• State Suggested Answer
  • Replies replies
    3
  • Answers answer
    1
  • Subscribers subscribers
    11
  • Views views
    446
  • Users 0 members are here
  • Locked Locked
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Automatic Hybrid AzureAD Join

STTennant

Hi,

We are trying to get Automatic Hybrid Azure AD Join working without success.  We have followed the documentation which includes configuring WS Federation and WS-Trust. 

NAM seems to be processing WS-Trust requests properly as we can see claims for ImmutableID and UPN being added in the log file (catalina.out) and properly constructed SAML 

tokens in the response.  I am not entirely sure what is generating this traffic - it could be one drive.

Automatic Hybrid Azure AD configuration requires adding Kerberos to the WS-Trust/STS Configuration/Methods and modifying the web.xml file to add the NetIQSTS12MEX servlet, on the identity servers. 

However, we are not getting the PRT token (i.e. when we run dsregcmd /status, AzureADPRT is NO.).  

I can't help thinking that we are missing something.  For example, the claims required by a device seem to differ from those required by a user (according to Microsoft's documentation).  e.g. devices require objectSid from AD.  This is a problem as our "Name/Password - Form-WebService" method's user store is not AD but an eDirectory (our identity vault).

I don't want to elaborate too much in case this makes no sense to anyone.  But has anyone got this working?

Thanks

Steve Tennant

  • 0

    Hi!

    Maybe problem lies around this sentence:

    STTennant said:
    This is a problem as our "Name/Password - Form-WebService" method's user store is not AD but an eDirectory (our identity vault).

    In order for AM to authenticate device, AM need to have access to devices (computers) in backend directory. This is also the reason for step 1b in https://www.microfocus.com/documentation/access-manager/5.0/admin/config-am-device-reg.html:

    For device to be authenticated using kerberos token you need to:

    • Have configured Kerberos method and link it to directory with device information (for information extracted from device's kerberos token to be validated there)
    • Set this method as WS-Trust authentication method (Devices > Identity Servers > Edit > WS-Trust > STS Configuration)

    Do you have Kerberos method configured and attached to Active Directory user store where computer OU is added to search context?

    Kind regards,

    Sebastijan

  • Suggested Answer

    0 in reply to Sebastijan Sef

    Hi Sebastijan,

    Thanks for taking the time to reply.  The Kerberos method is configured and assigned.

    There has been a significant development with the help of Microfocus and we now have got this working.  One issue was we were sending a SAML2 token - we changed this to SAML1.  The other issue was relating to the domain of the user being identified which did not match.  We have populated another attribute with the variant domain (for each user) and added it to the query in the WebService form.  It all works now.

    Thanks for the feedback.

Resources

Support
Documentation
Learning Services
Partner Programs
Privacy
Compliance
Help
Company
Privacy Policy
Terms of Use
Cookies Preferences
Accessibility
Anti-Slavery Statement
Support
Contact Us
Careers
Code of Business Conduct and Ethics
The opinions expressed above are the personal opinions of the authors, not of OpenText. By using this site, you accept the Terms of Use. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.), Hewlett Packard Enterprise Company, or Micro Focus. As of January 31, 2023, the Material is now offered by OpenText, a separately owned and operated company. Any reference to the HP, Hewlett Packard Enterprise/HPE, and Micro Focus marks is historical in nature and the HP, Hewlett Packard Enterprise/HPE, and Micro Focus marks are the property of their respective owners.