AD win2003 wrong user error NGX

[Brentd]

Hi all

I have setup the following:
AD win2003 with Ent root CA
SSL cert on DC


NGX Account unit object
Account unit host
LDAP group
AD template

I have created the account unit and I can see all of the users in the users container in AD when I open the LDAP server under the users tab from the NGX dashboard.

I am using SSL and this has been verified on the AU settings in NGX dashboard as I can get the fingerprint from AD and I can also download the branches from AD.

I have setup a rule with user access (ldap_group@any) to http as the service and have setup "client auth" as fully automatic.

When I start IE to trigger the rule, I get a login dialog box but when I enter the username and password it informs me I have the wrong user name or password! ( I am using administrator and P@ssw0rd, this is a test environment)

I have tried tweaking just about everything with no good results and so I believe I am doing something fundamentally wrong, its strange that the NGX dashboard can see the AD objects but I cant authenticate to them.

I have also removed all of the digitally signed traffic settings in AD's group policys this has not helped...

Anybody have a clue where I can turn next?????

Thanks
Brent

[Brentd]

It seems I will be answering my own post...

I have tested and tweaked and tested and tweaked settings regarding this always with the same result (wrong user or password), then I decided to try non-SSL LDAP transfer while tracking with wireshark at the AD DC.

Well... Did I get a shock.

The administrator's password was set to P@ssw0rd on the AD DC and when I saw the cleartext password appear in the packet trace from wireshark, (as NGX was passing the LDAP auth to AD), it looked like this

ssw0rd

Obviously I now understand that the @ symbol, when passed by Checkpoint authentication, means something special (like forget everything before this :) ).. Once I discovered this and changed the AD password so that it contained no @ symbols, the AD (LDAP) authentication works great.

I hope this helps someone, as I would never have guessed this myself!
Brent

(So much for complex passwords in AD, when it comes to checkpoint)