Support

Go to the table of contents Go to the previous page Go to the next page Go to the index View or print as PDF
Security > Proxy user authentication > Integrated Windows Authentication > Troubleshooting Integrated Windows Authentication
Troubleshooting Integrated Windows Authentication
Help | Content Gateway | Version 7.7.3
This section covers 2 common problems:
*
Failure to join the domain
*
Failure to authenticate clients
Failure to join the domain
These conditions are required for Content Gateway to join a domain:
*
Content Gateway must be able to resolve the domain name.
*
Content Gateway system time must be synchronized with the domain controller's time, plus or minus 1 minute.
*
The correct domain Administrator name and password must be specified.
*
There must be TCP/UDP connectivity to the domain controller(s) (ports 88, 389, 445).
*
If backup domain controllers are configured, they and their Kerberos Distribution Center (KDC) services, must be reachable by Content Gateway on the network.
*
If the Active Directory is configured with multiple Sites, ensure that the subnet that Content Gateway is on is added to one of them.
Troubleshooting:
*
Errors encountered in the join action are reported at the top of the screen (the Integrated Windows Authentication tab).
*
The error message usually includes a link to the failure log where you can get more details.
*
Join failures are logged to /opt/WCG/logs/smbadmin.join.log
*
In most cases, the failure message in the log is a standard Samba and Kerberos error message that is easily found with an Internet search.
Failure to authenticate clients
These conditions are required to authenticate clients:
*
Content Gateway clients must be a member of the same domain as that joined by Content Gateway.
*
Client system time must be in sync with the domain controller and Content Gateway to plus or minus 1 minute.
*
Explicit proxy clients must not be configured to send requests to the IP address of Content Gateway. Clients must use the Fully Qualified Domain Name (FQDN) of Content Gateway. If the IP address is used, NTLM authentication is always performed.
*
The Content Gateway FQDN must be in DNS and resolvable by all proxy clients.
*
Browsers and other client applications must specify the FQDN of Content Gateway as an intranet site or trusted site.
*
When the Active Directory is configured with multiple Sites, the subnet that Content Gateway is on must be added to one of them. If it's not, the following alarm may be generated when Content Gateway is restarted:
Windows domain [domain name] unreachable or bad membership status
Troubleshooting:
In Content Gateway Manager, use the Diagnostic Test function on the Monitor > Security > Integrated Windows Authentication tab. This Monitor page displays authentication request statistics and provides the diagnostic test function.
The Diagnostic Test function performs connectivity and authentication testing and reports errors. It also shows domain controller TCP port connectivity and latency.
Errors and messages are logged to:
*
/var/log/messages
*
content_gateway.out
*
/opt/WCG/logs/smbadmin.log
*
/opt/WCG/logs/smbadmin.join.log
Performance issues:
*
IWA (Kerberos): Authentication performance is bound by CPU. There is no communication to the domain controllers for Kerberos authentication.
*
NTLM and Basic: Domain controller responsiveness effects performance. The Monitor > Security > Integrated Windows Authentication page shows average response time.
Print print article Email email article Font Size: A A

Search

Article Rating:

Do you have any additional feedback?    Email: close

Related Articles

Quick Links

Service Requests

How are we doing?

Provide us feedback on your experience with the Service Request portal.

provide feedback >

Go to the table of contents Go to the previous page Go to the next page Go to the index View or print as PDF
Security > Proxy user authentication > Integrated Windows Authentication > Troubleshooting Integrated Windows Authentication