Active Directory Intergration

[[email protected]]

Hi all,
I have downloaded NagiosXI trial OVA (5.2.2) and have wanted to trial it as an upgrade from our current install at work.

Unfortunately, I have come unstuck at the first hurdle and am not sure what I may be doing wrong. I have searched the forums for this but could not find anyone else having the same issue with the current version.

So when I come to configure the AD Integration as:
Enabled This Authentication server
Connection Method: Active Directory
Base DN: DC=AS,DC=local (internally we use as.local)
Account suffix: AS.local
Domain Controllers: ad3.as.local
Security: None
pic attached

Now when I come to use the above settings and perform a Import of Users using my domain admin account (or any account) I get the following:

Code: Select all

Unable to authenticate: 80090308: LdapErr: DSID-0C090334, comment: AcceptSecurityContext error, data 525, vece

pic attached

I have tried the following:
- Making sure that the AD server can be pinged from NagiosXI command interface
- Made sure that the correct IP address is picked up by DNS and can be pinged from NagiosXI
- Made sure to change the DNS entry for the AD server to IP address
- Tried to use alternative live domain admin accounts
- Tried to configure LDAP by using DNS and IP address for the LDAP Host, and 389 for the port

and no matter what I do I get the same error message as above. Would you be able to help me identify what I may be doing wrong.

The virtual NagiosXI is on the same VLAN as the AD server and in fact it is sitting on the same VMware host and has access to the same vSwitch. I have made sure to power cycle the NagiosXI server.

Can you please help me identify where I am going wrong.
Thank you,

[hsmith]

This post is kind of a mess, and seems to have some people arguing, but there are some useful bits of information if you sort through it...
https://social.technet.microsoft.com/Fo ... inserverDS

Specifically:

The error code 52e indicates invalid credentials. Check the list below as reference regarding all error codes.

525​ user not found ​
52e​ invalid credentials ​
530​ not permitted to logon at this time​
531​ not permitted to logon at this workstation​
532​ password expired ​
533​ account disabled ​
701​ account expired ​
773​ user must reset password ​
775​ user account locked

[[email protected]]

This post is kind of a mess, and seems to have some people arguing, but there are some useful bits of information if you sort through it...
https://social.technet.microsoft.com/Fo ... inserverDS

Specifically:

The error code 52e indicates invalid credentials. Check the list below as reference regarding all error codes.

525​ user not found ​
52e​ invalid credentials ​
530​ not permitted to logon at this time​
531​ not permitted to logon at this workstation​
532​ password expired ​
533​ account disabled ​
701​ account expired ​
773​ user must reset password ​
775​ user account locked

Hi,
I have come across this and can see that the 525 is user not found, however, what is strange is that I get that reply no matter what user credentials I use; valid or otherwise.
It seems as though for some reason the Nagios server is just not communicating with the AD servers, although as I mentioned, I can ping them from the Nagios console session.
Does it make a difference that we are still running AD2003 servers, i.e. both domain and forest functional level of our domain is Windows Server 2003?

Thank you.

[hsmith]

What format are you using for the username?

[[email protected]]

I've used (AS.local being the domain):

username
as\username
as.local\username
[email protected]

Should I be using anything else?

Thanks

[hsmith]

For kicks can you try it in the full DN format?

Mine for example: CN=Holden Smith,CN=Users,DC=hs,DC=ad

[[email protected]]

For kicks can you try it in the full DN format?

Mine for example: CN=Holden Smith,CN=Users,DC=hs,DC=ad

I will try that tomorrow as soon as I can.

Quick questions, is NagioxXI AD module compatible with AD 2003?

[hsmith]

To the best of my knowledge there is no reason that it wouldn't be. I reached out to the developers and asked them, and they told me there shouldn't be issues.

[[email protected]]

For kicks can you try it in the full DN format?

Mine for example: CN=Holden Smith,CN=Users,DC=hs,DC=ad

I have just tried using full DN format within the AD Import Users and I still get

Code: Select all

Unable to authenticate: 80090308: LdapErr: DSID-0C090334, comment: AcceptSecurityContext error, data 525, vece

Any other ideas? Thank you

[rkennedy]

The error seems to relate to a user not found, which makes me think the full DN might not be proper. What is the full DN format that you're using to check? Can you paste it here?

Also, open a command prompt and type -

Code: Select all

dsquery user -name firstname*

Replace firstname with the first name of the user you're trying to use in AD and paste the result.