Micollab Enable Authentication - How?

[jomitelquery]

Currently importing users successfully from Active Directory through the IDS however want to enable authentication so our Active Directory Server authenticate logins into Micollab. Requires enable authentication to be ticked and secure method off SSL/TLS to be ticked. However getting schannel event logs on our directory server and error within IDS indicating server cannot be contacted when secure method is selected. From reading this requires LDAPS and the use of certifcates? Correct?
What are prereqs for this to work? A Microsoft Certificate Authority to be installed on our directory server or to install the Mitel Certificate Authority on the directory server? Mitel documentation states the Mitel? If so can anyone confirm the steps required?
Many Thanks

[nowickj]

You must have A Microsoft Certificate Authority installed on AD server. I remember that I had a strange situation with that, because after setup I could not synchronize with AD. As I came on the other day everything worked

[martyn]

Slight correction on the above, you need to have a certificate installed on the DC that you are synchronizing with.

You don't need to necessarily have Certificate Services installed on that particular DC, it just needs to have a certificate installed with IIS running on there.

[VinceWhirlwind]

Can anybody shed some light on the procedure here?
 
Where do you get it from, and where do you put it, precisely?

[martyn]

Can anybody shed some light on the procedure here?
 
Where do you get it from, and where do you put it, precisely?

Which part are you stuck on?

[VinceWhirlwind]

Where do I get the certificate from that goes on the AD server? Will the AD server guy know what to do with it, or do I need to give him instructions?
 
Also, slightly different issue, or maybe it's the same - when users access their MiCollab Portal it tells them there is no certificate.
The Help file for client certificates says,
 
"Manage Client Certificates
To securely authenticate connections, some applications may request a security certificate signed by the MSL server using a Mitel Certificate Authority (CA). You can manage Certificate Signing Requests (CSRs) and issued certificates using the Certificate Management panel.
To approve a CSR:
Under Security, click Certificate Management. Certificate requests waiting for approval appear under the heading Queued CSRs.
Click the Certificate ID link."
 
There is no link. Also, is this something that happens once, or once per user?
 

[martyn]

Where do I get the certificate from that goes on the AD server? Will the AD server guy know what to do with it, or do I need to give him instructions?
 

The certificate is signed by a trusted CA. Depending on the environment it could be as simple as requesting a web server certificate from the internal CA, if they have one, or could be a case of it having a publicly signed certificate by way of a wildcard or individual cert.

Also, slightly different issue, or maybe it's the same - when users access their MiCollab Portal it tells them there is no certificate.
The Help file for client certificates says,
 
"Manage Client Certificates
To securely authenticate connections, some applications may request a security certificate signed by the MSL server using a Mitel Certificate Authority (CA). You can manage Certificate Signing Requests (CSRs) and issued certificates using the Certificate Management panel.
To approve a CSR:
Under Security, click Certificate Management. Certificate requests waiting for approval appear under the heading Queued CSRs.
Click the Certificate ID link."
 
There is no link. Also, is this something that happens once, or once per user?

By default the MSL will use a self signed certificate. Because clients don't trust this they will receive an error when they go to the user portal. To stop this from happening you either need to load the cert in to the trusted certificates store on each system (either manually or via GPO), or generate a CSR on the server and have it signed by a trusted CA.

I am guessing by this that you are trying to complete an install for a customer? Are you trained and certified on MiCollab & MSL and understand how SSL certificates and Microsoft environments work?

[VinceWhirlwind]

I guess what has me confused is that the instructions for enabling AD authentication talk about installing a certificate and that step in the help file links to the help page about installing certificates for clients, which I am realising has nothing to do with AD authentication.

[johnp]

The instructions are wrong.