Error with register ldap user groups - PAM 3.0.2

[Julian Riano]

Hi 

 

I have the next error when y connect to active directory endpoint,select the groups to register but alway get this error how response "PAM LDAP 0025: LDAP group CN ... not found in domain".

The account has been validate an working in other escenarios how rdp sessions and have permission to domain admin

what is the posible cause?

 

I working with PAM 3.0.2 .

 

Attached error image

 

 

Thanks

[voged01]

Hi Julian.  Whenever there are problems refreshing, or importing, ldap groups a good tool to identify the cause are the system logs.  Go to the Config --> Diagnostic page and set the LDAP Sync Log Level to Verbose.  Reproduce the problem and download the System Log file, logs.bin.  The logs.bin will have to be reviewed by someone in Support, as the logs.bin contains a lot of internal information and is encrypted.  It would be best if you opened a ticket and attached the logs.bin created as described above.

[Julian Riano]

Hi voged01

 

I have opened the case with the requested inf, but while they are responding and out of curiosity, replicate the
environment with 1 active directory and 2 PAM. One in version 2.8 and the other in version 3.0.2, replicate the process
of importing the user groups and in version 2.8 the process was successful while in the 3.0.2 it presents
the error "PAM-LDAP-0025: LDAP group .DNgroup ... not found in domain"


Will be a fails in this version ?

[Ralf Prigl]

Hi, If you are dealing with a single domain only, please follow Ed's advice. If you have multiple domains in a forest of trusted relationship, and the group belongs to a domain different from the one you configured in PAM, you should try using the global catalog ports 3268 or 3269 instead of 389 or 636.