AD Authentication: Invalid DN syntax

Fabio_Dangelo
Fabio_Dangelo Posts: 14  Freshman Member
First Comment Friend Collector
edited April 24 in USG FLEX H Series

Hello.

Just update to 1.20 firmware to enable AD authentication.

The firewall FLEX500H is allready joined to AD and I can see it as Computer in Active Directory users and computers.

When I try to test the configuration I get the error "Invalid DN syntax".

What's wrong?

Screenshot 2024-04-24 111200.png

thank you

Accepted Solution

  • Fabio_Dangelo
    Fabio_Dangelo Posts: 14  Freshman Member
    First Comment Friend Collector
    Answer ✓

    Solved!

    You have to be shure that user's distinguishedName is shorter than 63 char.

    If not it will fails.

    You can check user's distinguishedName in user advanced attributes in Active Directory User And Computer enabling "Advanced Features".

«1

All Replies

  • Fabio_Dangelo
    Fabio_Dangelo Posts: 14  Freshman Member
    First Comment Friend Collector

    any advise?

  • Zyxel_James
    Zyxel_James Posts: 663  Zyxel Employee
    Zyxel Certified Network Administrator - Security Zyxel Certified Network Administrator - Nebula Zyxel Certified Sales Associate 100 Answers

    Please check on Advanced Settings, I suspect that you input the wrong information to Group Membership Attribute or something else.

  • Fabio_Dangelo
    Fabio_Dangelo Posts: 14  Freshman Member
    First Comment Friend Collector

    this?

    I left the default values

    Screenshot 2024-04-30 084212.png

  • YanShadowGT
    YanShadowGT Posts: 14  Freshman Member
    First Comment Friend Collector Fourth Anniversary

    Hello,

    I have the same problem leaving the default values in advanced, the AD I want to connect to is Windows 2019

  • Fabio_Dangelo
    Fabio_Dangelo Posts: 14  Freshman Member
    First Comment Friend Collector

    mine is 2016.

    I think the problem is this firewall (too young), not server OS.

    Let's see if ZyXEL can fix it.

  • Fabio_Dangelo
    Fabio_Dangelo Posts: 14  Freshman Member
    First Comment Friend Collector
    Answer ✓

    Solved!

    You have to be shure that user's distinguishedName is shorter than 63 char.

    If not it will fails.

    You can check user's distinguishedName in user advanced attributes in Active Directory User And Computer enabling "Advanced Features".

  • YanShadowGT
    YanShadowGT Posts: 14  Freshman Member
    First Comment Friend Collector Fourth Anniversary

    Hello,

    It doesn't work for me, user's distinguishedName is shorter than 63 char and same error Invalid DN syntax

    image.png

  • Fabio_Dangelo
    Fabio_Dangelo Posts: 14  Freshman Member
    First Comment Friend Collector

    Test is the user account with administration rights used to join the domain and used to query the DC?

    Did you added the required DNS forward rule too?

  • YanShadowGT
    YanShadowGT Posts: 14  Freshman Member
    First Comment Friend Collector Fourth Anniversary

    Thank you for your prompt help, I found the problem, it must be made clear that it only works in the Domain Users folder, if the user is in another folder it stops working.

    Everything working correctly!!!

  • fschenckel
    fschenckel Posts: 2  Freshman Member
    First Comment Fifth Anniversary

    Hello,
    I get exactly the same error (Invalid DN syntax). The domain is correctly joined, but all user tested are failing !

    We have users organised in several OUs, so the limit with 63 chars may be over.
    But hey, what's this for a limit ?? I'm coming from a VPN 100 and wanted the Flex 200H the replace it, but what a mess, these are absolutly not compatible, need to reconfigure all manually, and many functions are missing !!
    This seems an unfinished product to me. Can't understand ! I'm thinking about returning it…

    ⇒ Did you added the required DNS forward rule too?
    What means exactly this, could oit be related ?

    I hope someone can help !

    Thanks !

Categories

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）