Difficulty configuring Domain Authentication

Octopus Server
, ,
1

Running v2020.2.16, we are attempting toget Windows Domain Authentication configured and are having issues with the users being recognized over a trust. I have reviewed…

…and tried a few permutations of the configuration suggested but I have been unable to get authentication to work for any user in the trusted domain.

We have two domains, example.com and subdomain.example.com. Our goal is to use users which are authenticated in the example.com domain as the login accounts for the Octopus server. The groups would be managed in the subdomain.example.com domain and users from example.com would be added to the groups.

subdomain.example.com has a one way transitive trust to the example domain.

The server lives in subdomain.example.com and the Active Directory settings are anbled to use that domain. The Octopus service is running under an example.com user account as per documentaion it is required to be in a domain that is trusted by both domains.

I cannot get users to user@example.com to authorize for this domain. Here’s waht happens…

If I use user@example.com as the user name I get…

Invalid username or password. UPN format may not be supported for your domain configuration.

If I use example.com\user, it gets weird and it add the user@subdomain.example.com as a user. I don’t understand this behavior as it appears to be incorrect.

3

Hi @jeffrey.waskiewicz,

Welcome to the Octopus boards!

Thanks for the detailed description of your setup and the issue.

Let me reach out and speak with one of our engineers and gather some more information. I’ll update you as soon as I find out more.

Please feel free to reach out in the meantime with any other questions or concerns.

Thanks,
Jeremy

1 Like
5

Hi @jeffrey.waskiewicz,

I had a chat with one of our engineers and he gave me some information regarding your scenario.

When you are saying you are using example.com\username, are you using the NTdomain, or the DNS domain? It is required to use the NTDomain or you will have issues.

It might be worth noting, but the NTDomain can only contain alpha-numerics, no dashes or punctuation. I don’t think this is your issue, but I wanted to mention it just in case.

Please let me know if that resolves the issue for you or if you were already using the NTDomain.

Thanks,
Jeremy

7

I can confirm I have tried the NTDomain and the issue occurs with example\user.name

8

Hey @jeffrey.waskiewicz,

What is the result when you do ntdomain\user.name? Is it what you said that it adds the subdomain to it?

Thanks,
Jeremy

10

Hey @jeffrey.waskiewicz,

Could you also please try just putting in the username with no domain and see what happens? Also, you’re using the Sign in as a domain account button, correct?

Thanks,
Jeremy

11

All tests executed in an incognito window.

  1. Sign in as a domain account button as example\user first attempt silently fails, the second attempt throws the error…
  1. Sign in as a domain account button as user@example.com first attempt silently fails, the second attempt throws the error…
  1. Use forms authentication for example\jeffrey.waskiewicz. Creates a user for jeffrey.waskiewicz@subdomian.example.com.

4 ) Use forms authentication for jeffrey.waskiewicz@example.com throws the error.

Invalid username or password. UPN format may not be supported for your domain configuration.

Logs: 2020-08-25 11:10:10.1419 26576 20 INFO A principal identifiable by ‘jeffrey.waskiewicz@example.com’ was not found in ‘dc.subdomain.example.app’

12

Hey @jeffrey.waskiewicz,

Thanks for all the information. Let me get back with the engineer and figure out what our next steps are.

Please feel free to reach out in the meantime.

Thanks,
Jeremy

13

Hey @jeffrey.waskiewicz,

Is the service account that runs the Octopus Server a member of the domain, or the subdomain? I believe it will need to be a member of the domain for the Active Directory integration to function correctly.

Please let me know.

Thanks,
Jeremy

14

It’s a member of example.com per your documentation. I stumbled on that during my troubleshooting.

15

Hey,

Thank you for confirming that.

Which type of auth did you choose in your Active Directory settings within Octopus? Negotiate?

Have you tried the SPN workaround in the GH issue you linked above? You said you tried the suggested configuration but wanted to be sure this is what you meant.

Are you able to run setspn -L <server> to list them out so we can get an idea of what they look like? If you need to private message me the results to keep them uncensored please feel free to do so.

Please let me know if you have any questions about the above.

Thanks,
Jeremy

16

This topic was automatically closed 31 days after the last reply. New replies are no longer allowed.