Proxy Http/SSO and Domain Controller on same machine...

[Gilberto Ferreira]

Hello friends....

I have a doubt: Proxy HTTP with SSO actived and Samba as Domain Controller will work on the same machine??

I remember that I use this configuration before and work properly, but the Domain Controller was a Windows Server....

Thanks for any help

[Sam Graf]

Yes. If I've followed the various conversations about this correctly, people who are using Zentyal as a PDC have much more success with SSO than those who aren't.

[Gilberto Ferreira]

Yes. If I've followed the various conversations about this correctly, people who are using Zentyal as a PDC have much more success with SSO than those who aren't.

Well... Here in my tests, doesn't work...
I install share folders, users and groups and proxy http.

Setting Zentyal as domain controller, create same users and groups...

I have created 2 groups:

level01

level02

And 2 users:

gilberto, that I put into level01 group

test, that I put into level02 group

After that, I create a rules in Proxy HTTP configuration, like that:

SSO - enabled

Proxy HTTP -> Filters -> freeaccess = this filter there's no rule to block any site.

Proxy HTTP -> Filters -> blockaccess = this filter block same sites, like facebook and others.

Proxy HTTP -> Access Rules -> Everytime -> Level01 -> FreeAccess Filter

Proxy HTTP -> Access Rules -> Everytime -> Level02 -> BlockAccess Filter


I also create a dns zone, called servidor, that point to Zentyal Server IP Address.

I put a Windows XP machine as domain member of Zentyal Server. I'm able to log into domain and see all folders that my users can see...

But, when I open a WebBrowser, such IE or Google Chrome, and set Proxy like servidor.home.lan, all webpages is block!

Doesn't matter if I logged with user gilberto or test... Even with users gilberto, that I suppose have a free access by the fiilter above...

Otherwise, when I disable SSO, I have a popup window ask me for password... But the filter above work perfect...

Is There something that I make wrong???

Thanks for any help...

[Sam Graf]

Is There something that I make wrong???

That's a good question. In my testing under a non-PDC setup the only way I could get SSO to work was using object policies. Group policies wouldn't work because authentication didn't work. But I did all that testing weeks ago so can't speak to anything that might have changed through updates since then.

There are several threads scattered around where people have gotten it to work when Zentyal is acting as a domain controller. I'm assuming you've already searched "sso" for that stuff. If you want, you could try using object policies instead of group policies as a test (not that you can use object policies instead of group policies in real world use). If object policies work but not group policies, that might help narrow the field in terms of finding a fix (either configuration or bug).