCODE).Value) = "") Then

.Profile.PostalCode = Utilities.CheckNullString(UserEntry.Properties(Configuration.ADSI_POSTALCODE).Value)

 

End If

 

If Not (Utilities.CheckNullString(UserEntry.Properties(Configuration.ADSI_COUNTRY).Value) = "") Then

.Profile.Country = Utilities.CheckNullString(UserEntry.Properties(Configuration.ADSI_COUNTRY).Value)

 

End If

 

If Not (Utilities.CheckNullString(UserEntry.Properties(Configuration.ADSI_TELEPHONE).Value) = "") Then

.Profile.Telephone = Utilities.CheckNullString(UserEntry.Properties(Configuration.ADSI_TELEPHONE).Value)

 

End If

 

If Not (Utilities.CheckNullString(UserEntry.Properties(Configuration.ADSI_FAX).Value) = "") Then

.Profile.Fax = Utilities.CheckNullString(UserEntry.Properties(Configuration.ADSI_FAX).Value)

 

End If

 

If Not (Utilities.CheckNullString(UserEntry.Properties(Configuration.ADSI_CELL).Value) = "") Then

.Profile.Cell = Utilities.CheckNullString(UserEntry.Properties(Configuration.ADSI_CELL).Value)

 

End If

 

If Not (Utilities.CheckNullString(UserEntry.Properties(Configuration.ADSI_WEBSITE).Value) = "") Then

.Profile.Website = Utilities.CheckNullString(UserEntry.Properties(Configuration.ADSI_WEBSITE).Value)

 

End If

.AuthenticationExists =

True

 

' obtain firstname from username if admin has not enter enough user info

 

If .Profile.FirstName.Length = 0 Then

.Profile.FirstName = Utilities.TrimUserDomainName(UserInfo.Username)

 

End If

 

End With

 

 

End Sub 

Private

 

.IsSuperUser =

 
Previous
 
Next
HomeHomeDNN Open Source...DNN Open Source...Provider and Extension ForumsProvider and Extension ForumsAuthenticationAuthenticationAD configuration frustration - authentication intermittantAD configuration frustration - authentication intermittant


These Forums are dedicated to discussion of DNN Platform and Evoq Solutions.

For the benefit of the community and to protect the integrity of the ecosystem, please observe the following posting guidelines:

  1. No Advertising. This includes promotion of commercial and non-commercial products or services which are not directly related to DNN.
  2. No vendor trolling / poaching. If someone posts about a vendor issue, allow the vendor or other customers to respond. Any post that looks like trolling / poaching will be removed.
  3. Discussion or promotion of DNN Platform product releases under a different brand name are strictly prohibited.
  4. No Flaming or Trolling.
  5. No Profanity, Racism, or Prejudice.
  6. Site Moderators have the final word on approving / removing a thread or post or comment.
  7. English language posting only, please.
What is Liquid Content?
Find Out
What is Liquid Content?
Find Out
What is Liquid Content?
Find Out