How to set workstation name for ldap authentication

Hi TC Developers,

My company want  teamcity to authenticate with our domain server( Active Directory server), after setting the ldap configuration, I found only account with no workstation restriction can login, but many domain account have been restricted to specific computers(workstations),  the error log is like:

[2013-04-16 16:43:32,203]   INFO -     jetbrains.buildServer.LDAP - ------ Sync with LDAP users started ------
[2013-04-16 16:43:32,296]   INFO -     jetbrains.buildServer.LDAP - Sync with LDAP users done
[2013-04-16 16:43:32,296]   INFO -     jetbrains.buildServer.LDAP - Last synchronization statistics: created users=0, updated users=0, removed users=0, users in ldap=452, matched users=3, duration=93ms, errors=[]
[2013-04-16 17:15:55,562]   INFO -     jetbrains.buildServer.LDAP - Failed to login user 'CN=Andy Ma,OU=Chinesen,DC=tomtec,DC=org' due to authentication error. Cause: Invalid credentials ([LDAP: error code 49 - 80090308: LdapErr: DSID-0C090334, comment: AcceptSecurityContext error, data 531, vece



This error means 'not permitted to logon from this workstation'.
Here dn "'CN=Andy Ma,OU=Chinesen,DC=tomtec,DC=org'" has attribution "userWorkstations" with value equals"andyma,andyma2,ama-pc", teamcity server is installed on workstation "andyma2", so why still have this issue?
4 comments
Comment actions Permalink

Hi Andy

Technically, in case of LDAP authentication, password verification happens on a domain controller machine, so the users need to have permissions to log on there, which is not securely.

NTLM authentication mode will work for you - in this case authentication happens on end user's machine, so workstation lists do work properly.

In upcomming TeamCity 8.0 you'll be able to use NTLM single sign-on together with LDAP synchronization of user properties.

0
Comment actions Permalink

Hi Michael,

Thank you for your reply. I am trying ldap authentication module because we don't want to add teamcity server to domain, yes you are right, it Teamcity server is installed in the same domain with user account, we can successfully login.
So is there any solution for this situation: teamcity server is not in the domain, but want to enable login with domain accounts, and domain accounts have been restricted to specific workstations? Any settings can do to set workstation or netbios name in teamcity authentication properties file?

Thanks

0
Comment actions Permalink

Andy,

I believe this is not pessible - this is how workstation restrictions work in Active Directory.
So you have to either remove logon restrictions from user accounts, or join TeamCity server to a domain and use NTLM authentication.

Just curious, what problem do you have with joining the server to domain?

0
Comment actions Permalink

Thank you very much, Michael, I agree with you, so we will put our server in domain, I think no much problem to do this, I ask this question just want to know if possible for current special case.

0

Please sign in to leave a comment.