Installation and deployment Questions on installation, system configuration and deployment to the live server.
Version 5.x > Installation and deployment > Having trouble with AD import and Windows Authentication View modes: 
User avatar
Member
Member
kong-gc.cuny - 5/16/2011 5:13:52 PM
   
Having trouble with AD import and Windows Authentication
Hello folks. I've read through all the postings and help files I could find but to no avail. So here is what I have and could use some help with:

* I have a default Corporate Site (portal) install at the moment that I'm testing with.
* I've run the AD import tool and imported a handful of users (didn't want too much garbage yet). One of the accounts I imported was my own 'kong' which I gave global admin permission to.
* I ran the AD import tool from a desktop PC and had it update the database that the Kentico installation is running from.

* I tried to log into the CMSDesk and the CMS Site Manager and in both cases, it would not recognize my password when I typed in my network pwd.
* I then read something about changing the web.config file to use 'Windows' instead of 'Forms' authentication and did that but trying to login also didn't work (I didn't even get the auto-login that I guess should be happening in this case).
* I then decided to take a peek around and looked at the CMS.Users table and noticed that the only account with a password was the default Admin account. All the users I imported did not come with a password (though I'm assuming this is normal?)

So my questions are:
* Any suggestions at this point on what to do?
* Do I need to run the import tool on the actual server that I have Kentico installed on or does it matter?
* Is there something I need to do in Kentico itself in order to point it to the AD server that it needs to authenticate against?

I'm really stumped here and not quite sure as to the next steps I should be taking. Can anyone give a bit of assistance?

Thank you!

User avatar
Kentico Developer
Kentico Developer
kentico_ivanat - 5/18/2011 6:55:34 AM
   
RE:Having trouble with AD import and Windows Authentication
Hi,

could you please confirm that you have already seen following documentation:
configuring windows authentication
windows vista and windows 7 authentication (IIS 7 and higher)

The password is not imported with the AD import tool. Users who were imported by the tool are recognized according to Is domain user checkbox.


What was the setting for the AD Import tool for the user names? In which format are they imported - with slash or dash between domain and user name? Maybe that the users were imported using one format but the CMS is set to use the other one.


Best regards,
Ivana Tomanickova

User avatar
Member
Member
kong-gc.cuny - 5/19/2011 5:00:22 PM
   
RE:Having trouble with AD import and Windows Authentication
I've read through both documentations. When I imported, I use 'SAM account name (joe)' and checking in the db, I see also that the username is recorded as only being the user.. no domains, no slasshes or dashes.

Do I need to run the import tool on the same server that Kentico is installed on?

User avatar
Kentico Developer
Kentico Developer
kentico_ivanat - 5/23/2011 7:12:37 AM
   
RE:Having trouble with AD import and Windows Authentication
Hi,

Could you please try to reimport users using Domain\SAM (intranet\joe) format? The SAM format would require using custom membership provider. Then the logon should work without need of second login on the site (in case you are using the Internet Explorer browser). In the Firefox, typing user name i.e domain\joe would be required. If you take a look to the database the name is stored in format domain-joe, but during login you can type the name with slash.

Best regards,
Ivana Tomanickova


User avatar
Member
Member
kong-gc.cuny - 5/23/2011 4:03:25 PM
   
RE:Having trouble with AD import and Windows Authentication
After some testing we found that indeed it preferred the domain-user format and so we have that partially working now.

However it seems that we also need to add the domain of the site into our 'trusted intranet' settings in IE. Is there anyway to bypass this requirements?

User avatar
Kentico Developer
Kentico Developer
kentico_ivanat - 5/25/2011 7:22:39 AM
   
RE:Having trouble with AD import and Windows Authentication
Hi,

one possibility would be to decrease the level of security in IE, but it is not a good solution. Maybe you could try to change group policy?

Best regards,
Ivana Tomanickova