Skip to main content
  • EN

Dear all,

I've a problem of authentication on fmeserver when I configure some details in the User Management > Directory Servers.

 

Our Active Directory as 9 servers behind a load balancer with a dns alias.

 

I've tried some configuration and only the worst works as desired. Here there are my tests:

 

1) desired solution:

  • host with DNS
  • alternate servers ip

Result: SSO login works, but API token request and user/pass login don't work

 

2) mixed solution:

  • host with one ip of the 9 in list
  • alternate servers ip

Result: SSO login and API token request work, but user/pass login doesn't work

 

3) worst solution:

  • host with one ip of the 9 in list
  • no alternate servers ip specified

Result: SSO login API token and user/pass login work

 

There is a solution to have the first configuration working as the third?

 

Thanks

Hello @giosp​ ,

 

We do not support the load balancer DNS alias to be set as the "Host" in AD connection on FME Flow GUI. The 2nd solution should work with "Host" as one of the 9 servers and the rest of them listed as "Alternate Servers". However, are there multiple KDC hosts? We do not currently support multiple KDC hosts but we have an enhancement ticket.

Currently, when leaving the “KDC Host” empty in the connection setting in this multiple KDC scenario, it might not work at all. Specifying one of the domain controllers will occasionally work if the user is connected through that specific DC.

Hello @giosp​ ,

 

We do not support the load balancer DNS alias to be set as the "Host" in AD connection on FME Flow GUI. The 2nd solution should work with "Host" as one of the 9 servers and the rest of them listed as "Alternate Servers". However, are there multiple KDC hosts? We do not currently support multiple KDC hosts but we have an enhancement ticket.

Currently, when leaving the “KDC Host” empty in the connection setting in this multiple KDC scenario, it might not work at all. Specifying one of the domain controllers will occasionally work if the user is connected through that specific DC.

Hello @Merline George​ ,

thank you for your reply. Ok, I will continue with the scenario 3 and I wait for a feature enhancement.

Yes I have multiple KDC hosts: if I execute nslookup -type=srv _kerberos._tcp.MYREALM I have the list of the 9 servers behind my dns alias. In the KDC Host I've set my dns alias and not the same ip as inserted in Host field. But as reported for the scenario 3 all works but is not fault tolerant.

Reply


Community Stats

30,351
Posts
115,342
Replies
38,085
Members
Terms & ConditionsCookie settings
A product of
Safe Software respectfully acknowledges that we live, learn and work on the traditional and unceded territories of the Kwantlen, Katzie, and Semiahmoo First Nations.