MSPROXY 2 - Access control failing

If I undserstand your query, you have a NT domain with Proxy that does not work well for NT domain users (who are authenticated & login to domain) but works only for users created on Proxy, am I right ?

Well, have you added users from domain in your winsock / sock for HTTP, HTTPS, POP3, SMTP, FTP protocol access ?
If yes, then has the Proxy ever been giving "Trust Relationship Failed" error ?

I suggest you reinstall your Proxy as Member server to your domain, once the Proxy is on the domain, check login as domaion Admin & Proxy Admin (both).
Then install Proxy & add users from NT domain, granting them protocol access.

One more suggestion, add one more proxy to "Load Balance" the first plus act as backup. If your first Proxy fails, the other would still work.
Best of Luck,
Akash

If the server is a member of your domain:
1. Create a local group.
2. Put into the local group the domain users you wish to have a particular access.
3. In Proxy, assign the access to the local group.

If the server is NOT a member of your domain:
1. Create a local group.
2. For each domain user you wish to have a particular access, create a local user with the same username and same password as the user has on the domain.
3. Put into the local group the local users you wish to have a particular access.
4. In Proxy, assign the access to the local group.

Built-in groups work because they are local groups.

Good luck.

The server is the PDC.

When i enter the Groups/Users to the access list it accepts all i say and looks like a normall config. I made a Internet WWW and a Internet MAIL group and added them to pop3,smtp & WWW access lists. When you actuallyuse it as a user it requires authentication. If i put in domain it works perfectly. If i use domain admins, Domain Users, Administrators it works flawlessly.

If i use anything that has been manually created and is not a \BUILTIN\ account suchas an Internet group or a individual user then it does the authentication thing.

I know from my experiences that accounts are categorized by groups, users, computers & Builtin. How NT / Proxy deal with these groupings is where i think the issueis. NT side of things works 100% but Proxy must do something a little different (metasecurity??).

CAUSE
The Group you belong to is not listed in the Enable Access Control list found under the Permissions tab in the WinSock Proxy Service Properties, and the Group is not listed in the Log On Locally Right found in the User Manager for Domains, Policies, and User Rights.

WORKAROUND
You need to belong to both of the above lists.

Leopold

You might try to disable Winsock Proxy Access Control if enabled.

Clear the WinSock Proxy | Properties | Permissions | "Enable access control" checkbox.

----------

To enable access control:

1) Create new user in "User manager for domains", as a member of the "Domain Users" group

2) Grant this user "Policy | User Rights| Log on locally", also in User Manager for Domains

3) Re-enable Access control on proxy server

4) Add new user to "Unlimited access" (for security reasons you should change this to a custom protocol later)

5) Open command prompt on internal server

6) Make "c:\mspclnt" your current directory (assumes default proxy client installation location)

7) Create credentials for nserver.exe, nrouter.exe, and nreplica.exe as follows:

credtool -w -n nserver -c NewProxyUser Domain Password

credtool -w -n nrouter -c NewProxyUser Domain Password

credtool -w -n nreplica -c NewProxyUser Domain Password

where NewProxyUser is the new user created in step 1, Domain is the NT domain to which the proxy server belongs, and Password is the password assigned to NewProxyUser. The credentials for each service can be checked by replacing the "-w" in the above commands with "-r"

8) Add the line "ForceCredentials=1" to the WSPCFG.INI file you created in step 9. e.g.

[Common Configuration]
ServerBindTCPPorts=1352
Persistent=1
KillOldSession=0
ForceCredentials=1

9) Reboot the internal server

10) Testthat the outside and internal servers can still communicate correctly.

Good luck,

Maxwell

This question was auto closed due to inactivity