Using AD LDS as proxy to AD DS with Zenon

Using AD LDS as proxy to AD DS with Zenon

Hello,

Because og ISA95 considerations, the ZenOn instances I need to configure will reside in a VLAN that has no direct access to the AD DS domain controller. But the requirement is to have domain based authentication. ZenOn supports AD LDS which is great. The AD LDS instance can act as a "binding authentication proxy" to an AD DS and it also has tools (adamsync) to synchrnonize AD DS users and groups down to the AD LDS instance. And this is also great. These two seem to be a solution for my requirements as I can have an LDS instance that has access to the DC, and the ZenOn instances will have access to the LDS instance.

But I can't make them work together.

I have set up AD DS to AD LDS synchronisation, and binding proxy authentication also work as expected - but only from custom code. The same user name and password pair that is accepted by the generic LDAP bind yields "invalid user name" in zenon. I presume, that there are other checks towards the LDS instance going on under the hood, but I have found no documentation about this, and I am currently unable to find it out. There is a difference between the legacy user and the proxied user though: the legacy user is of "user" class while the proxied is "userProxyFull" - and I can't have them both. Thus if there is an LDAP search based on the class, it will obviously fail.

Is there somewhere any documentation on how to set up such an environment? I doubt that such a segregation is a requirement only at our site.
Or at least can somebody tell the exact flow of the communication between the LDAP server during authentication; which attributes/values are fetched and/or filtered during any of these phases?

Regards,

This is a migrated post! Originally posted on 13.07.2020 by user zorgoz. Please be aware that information can be outdated.