IBM Security MaaS360

 View Only
Expand all | Collapse all

Active Directory Authentication stopped working

  • 1.  Active Directory Authentication stopped working

    Posted Tue June 16, 2020 11:33 AM

    Getting error (BYCloudConfigRetreiveProfileFromWebErrorDomain error -1.) when adding a new DEP device.

    Cloud extender configured properly. Cloud extender Authentication Test completes successfully. However, when adding a new device, authentication fails and throws the above error.

    We have made no recent changes but I am currently stuck being unable to add new devices.



    ------------------------------
    Joseph Hays
    ------------------------------


  • 2.  RE: Active Directory Authentication stopped working

    Posted Tue June 16, 2020 12:00 PM

    Hi Joseph,

    On the MaaS360 page with the DEP tokens listed - has the token the device belongs to updated pretty recently (within the last couple of hours or so)?



    ------------------------------
    Matt Shaver
    System Architect
    IBM
    mshaver@us.ibm.com
    ------------------------------



  • 3.  RE: Active Directory Authentication stopped working

    Posted Tue June 16, 2020 12:07 PM
    Token was updated on 5.15.2020.

    ------------------------------
    Joseph Hays
    ------------------------------



  • 4.  RE: Active Directory Authentication stopped working

    Posted Tue June 16, 2020 12:21 PM
    I used the incorrect language there - apologies

    I'm looking for the last sync time as outlined in the attached screenshot.


    ------------------------------
    Matt Shaver
    System Architect
    IBM
    mshaver@us.ibm.com
    ------------------------------



  • 5.  RE: Active Directory Authentication stopped working

    Posted Tue June 16, 2020 12:43 PM
    Last Sync time is 06/16/2020 12:39 EDT

    Although, I added a phone to DEP today that doesn't seem to have made it over yet.  

    The accounts and credentials I am using to test have been in the system for at least a week I would say and show up in the maas portal.  My personal credentials have been linked to the server for probably over 2 years at this point and still fail.  

    I have also updated the admin credentials on the cloud extender and even rebooted the server that hosts it.  Credentials still failing when adding a new device, although the credential test from both the cloud server and maas cloud extender page both pass.


    ------------------------------
    Joseph Hays
    ------------------------------



  • 6.  RE: Active Directory Authentication stopped working

    Posted Tue June 16, 2020 02:14 PM
    I have also uninstalled and reinstalled the cloud extender with no luck.  Will be installing on a different server now.  I believe this issue is on IBM's side but support is lacking.

    ------------------------------
    Joseph Hays
    ------------------------------



  • 7.  RE: Active Directory Authentication stopped working

    Posted Tue June 16, 2020 02:43 PM
    I don't believe this is related to the CE tool but rather to our back end communications with Apple.  Would you mind sending me your account number via email - mshaver@us.ibm.com

    ------------------------------
    Matt Shaver
    System Architect
    IBM
    mshaver@us.ibm.com
    ------------------------------



  • 8.  RE: Active Directory Authentication stopped working

    Posted Tue June 16, 2020 03:01 PM
    Account Number sent via email.  I am adding the additional details here for the benefit of others.

    I have started to think it may be related to Apple's DEP connection, although I am not certain why that would affect the Active Directory Authentication.  The DEP connection does seem slow today bringing over freshly added devices (the ones I have been testing were added yesterday and last week).  I did notice an error in the MDM earlier stating that the DEP token and T&C validity has expired.  However, the Token was updated about a month ago ahead of expiration.  IT expires in roughly 1 year.  When logging on, I did have to accept new terms of agreement from Apple.  I double checked all token aspects and they are not expired and checking in as expected.



    ------------------------------
    Joseph Hays
    ------------------------------



  • 9.  RE: Active Directory Authentication stopped working

    IBM Champion
    Posted Wed June 17, 2020 08:57 AM

    This may help.  Apparently Apple updated the T's and C's effective the 16th and a number of my customers cannot find the area to accept the changes, in Apple Business Manager.  Has anyone else found the place to accept the new T's and C's?

     

    Stay Healthy!

     

    Mitch Lauer

    connecTel  Wireless  

    159 Perry Highway, Suite 200

    Pittsburgh, PA 15229

    216-970-6981 | Cell

    412-339-5775 | Help Desk

    412-339-5765 | Direct Dial

     






  • 10.  RE: Active Directory Authentication stopped working

    Posted Wed June 17, 2020 09:06 AM
    Thanks Mitch.  I believe I was able to find the T&C and accept them but I may be missing something.  Yesterday during troubleshooting I just logged off business manager and when I logged back on the T&C prompt popped right up for me and I accepted it, unless there is another hidden option somewhere.  After accepting that, the DEP token and T&C validity warning disappeared from the Maas Portal.  However, devices being added are still failing the authentication during on boarding.  I am most likely going to disable authentication temporarily so I can get devices out the door.  Still looking for the actual solution.

    ------------------------------
    Joseph Hays
    ------------------------------



  • 11.  RE: Active Directory Authentication stopped working

    IBM Champion
    Posted Wed June 17, 2020 10:08 AM

    A pleasure!  IT turns out that everyone received an email a month ago about the new T's and C's happening on the 16th, but they actually did not show up till late in the day yesterday.  I am seeing this with a number of my customers today and we are updating everything.

     

    Stay Healthy!

     

    Mitch Lauer

    connecTel  Wireless  

    159 Perry Highway, Suite 200

    Pittsburgh, PA 15229

    216-970-6981 | Cell

    412-339-5775 | Help Desk

    412-339-5765 | Direct Dial

     






  • 12.  RE: Active Directory Authentication stopped working

    Posted Wed June 17, 2020 10:13 AM
    I have accepted the new T&C and still cannot seem to add any new devices.  Authentication was failing.  I disabled the authentication requirement and now I am reaching a "Invalid request parameters" page where the credential page / accept MDM page normally is.  

    Looks like we will be shipping out devices without MDM until IBM or Apple can help us solve this issue.

    ------------------------------
    Joseph Hays
    ------------------------------



  • 13.  RE: Active Directory Authentication stopped working

    Posted Thu June 18, 2020 10:10 AM
    ​Hi, All - you have to log in to the Apple Business Manager site. It'll have a pop up for the Terms & Conditions there that have to be accepted.

    ------------------------------
    Amy Burt
    ------------------------------



  • 14.  RE: Active Directory Authentication stopped working

    Posted Thu June 18, 2020 10:34 AM
    Thanks Amy.  If you check the thread, Terms and conditions were accepted from Apple and that was actually not the issue.  Best answer has been marked to help others if they run into the same problem.

    ------------------------------
    Joseph Hays
    ------------------------------



  • 15.  RE: Active Directory Authentication stopped working
    Best Answer

    Posted Wed June 17, 2020 11:25 AM
    Okay I have finally solved the problem.  Must have been an update on either Apple's side or IBM's side that caused it as I made no changes before it stopped working, but I found the solution.  All credentials appeared to be rejected as they were not passing through the domain information.  During the Authentication tests, there was a field to enter the domain, however, when onboarding a device, no domain field was available.  Disabling authentication allowed me to add devices which lead me to believe it was not necessarily a backend communication problem, but rather something with the credentials.  I have no idea why it was working this way previously and stopped, but I solved the issue by going to Settings > Device Enrollment Settings > Basic        and changing the default authentication mode to Corporate Active Directory.  Here I also updated the default domain and allowed domains from the form of "domain.com" to "dm" (Netbios / legacy pre windows 2000 domain name).  Doing so added a domain drop down to the authentication page and when selecting the correct domain authentication finally started working again.

    ------------------------------
    Joseph Hays
    ------------------------------



  • 16.  RE: Active Directory Authentication stopped working

    Posted Fri June 19, 2020 01:40 AM
    Hi Joseph,

    what about AD Authenication at the DEP Setup on macOS? Is that also working again for you, after yiu changed the settings?

    regards
    Falko

    ------------------------------
    Falko Christ
    Administrator
    Primetime fitness GmbH
    Frankfurt am Main
    ------------------------------



  • 17.  RE: Active Directory Authentication stopped working

    Posted Tue June 23, 2020 09:44 AM
    I was experiencing the same issue since last Thursday. Had an open case with support but they take forever to answer. So glad I came across this thread! Changing the default authentication mode to Corporate Active Directory and adding the default domain did it for me. Thank you so much!

    ------------------------------
    Ridgeway Plumbing
    ------------------------------



  • 18.  RE: Active Directory Authentication stopped working

    Posted Mon November 28, 2022 11:44 AM
    I know this is an old post but I started having this same error code last week. I have an open case but everything that they have told me to do hasn't worked. I tried to follow the steps but I didn't understand the domain part.

    ------------------------------
    Sam Langenbach
    ------------------------------