TES 6.2.1 multiple domains

Joe Fletcher · ‎02-23-2015

Hi,

Anyone got a multiple domain config working in 6.2.1? Either I'm being blind or there's gap in the documentation.

I've got the section for the Client manager but so far I haven't found out if there is an equivalent for the master.

http://www.cisco.com/c/en/us/td/docs/net_mgmt/datacenter_mgmt/Tidal_Enterprise_Scheduler/6-2/installation/guide/Cisco_TES_6-2_Installation_Guide/Installing_ClientManager.html#17582

The release notes say it can be done; just not how.

TIA

zhuxiaokun · ‎05-19-2016

We have the same problem, opened a ticket, and CISCO support found a previous case (I guess it is your case) and fixed it.

The instruction from Installation PDF is to add "Security.Authentication.Ext.File=user-auth.xml" to master.props file, then provide your user-auth.xml file.

When we implement it, we commented out the line of "Security.Authentication=ActiveDirectory", because in the multi-domain configuration XML file, we have LDAP as available authentication as well. After this change, the CM is successful to authenticate from multiple source, but the Master cannot authenticate from any. CISCO solution is to add this line back to the master.props file, then at least the primary AD authentication works, we still need to test other.

Joe Fletcher · ‎05-19-2016

Hi,

Doesn't sound at first glance like you've actually got a fix. It appears there are partial solutions but nothing complete.

Cheers

Maximilian Gallagher · ‎05-19-2016

Correct. I'm working on writing a bug for this now.

sdeciscoip · ‎05-27-2016

We authenticate to two different AD domains. Our master.props file looks like this (for the authentication section):

Security.Authentication=ActiveDirectory
ActiveDirectory.Host=corp.domain.com
ActiveDirectory.Port=389
ActiveDirectory.UserSearchPrefix=DC=corp,DC=domain,DC=com
ActiveDirectory.GroupSearchPrefix=DC=corp,DC=domain,DC=com

Security.Authentication.Ext.File=user-auth.xml

And then in the user-auth.xml we have this:

<ext-user-auth>
<user-auth>
<name>other</name>
<desc>Configure AD for user authentication</desc>
<type>ActiveDirectory</type>
<host>other.domain.com</host>
<port>389</port>
<ad.usersearchprefix>DC=other,DC=domain,DC=com</ad.usersearchprefix>
<ad.groupsearchprefix>DC=other,DC=domain,DC=com</ad.groupsearchprefix>
</user-auth>
</ext-user-auth>

Note that our users have to log in using the format of domain\userid.