Skip to main content
Solved

LDAP authentication failing after 9.62 upgrade

  • December 4, 2014
  • 14 replies
  • 52 views

Forum|alt.badge.img+9

Is anyone else seeing this? We have JSS's on 9.61 authenticating to the same LDAP server without issue. Since bumping 3 x JSS's to 9.62 we can no longer auth with LDAP credentials....

Best answer by james_ridsdale

Found the issue...

"Use recursive group searches" is enabled on 9.62 vs disabled on 9.61.

Just updated this setting and all is fine.

14 replies

Forum|alt.badge.img+14
  • Contributor
  • December 4, 2014

Upgraded our PreProd to 9.62 (from 9.61) earlier this morning. No issues with LDAP (AD) credentials that I'm seeing in limited testing.


Forum|alt.badge.img+9
  • Author
  • Contributor
  • Answer
  • December 4, 2014

Found the issue...

"Use recursive group searches" is enabled on 9.62 vs disabled on 9.61.

Just updated this setting and all is fine.


donmontalvo
Forum|alt.badge.img+36
  • Hall of Fame
  • December 8, 2014

@james_ridsdale Guessing you had to stop/start Tomcat for the change to take effect?


Forum|alt.badge.img+9
  • Author
  • Contributor
  • December 8, 2014

Tomcat restarts made no difference. This was the first thing I tried.


donmontalvo
Forum|alt.badge.img+36
  • Hall of Fame
  • December 8, 2014

I meant did you uncheck "Use recursive group searches" and have to restart Tomcat for that change to take effect?


Forum|alt.badge.img+26
  • Honored Contributor
  • December 8, 2014

@james_ridsdale - upgraded from 9.6 to 9.62 yesterday. No issues with LDAP lookup, but also noticed that "Use recursive group searches" was enabled after the update. I've elected to uncheck it since it hasn't been needed in the past.


cdenesha
Forum|alt.badge.img+14
  • Honored Contributor
  • December 8, 2014

I have no idea what my setting was before.

Isn't this the kind of thing we should know about before an upgrade? I read the release notes pretty closely..


Forum|alt.badge.img+7
  • Contributor
  • December 9, 2014

Where is the "Use recursive group searches" setting located on the JSS?


donmontalvo
Forum|alt.badge.img+36
  • Hall of Fame
  • December 9, 2014

Settings > System Settings > LDAP Server > ...pick one... > Mappings > User Group Membership Mappings > [x] Use recursive group searches


donmontalvo
Forum|alt.badge.img+36
  • Hall of Fame
  • December 9, 2014

Our issue (Casper Remote "you don't have enough permission") was unrelated to this thread resolved with a workaround, will update the other thread.


Forum|alt.badge.img+5
  • New Contributor
  • January 12, 2015

Hi Don. I am also seeing the Casper Remote "you don't have enough permission" issue in our environment. Could you please post what workaround you are using or a link to the thread? Thank you!


donmontalvo
Forum|alt.badge.img+36
  • Hall of Fame
  • January 12, 2015

Hi @derek.peterson, 9.63 fixed it:

http://resources.jamfsoftware.com/documents/products/documentation/Casper-Suite-9.63-Release-Notes.pdf

Page 15:

[D-008176] Fixed an issue that prevented JSS user accounts that belong to a JSS user group and have custom privileges for Casper Imaging, Casper Remote, or Recon from opening and using those applications.

Forum|alt.badge.img+5
  • New Contributor
  • January 13, 2015

Thanks @donmontalvo!

To workaround the problem in Casper 9.62 enabling Use Casper Imaging, Customize a Configuration, and Store Autorun Data in Users Accounts & Groups Privileges restored the ability to use Casper Remote. This will do the trick until we can deploy Casper 9.63.


bentoms
Forum|alt.badge.img+35
  • Hall of Fame
  • January 13, 2015

Thanks @donmontalvo from us too. We found the same with 9.62 & your fix worked.