Nebula Active Directory Authentication Group Attribute

Mk88_it

Hello,

i'm trying to configure Nebula Authentication Server linking my AD server, the integration works as aspected except for Group Memeber Attribute.

In my AD server i have a group called (CN) domain.local/group/WifiGuest, so I wrote in the field the name ""WIfiGuest" but if i try to login with an user included into that group, Captive portal says "auth denied" and in to nebula log i see this message "Failed login attempt to Device from http/https (incorrect password or inexistent username)"

I tried anything but i didn't figure out from this issue.

Could you help me please?

Mk88_it

Hi, NCA is right for "FreeWifi" interface. I'm using AD auth for the interface called "hotspot" as you can see.

However I think I found my mistake: the selected AD Group i would use for auth must be indicated in the "External User Group" section not in the custom options for the "my ad server" section

Zyxel_Judy

HI @Mk88_it ,

To better assist you, please provide:

1. Your Zyxel device model and firmware version
2. The username and login timestamp used for Captive Portal access

Additionally, please enable Zyxel support and provide us with the name of your Nebula organization/site here or via the private message by clinking to my account > Message.

Mk88_it

Hello Judy thanks for your answer,

1- ATP 500 V5.39(ABFU.0) managed from nebula

2- login username I used: testuser (windows domain user)

I also enabled Zyxel support access and sent you a private message

Zyxel_Judy

Hi @Mk88_it ,

Your current Authentication method, which is set to "Sign-on with Nebula Cloud Authentication," is preventing AD server users from connecting to the network.

To set up AD authentication for the Captive portal, please follow these steps:

1. Go to Firewall > Authentication method
2. Select FreeWifi Interface
3. Under Sign-on, choose "gallini"
4. Click the Save button

Mk88_it

Hi, NCA is right for "FreeWifi" interface. I'm using AD auth for the interface called "hotspot" as you can see.

However I think I found my mistake: the selected AD Group i would use for auth must be indicated in the "External User Group" section not in the custom options for the "my ad server" section

Mk88_it

Ok this is the solution.

I have only one question: where i can see the AD users connected to that captive portal?

Zyxel_Judy

Hi there,

As discussed in our private messages, you can check the event logs to see which AD users are connecting through the captive portal.