AD Authentication fail

[elvicmac]

Since yesterday we started to have issues trying to access aour DB by WEB as we use to do it we have a powerMac G5 Mac as FM server and have the Server advanced (9.0 3) with MacOS 10.5.8and 4GB Ram, we reviewed the settingsfor directory service and nothing cnahged but all the users whne try to access using the AD user/password shows a message :

"The account and password you entered cannot be used to access this file. Please try again."

We didn't update any thing on the OS, any suggestions will be very appreciated.

Thks

PS this happens also for users with FM PRo Clients trying to access databaeses using the AD accounts, with the administrator password have no issues ( at least using FM client)

:ph34r:

[Steven H. Blackwell]

Since yesterday we started to have issues trying to access aour DB by WEB as we use to do it we have a powerMac G5 Mac as FM server and have the Server advanced (9.0 3) with MacOS 10.5.8and 4GB Ram, we reviewed the settingsfor directory service and nothing cnahged but all the users whne try to access using the AD user/password shows a message :

"The account and password you entered cannot be used to access this file. Please try again."

We didn't update any thing on the OS, any suggestions will be very appreciated.

Thks

PS this happens also for users with FM PRo Clients trying to access databaeses using the AD accounts, with the administrator password have no issues ( at least using FM client)

So many items to check here.

1. Is Use External Accounts option activated in the Server Admin Console?

2. Are the Groups set up properly in both Active Directory and in the FIleMaker Pro files? The group names must match exactly.

3. Directory Service settings have nothing to do with External Server Authentication.

4. Is the server a member of the domain?

5. Server 9 had some External Authentication issues. Be sure you have run the x326 updater on FM Server.

6. Since you are using Macintosh OS for your server, all suers will have to enter credentials to access the files. There is no Single Sign On in this scenario. However, the external credentials from the domain controller should work to authenticate them, both for FIleMaker Pro and for web access. There is no SSO for web, but again, the external credentials should work. Be sure that the Privilege Set for the Group to which an Account belongs has the appropriate web access privilege bit enabled in the file.

Steven

[elvicmac]

Thks for your answer, mi coments in Red

So many items to check here.

1. Is Use External Accounts option activated in the Server Admin Console? If I'm correct this is on the tab "Security" and is slected on "client authentication "Filemaker and external server accounts"

2. Are the Groups set up properly in both Active Directory and in the FIleMaker Pro files? The group names must match exactly. . Yes this haven't changed

3. Directory Service settings have nothing to do with External Server Authentication.

4. Is the server a member of the domain? No, is not

5. Server 9 had some External Authentication issues. Be sure you have run the x326 updater on FM Server. Yes I laready have that version

6. Since you are using Macintosh OS for your server, all suers will have to enter credentials to access the files. There is no Single Sign On in this scenario. However, the external credentials from the domain controller should work to authenticate them, both for FIleMaker Pro and for web access. There is no SSO for web, but again, the external credentials should work. Be sure that the Privilege Set for the Group to which an Account belongs has the appropriate web access privilege bit enabled in the file.

Yes this is enabled as should be

Steven

And as I mentioned until Friday we were able to access without problems, perhaps a pref file would be damaged and have to reinstall again?

What do you think?

[Vaughan]

I mentioned until Friday we were able to access without problems

So what happened on Friday? Did the system have an OS or Java update installed?

[Steven H. Blackwell]

4. Is the server a member of the domain? No, is not

Well if the database server is not a member of the domain the only way external server authentication will work is if the Accounts and Groups are part of the local security groups on that database server. I'd double check this to be sure whether the server is aprt of the domain or not.

Steven

[FMaker]

Well if the database server is not a member of the domain the only way external server authentication will work is if the Accounts and Groups are part of the local security groups on that database server. I'd double check this to be sure whether the server is aprt of the domain or not.

Steven

Has anything change with the domain controller? I use a Windows server for the FM Server install but our Mac users authenticate to AD via an OS X Server. In order for this to work I had to modify the GPO because Windows thought the Mac server was a man-in-the-middle attack.

http://support.microsoft.com/kb/935834

[Steven H. Blackwell]

Has anything change with the domain controller? I use a Windows server for the FM Server install but our Mac users authenticate to AD via an OS X Server. In order for this to work I had to modify the GPO because Windows thought the Mac server was a man-in-the-middle attack.

http://support.microsoft.com/kb/935834

Have there been any OS updates or patches to this OS X Server? This is a bit of an odd configuration. However, jsut to repeat an earlier point, a Macintosh user can never achieve SSO with FIleMaker Server. But Mac users can be authenticated by AD based eternal credentials.

Steven