• State Suggested Answer
  • Replies 5 replies
  • Answers 2 answers
  • Subscribers 95 subscribers
  • Views 1163 views
  • Users 0 members are here
Options
Related

Edit Dial-in Network Access Permission setting

si aksenov
over 1 year ago

Greetings.
My goal is to set for some ADSAccount users property Network Access Permission(same in Manager 'Dial-up permitted') to 'Control access throught NPS Network Policy' (tab 'Dial-in' in ADUC; tab 'RAS' in OneIM Manager).

When i try to manage this attribute in OneIM get an error in JobQueueInfo:
[1777018] Error running synchronization project (Active Directory Domain (DC=my,DC=LOCAL))'s workflow (Provisioning).
[1777124] Error running synchronization step (user) of synchronization configuration (Provisioning (Provisioning)).
[1777004] Method (Update object (Update)) could not be run successfully.
[2226223] Error writing RAS properties of user account ras_test_user to server ad.my.local. (Error: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED)))

I thought that there was a bug in OneIM version installed in my production environment.
So I install brand new deployment OneIM 8.2 with fresh connection to my test Active Directory domain.
for user account for accessing Active Directory had been granted domain admin rights
but still have same issues when try to provisioning mentioned attribute.

when sychronize object from Active Directory domain all fine

Has anyone ever encountered such a problem?
any suggestions or recommendations

Parents Reply Children
  • 0 over 1 year ago in reply to si aksenov

    The key thing to keep in mind is the service account user the Job Service running the AD Jobs needs to have the permissions. DId you check that the Job Service is running with the right account?

  • 0 over 1 year ago in reply to Markus Weiss-Ehlers

    It was really hard, but I made it.
    At first I thought about limited delegation, but that was a dead end
    Therefore, if the “Single Identity Manager Service User Account” does not match the “User to Access Active Directory”, then to be able to edit the RAS settings OOTB for "Single Identity Manager Service User Account" need read & write permissions on user objects in Active Directory:
    account restrictions
    msRADIUS-FramedIpv6Route
    msRADIUS-FramedIpv6Prefix
    msRADIUS-FramedInterfaceId
    msRADIUS-SavedFramedIpv6Route
    msRADIUS-SavedFramedIpv6Prefix
    msRADIUS-SavedFramedInterfaceId
    msRADIUSCallbackNumber
    msRADIUSFramedIPAddress
    msRADIUSFramedRoute
    msRADIUSServiceType
    msRASSavedCallbackNumber
    msRASSavedFramedIPAddress
    msRASSavedFramedRoute
    msNPAllowDialin
    msNPCallingStationID
    msNPSavedCallingStationID

    to make some of these attributes to appear in dsa.msc need to edit %systemroot%\System32\dssec.dat file