up vote 2 down vote favorite
share [g+] share [fb]

I am using (trying to anyway) an ActiveDirectory plugin for ScrewTurn wiki called UserAuth (by "ElectricImages"). Whenever a user logs into the Wiki's login page with correct network credentials (provides domain\user and password), they get a login error and the ScrewTurn log shows the message Authentication of ...... failed: A referral was returned from the server.

If the user gives the wrong password, then the log says Authentication of ...... failed: Logon failure: unknown user name or bad password, so it seems that ActiveDirectory is in fact getting the authentication info.

What could be going wrong?

link|improve this question
45% accept rate
Are you authenticating against a server that actually is a domain controller for the domain you're authenticating to? – Massimo Sep 1 '09 at 19:06
Or, to be a little clearer, are you in a multi-domain environment (forest, trusts, etc.)? – Massimo Sep 1 '09 at 19:07
see comments in squillman's answer – JoelFan Sep 1 '09 at 19:29
Seen, but you didn't answer my question: do you have a single domain or many trusted domains? Referrals are usually returned when you try to log on to DomainA but you're talking to a domain controller for DomainB. – Massimo Sep 1 '09 at 19:31
The plugin is configured to connect to a certain domain (e.g. ServerFault) and the user who's trying to log in also belongs to that same domain... (e.g. ServerFault\john) – JoelFan Sep 1 '09 at 19:36
show 1 more comment
feedback

3 Answers

up vote 3 down vote accepted

OK, I fixed it... There were 2 problems:

  1. I needed to use the fully qualified name, e.g. Source=ServerFault.com (as suggested by squillman)

  2. I needed to change the "Anonymous Access" user in IIS to be a network user that has access to Active Directory (previously, it was a local machine user)

Thanks all who helped!

link|improve this answer
feedback
up vote 1 down vote

I have seen this when when the Base DN was set to legit-looking, but non-existant DN.

link|improve this answer
feedback
up vote 0 down vote

Directory referral messages often indicate that you're either binding to the directory in the wrong place or that you're doing some kind of cross-domain query against a server that might be in the same forest but isn't responsible for the domain in question. What are you using for the Source configuration tag? Do you have a domain controller at the site where your server is that is authoritative for that domain?

link|improve this answer
what do you mean by "binding in the wrong place"? – JoelFan Sep 1 '09 at 19:27
the Source tag is the same as the domain name of the users that are trying to login to the wiki... i.e. Source=ServerFault and the users are logging in to the wiki using: ServerFault\john – JoelFan Sep 1 '09 at 19:28
Try using the fully qualified domain name instead. So instead of Source=ServerFault, use Source=ServerFault.com – squillman Sep 1 '09 at 19:57
"binding in the wrong place" is actually going to be irrelevant to this issue. Typically you need to bind to a location in the directory when querying, but this plugin automatically binds. I don't see any options for configuring this. – squillman Sep 1 '09 at 20:22
feedback

Your Answer

 
or
required, but never shown

Not the answer you're looking for? Browse other questions tagged or ask your own question.