LDAP back-end authentication setup issues

These issues relate to the SASL Digest-MD5 LDAP authentication mechanism used by OneSpan Authentication Server Appliance and a Microsoft security concept called service principal name (SPN). Authentication with SASL Digest-MD5 is only allowed when the digest-uri parameter contains a string that is also defined as SPN on the Active Directory server.

OneSpan Authentication Server Appliance automatically sets the digest-uri parameter by performing a DNS reverse lookup of the IP address used to contact the domain controller.

The location of the back-end server record is 192.0.2.21.

The DNS server used by OneSpan Authentication Server Appliance contains the following information:

• An 'A' record: dc1.mydomain.com resolves to 192.0.2.21.
• A 'PTR' record: 21.2.0.192.in-addr.arpa resolves to dc1.mydomain.com.

The following steps for an authentication occur:

1. OneSpan Authentication Server Appliance retrieves information from the back-end record and opens an LDAP connection to the domain controller.
2. OneSpan Authentication Server Appliance performs a reverse DNS lookup for 192.0.2.21 (DNS request for 21.2.0.192.in-addr.arpa) and receives dc1.mydomain.com.
3. OneSpan Authentication Server Appliance sends digest-uri dc1.mydomain.com along with other authentication settings to the Active Directory using the open LDAP connection.
4. The domain controller verifies that the digest-uri parameter exists as an SPN. If it does, the authentication proceeds and credentials are verified.