This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

DPA Authentication Multiple Domains in Separate Forests

Does anyone have any experience setting up DPA for multiple domains in separate forests? I see several KBs that reference the BaseDN can be shortened to allow easy authentication of sub domains in the same forest. I don't see any practical examples for multiple domains in separate forests. There is a fully trust and I have members of domain B in a security group in domain A (where domain A is configured in DPA and is a global catalog AD Domain controller). Domain A users can authenticate fine, domain B members cannot log and I get the follow in the DPA Auth logs.

WARN (2019-12-09 14:49:27,208.EST) [https-jsse-nio-8124-exec-10] CustomUserDetailsService - xxxx

INFO (2019-12-09 14:49:27,270.EST) [https-jsse-nio-8124-exec-10] LoginThrottle - Invalid login attempt to /iwc/login.iwc by 'xxxx' from 10.10.x.x

0 mohammad.hafizullah over 2 years ago

Have you found any answer or work around to this problem?
Cancel
Vote Up 0 Vote Down

Cancel
0 cpriddy over 2 years ago

You might refer to https://documentation.solarwinds.com/en/success_center/dpa/content/dpa-configure-ad-or-ldap.htm

Do you have multiple domains?

If your domain users authenticate from a different domain other than the domain specified here, you must connect to the global catalog ports 3268 or 3269. The domain users must belong to a universal group, and that universal group must be added under Options > Administration > Users & Contacts > User Administration.

We have had cases where this is followed and there are still some issues in finding some of the groups in the search form odd or not standard LDAP setups. You may need to call DPA support for additional workarounds if that is the case.
Cancel
Vote Up 0 Vote Down

Cancel
0 monitoringlife over 1 year ago in reply to mohammad.hafizullah

Sorry for the late reply. There was no workaround. I ended up using another authentication system (which is likely not an option for most organizations).
Cancel
Vote Up 0 Vote Down

Cancel

DPA Authentication Multiple Domains in Separate Forests

Do you have multiple domains?