topic Re: AD UPN Suffix in Firewall and Security Management

AD UPN Suffix

David_Herselman — Tue, 24 Mar 2020 06:17:14 GMT

We have Identity Awareness configured and working with AD Query, Captive Portal (including Kerberos SSO), Terminal Services MuH and RADIUS for Enterprise WiFi (Packet Fence).

We however have problems with user accounts where their Active Directory UPN Suffix was changed as this then no longer matches the domain in the LDAP Account Unit.

What is the official way to configure additional UPN Suffixes?

What we've done so far:

Created additional LDAP Account Units, referencing the same AD servers, credentials and LDAP branch as the one for the AD realm but then unset 'User management' and 'AD Query'.

Problem is that RDS (Terminal Services) MuH agent uses Kerberos to identify users and identifies the person as user@upnsuffix2 but then doesn't resolve group memberships.

The account is technically party of the main/original LDAP Account Unit, is there no way to configure UPN suffix aliases?

adlogconfig a gives an option relating to 'add domain' but I'm unable to locate documentation relating to this...

Regards

David Herselman

Re: AD UPN Suffix

PhoneBoy — Wed, 25 Mar 2020 04:11:04 GMT

@Royi_Priov any idea?

Re: AD UPN Suffix

Royi_Priov — Sun, 29 Mar 2020 14:35:03 GMT

Hi @David_Herselman

Generally, I will recommend using Identity Collector and not AD Query

You can read about the differences in sk108235.

In Identity Collector, you also have "alias" feature to replace domain suffixes easily.

I hope it helps!

Royi Priov

Identity Awareness R&D

Re: AD UPN Suffix

gardazishvili — Tue, 31 May 2022 08:36:20 GMT

sk87200

Re: AD UPN Suffix

Henrik_J — Thu, 23 Mar 2023 07:29:17 GMT

This worked for me.
Thank you.

Re: AD UPN Suffix

David_Herselman — Fri, 10 Nov 2023 15:47:42 GMT

Hi,

I do realise that this reply is almost 4 years in the making but this nuance continues to plague us. We managed to work around the issue but have a situation where this work around unfortunately doesn't work.

The problem with using Identity Collector is that it exclusively retrieves events from AD servers. We wish to use RADIUS with PacketFence or Aruba ClearPass, integrating with CheckPoint via either RADIUS accounting or Identity Awareness API. In those cases the user identity lands on the gateway, especially when using EAP-TLS which doesn't need to interact with AD at all when validating the validity of the presented certificate.

Our work around up until now has been to strip the realm from the username before it's sent, CheckPoint submits this to AD for group membership queries and authentication but this causes a problem when a username is longer than 20 characters. In that case AD matches the account against the pre-Windows 2000 username, which is often just the truncated version of the UPN.

What is the recommended method by which one can facilitate UPN suffix aliases in Active Directory?

Regards

David Herselman