PVP7 LDAP Questions

[jmbowles78]

I'm working for a customer who would like to replace local authentication on their PVP7 (FTVME 8.00) with Domain Authentication via LDAP. The PVP7 is on a local machine network (169.200.156.***) and connected to their plant network via an NAT (AB 1783-NATR). I've been struggling and have a few questions:

1. Is LDAP domain authentication feasible through an NAT device? I have the PVP7 added to the NAT table and have configured the PVP7 network adapter with the NAT IP address as the gateway. I can ping the PVP7 from a PC on the plant network.

2. Does the PVP7 need to be a member of the domain for the LDAP authentication to work?

3. In FTVSME on my laptop (not a member of the domain and not on the plant network) when I try to add a Windows-linked user group, it appears that I can't add any of the plant network AD groups since I am not a member of the domain. Is being a member of the domain a requirement for this step in the development?

 

[KuulKuum]

I believe you will need to firmware flash your PVP7 to 8.20 or higher for LDAP authentication to work correctly.

 

[James Mcquade]

If you plan to log into the plant using the domain admin server, i don't think you can.
in order to log onto the domain, you need to have a pc, pcname, user name, password, and it has to be registered in the domain server.
if i am incorrect, someone please let me know.
james

 

[jmbowles78]

I misspoke earlier on the model, it is actually a PVP6 700 (not a PVP7).

I believe you will need to firmware flash your PVP7 to 8.20 or higher for LDAP authentication to work correctly.

Thank you for the suggestion. We flashed the firmware to 8.20 and re-entered the LDAP settings with no improvement.

We are able to ping the domain controller from the HMI via IP address, but not via name. I'm not sure if DNS is required for LDAP authentication to work, but we have tried setting the domain as an IP address instead of a name with no improvement.

Any additional suggestions would be appreciated.

 

[KuulKuum]

Have a look at the KB QA23919, depending on your configuration you might need to install the Domain Certificate on the PVP panel.

RA Knowledgebase doc id QA23919 - FactoryTalk View Machine Edition 8.xx and later Domain Authentication Support

There are other LDAP troubleshooting docs on RA site but will require a TechConnect contract to access.
RA Knowledgebase doc id QA48731 - Troubleshooting LDAP on a PanelView Plus 6/7 terminals