Troubleshooting: LDAP Test Connection Fails with Cross-Domain Service Account – SecureAuth Support

Version Affected: 9.0.1, 9.1, 9.2

Overview

When two trusted Active Directory domains exist, and a service account from one domain is used to connect to both domains, the Test Connection feature on the Data tab can fail.

Cause

The Test Connection button ignores the "@" portion of the account field, and instead uses the domain being connected to as the account's domain prefix. This does not work when connecting to a domain using a service account from a different, trusted domain, as shown below.

Test Connection failing when using a service account from a different trusted domain than the one being connected to.

Resolution:

Provide the User Principal Name (UPN) of the service account in the first field, and leave the second field blank, as shown below.

Data tab with the service account's User Principal Name entered in the first field and the second field left blank.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.