Authentication failed with ACS SE 3.3.4

[remco.gussen]

Hello

I have got problems with authentication in another domain.

Root domain has got two child domain.

ACS Agents are installed on two domain controllers in root domain.

Authentication in one child domain is ok.

Authentication in other child domain is not ok.

ACS Agent log:

CSWinAgent 02/13/2008 14:51:30 A 0371 3488 RPC: NT_MSCHAPAuthenticateUser received

CSWinAgent 02/13/2008 14:51:30 A 0048 3488 NTLIB: Attempting Windows authentication for user testuser

CSWinAgent 02/13/2008 14:51:30 A 0048 3488 NTLIB: Windows authentication SUCCESSFUL (by SRV-****)

CSWinAgent 02/13/2008 14:51:30 A 0048 3488 NTLIB: Obtaining RAS information for user testuser from SRV-***

CSWinAgent 02/13/2008 14:51:32 A 0048 3488 NTLIB: MprAdminUserGetInfo returned error 0x6ba

CSWinAgent 02/13/2008 14:51:32 A 0048 3488 NTLIB: Failed to get RAS information for user testuser from SRV-***

CSWinAgent 02/13/2008 14:51:32 A 0436 3488 RPC: NT_MSCHAPAuthenticateUser reply sent

What can this be ?

Why is user authentication successful, but will authentication fail on ACS ?

Gr.

Remco

[Jagdeep Gambhir]

Remco,

The 0x6ba problem was fixed by adding the dns suffixes to the Ethernet controller:

-go to Network Connections from the control panel

-right click the local area connection

-select properties

-double click the TCP/IP option

-select 'Advanced' at the bottom

-click on the 'DNS' tab at the top

-choose 'Append these DNS suffixes'

-add the FQDN for each domain that ACS authenticates against in the field.

Regards,

~JG

Do rate helpful posts

[remco.gussen]

JG

This is not a Windows Machine. It is an appliance !!

On the appliance this is not possible. Is it ?

Gr.

Remco

[Jagdeep Gambhir]

Do it on a PC where remote agent is installed.

Regards,

~JG

[remco.gussen]

Did that... Problem still there...

Gr.

Remco

[remco.gussen]

Sorry JG.

For the second child domain it works too right now.... Thank you....

But..........

There is still another domain (not a child). There is a two-way trust between the two domain... Right here I still get the same error....