LDAP / Domain Logon fails after 15 minutes for new Win 11 Client Follow

Created February 06, 2023 09:30

Hi,

i need to configure Teamcity to use Domain Username / LDAP for logon.
i configured this at a fresh Teamcity Server installation.

I have a new Windows 11 Client PC, if a user (me, Jürgen) logs on to this PC, a new Profile will be created.
If i open the url for Teamcity Server i can logon with Domain Credentials and start my work.

If i come back 15 minutes later or next day, i only get an Windows Security Box, asking me to logon on with Windows credentials.

If i reset this PC and install a clean Windows 11, all is fine for the next 15 minutes.

Any idea what happens here?

3 comments

Anatoly Cherenkov

Created February 07, 2023 15:51

Hi! I am not sure I understand what the issue with TeamCity is. Would you please clarify?
When the user logs into TeamCity through LDAP, it checks with your Windows Domain through LDAP if the credentials you provided are valid and if so, the user will be logged in to TeamCity. The user will stay logged in until the session expires or the user logs out. However, TeamCity will not show you a Windows Security Box. It will show you the login screen in the web UI.

Juergen Barth

Created February 08, 2023 10:03

Hi,

i have a Domain Controller and the Container Computers Container...
Inside this Conatiner i have my Windows 11 PC..

The Windows 11 PC ist installed, the user "Jürgen" logs on
I open http://intranet.company.com with edge
I geht the Windows Authentication Page ...
I add http://intranet.company.com to the Intranet Zone (1)
I open http://intranet.company.com and i get authenticated and all is fine.
I reboot the PC, wait 1h, come back next day .. all is fine

I do the same with my teamcity.company.com server

I open http://teamcity.company.com with edge
I get the Windows Authentication Page ...
I add http://teamcity.company.com to the Intranet Zone (1)
I open http://teamcity.company.com and i can click on "Log in using Microsoft Windows domain"
I get authenticated and all is fine.
I can work with teamcity

Now I reboot the Windows PC or i got to a break or wait one day.

I open http://teamcity.company.com with edge
I get the Windows Authentication Page ...
my Domain Account get´s logged out

This MUST be some bug of Teamcity and the logon process.

If i use a new Domain User without any diacritic mark in it´s user name, like "juergen" logon is fine.

And as soon as i have some users with diacritic marks like "jürgen" the logon might work. but only if the Client PC has a fresh setup or some other magic..

This happens if the Tomcat Server doesn´t work well with diacritic marks or the LDAP sync fails ...

Juergen Barth

Created February 09, 2023 16:52

Hi, i think i solved this mystery.

I enabled all Proctolls "NTLM, Negotiate, Kerberos" and i set a Service Principal Name (SPN) for the Service Account i used in the setup.
So this seems to work now.

Please sign in to leave a comment.