Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My work is going to roll out a new application (HR, Payroll, etc.) called springbrook to our remote employees. The application runs on one of our physical servers (Win 2008 R2) and to use it locally, I had to map a network drive to the server on the local employee's computer. I created a desktop shortcut to the app so the user doesn't have to go inside the mapped drive and run it that way. They just click on the desktop shortcut.

Springbrook uses the LDAP protocol (in our case Active Directory) to authenticate the user trying to login against the login id’s already inside of Springbrook, so when the session is established it requires that the user logs in and is authenticated to the domain which in turn makes the connection to the LDAP connector which verifies user info and allows them access.

Our hardware firewall is a Sonicwall TZ210 device. I have the VPN setup in that device. At the remote site on the user's workstation who will be using Springbrook I have correctly setup the sonicwall VPN client. At the remote worksation I can establish a connection to our network, map the network drive and bring up the Springbrook login page. When I put in the credentials, a Springbrook error message pops up telling me I put in an incorrect password. That's not the case because I know the credentials are correct.

I contacted Springbrook about this and the tech told me that somehow the authentication isn't happening in the VPN tunnel.

Okay. I knew that, haha

He then said that they use Citrix for their remote employees. I'm sure Citrix has a very nice WebApp tool, but if I can do this through a VPN tunnel and save us money that would be great.

Any suggestions my fellow techies?

Server: Win 2008 r2 Firewall\VPN: Sonicwall tz210 Active Directory Domain

I've enabled LDAP in our firewall and got the same results. That didn't work. Other than that, I haven't tried anything. The remote workstation runs the same "stuff" as the local workstations that are running springbrook just fine.

share|improve this question
2  
Use Windows RRAS as the VPN server. The users will then authenticate to the domain via the VPN instead of authenticating to the SonicWall via the VPN. When they launch the app it should use the AD credentials of the VPN user, which is their AD account. –  joeqwerty Jan 22 '13 at 15:46
    
That's right! I forgot Win Server could act as a vpn server. Thanks. I'm going to try this out. –  AVandelay05 Jan 23 '13 at 14:46
    
Okay. Here is what worked for me. I enabled the RRAS role, customized it for VPN only and not NAT. I enabled dial-in access for the remote user. I then created the necessary nat and firewall rules in my sonicwall tz210. I grabbed a laptop, connected to WAN (not ours), created the VPN connection and was able to connect to our network. I was also able to use Springbrook! So, it works. Question: how secure is this method? –  AVandelay05 Jan 23 '13 at 15:58
    
How secure depends on what authentication and encryption is used between RRAS and the client by default. I don't know off the top of my head but it should be relatively simple to figure it out. –  joeqwerty Jan 23 '13 at 22:57
    
Okay thanks joeqwerty! –  AVandelay05 Jan 24 '13 at 16:08

2 Answers 2

up vote 2 down vote accepted

Use Windows RRAS as the VPN server. The users will then authenticate to the domain via the VPN instead of authenticating to the SonicWall via the VPN. When they launch the app it should use the AD credentials of the VPN user, which is their AD account.

share|improve this answer

You need to run a packet capture to determine if the remote client is successfully performing an LDAP bind. If so, since you may be sending the username and password in plain text, so that would make it fairly easy to validate.

You may want to localize this further by trying to establish an LDAP bind using a tool such as LDP.exe from a remote VPN client. If you cannot bind and authenticate using LDP the same way that the application is binding and authenticating, that would point you in the right direction.

Also, considering that this has not been tested, it would not surprise me that even if you do get it to function, the performance may be exceedingly poor.

share|improve this answer
    
Thank you Greg for the suggestion. I will try this. –  AVandelay05 Jan 23 '13 at 14:47
    
Greg, I tried joeqwerty's suggestion first and it worked it famously. I think I will continue on with that setup as long as it's secure for us. Thanks again for your suggestion. I appreciate it greatly. –  AVandelay05 Jan 23 '13 at 15:59

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.