Since I've been working at this company we've had a very basic AD setup. Users go in the user CN and there is a few OUs for computers, like desktops and servers.
Recently I've been planning a more comprehensive design to allow for custom department GP settings (specifically printers). I want to move users into OU's created for each department. Everything seemed to be working fine based on my testing except for one application.
JReport is a reporting application that has a LDAP setup to import users. It then implements SSO using that info. Been working great with our current settings, but the second I move a user from CN=Users to OU=XYZ they can no longer authenticate.
Here is a screenshot of the settings for the application:
As you can see it is a pretty simple setup. If I test the connection the directory manager has access. If I query users I can see the users that are in the new OU. But if I try to access a report it doesn't work. Even if I enter in the credentials manually.
So I guess my question is can anyone think of any reason that moving a user to a new OU would break this?
I want to move users into OU's created for each department
- I don't know your organization, but this simply won't work at many orgs I support. There is almost never a perfect one-to-one mapping of people to departments/programs/etc. I strongly suggest you consider the the G in GP stands for GROUP. Trying to use OUs as a grouping mechanism will result in really ugly policies.