Kace 1000's Single Sin On default settings had some issues detecting my Windows 7 user logon accounts.
As such I updated the LDAP filter as follows.
After joining and enabling Active Directory Single Sign On users still had to type their username and password in order to access the helpdesk.
Perplexed by this I referred to the access logs and found that the usernames were being detected properly as "username@domain.com".
However the usernames are incompatible with the default LDAP Authentication filter "(samaccountname=KBOX_USER)".
As such I updated the LDAP filter as follows.
- Settings > Control Panel > Authentication Setting
- Edit - LDAP Authentication
- Modify Search Filter -
"(|(samaccountname=KBOX_USER)(mail=KBOX_USER))" - Click - Save
So as to be more specific with user authentication.
We'll limit LDAP to users that are members of certain user groups and with enabled user accounts using the following LDAP query.
| (&(|(samaccountname=KBOX_USER)(mail=KBOX_USER))(&(!(userAccountControl:1.2.840.113556.1.4.803:=2))(objectCategory=person)(objectClass=user))(|(memberOf=cn=Contractors,ou=Security Groups,ou=UserGroups,dc=domain,dc=com)(memberOf=cn=Employees,ou=Security Groups,ou=UserGroups,dc=domain,dc=com))) |
Comments