Hello Everyone,
I'm enjoying the latest interface for setting the Windows AD settings but it's only working for users in one domain, the root.
Currently, to keep things simple I allow the root domain to be auto discovered in the forest. I also do NOT specify a default domain. The authentication type I leave to delegation mode. I use
myuser@mydomain.com as the user to read the Windows AD directory. (Note: The behavior is the same even when I specify mydomain.com as the root and default domain.)
IMPORTANT FACTOID #1: I read that the user specified for this only needs read permissions. I suspect it is more complicated than that as I outline further down.
When I login with
myuser@mydomain.com and a valid password, it logs in successfully and creates the user in the DNN users table, AWESOME...
However, when I login with
myotheruser@myotherdomain.com and a valid password, it fails. This other domain belongs to the same forest and is just a namespace in the Windows AD system.
Since the user I use in the extension's config area belongs to mydomain.com I figured changing this user to be
myotheruser@myotherdomain.com would flip the behavior around so that
myotheruser@myotherdomain.com would work and
myuser@mydomain.com would stop working. Interestingly, when I change the user specified in the extension's config area it didn't do this. In fact, using
myotheruser@myotherdomain.com seemed to take in the settings area --- but when I went to login as ANY user after this change it failed entirely.
I found what appears to be a tracked issue but the date doesn't show the
year the issue was submitted and the fact that I can login using myuser@mydomain.com implies UPN logins DOES work in the latest version of the AD extension:
http://dnnauthad.codeplex.com/WorkIte...
This leaves me wondering:
1. Are there special permission requirements for the user specified in the Windows AD authentication settings area? i.e. An AD admin that can walk the entire directory, additional domains/namespaces and all.
2. Does the
myotheruser@myotherdomain.com have less permissions than
myuser@mydomain.com... hence the total failure to login OR is it that myotherdomain.com is NOT the root domain?
3. Does this extension not respect/support additional domains/namespaces and you have to login only as users from your root domain?
4. Have I selected the wrong authentication type?
5. Am I missing something altogether different than my theories above?
P.S. I have read all the documentation I can get my hands on. Being that this is newer it seems the documentation is a bit superficial or outdated (previous builds). Many issues seemed focused on the SSO (single-sign-on) stuff but I'm using mixed-mode anyways and the hack-arounds out there seem okay should I require it later.
Thanks, Dylan