Troubleshooting Integrated Windows Authentication

Help | Content Gateway | Version 8.3.x

This section covers 2 common problems:

Failure to join the domain

Failure to authenticate clients

Failure to join the domain

These conditions are required for Content Gateway to join a domain:

Content Gateway must be able to resolve the domain name.

Content Gateway system time must be synchronized with the domain controller's time, plus or minus 1 minute.

The correct domain Administrator name and password must be specified.

There must be TCP/UDP connectivity to the domain controller(s) (ports 88, 389, 445).

If backup domain controllers are configured, they and their Kerberos Distribution Center (KDC) services, must be reachable by Content Gateway on the network.

If the Active Directory is configured with multiple Sites, ensure that the subnet that Content Gateway is on is added to one of them.

Troubleshooting:

Errors encountered in the join action are reported at the top of the screen (the Integrated Windows Authentication tab).

The error message usually includes a link to the failure log where you can get more details.

Join failures are logged to /opt/WCG/logs/smbadmin.join.log

In most cases, the failure message in the log is a standard Samba and Kerberos error message that is easily found with an Internet search.

Failure to authenticate clients

These conditions are required to authenticate clients:

Content Gateway clients must be a member of the same domain as that joined by Content Gateway.

Client system time must be in sync with the domain controller and Content Gateway to plus or minus 1 minute.

Explicit proxy clients must not be configured to send requests to the IP address of Content Gateway. Clients must use the Fully Qualified Domain Name (FQDN) of Content Gateway. If the IP address is used, NTLM authentication is always performed.

The Content Gateway FQDN must be in DNS and resolvable by all proxy clients.

Browsers and other client applications must specify the FQDN of Content Gateway as an intranet site or trusted site.

When the Active Directory is configured with multiple Sites, the subnet that Content Gateway is on must be added to one of them. If it's not, the following alarm may be generated when Content Gateway is restarted:

Windows domain [domain name] unreachable or bad membership status

Troubleshooting:

In the Content Gateway manager, use the Diagnostic Test function on the Monitor > Security > Integrated Windows Authentication tab. This Monitor page displays authentication request statistics and provides the diagnostic test function.

The Diagnostic Test function performs connectivity and authentication testing and reports errors. It also shows domain controller TCP port connectivity and latency.

Errors and messages are logged to:

/var/log/messages

content_gateway.out

/opt/WCG/logs/smbadmin.log

/opt/WCG/logs/smbadmin.join.log

Performance issues:

IWA (Kerberos): Authentication performance is bound by CPU. There is no communication to the domain controllers for Kerberos authentication.

NTLM and Basic: Domain controller responsiveness effects performance. The Monitor > Security > Integrated Windows Authentication page shows average response time.