When the "Refresh LDAP group" is selected PAM displays an error message "Unable to connect to domain DC=Forwardinc,DC=COM. All configured LDAP servers are down. Connection to LDAP Server ldaps.forwardinc.com Port 636 failed. Failing over to the next configured server for the domain."
After trying several times to refresh, the LDAP group is refreshed.
The AD/LDAP servers are available and all are up. There are hosted in WIndows 2016.
The LDAP logs show the following error everytime that the LDAP Refresh group fails:
<message>Exception failed trying to acquire ldap context to Server ldaps.emea.dsv.com Port 636</message>
<message>javax.naming.CommunicationException: ldaps.emea.dsv.com:636 [Root exception is javax.net.ssl.SSLException: java.lang.RuntimeException: Could not generate DH keypair]
The problem is related to the fact that 2.x is using Java 1.7.Release 3.x uses BouncyCastle instead of Java for these connections.
Unfortunately there is no way to change this in PAM safely.
CA PAM 2.X
This is issue is fixed in PAM 3.x
If you have Release PAM 2, verify the registry of the AD/LDAP servers: Java 7 can only support up to 1024 bit key, but many admins are starting to change Security options to accept a minimum of 2048 bit which cannot be handled by PAM 2.x currently.
More Information: https://docs.microsoft.com/en-us/windows-server/security/tls/tls-registry-settings