PAM-CM-3432 When Adding New AD Target Account

Products

• CA Privileged Access Manager - Cloakware Password Authority (PA)
• CA Privileged Access Manager (PAM)

Issue/Introduction

When trying to add an Active Directory target account in Privileged Access Manager (PAM), the following error is observed.

PAM-CM-3432: Cannot connect to a domain controller on the specified domain

Cause

The device associated with the target account was configured to use an IP address, but the Active Directory certificate did not have that IP address in its list of Subject Alternative Names. If the Tomcat Log Level is set to Info when the error is produced, the following message will be in the Tomcat logs.

com.cloakware.cspm.server.plugin.targetmanager.WindowsDomainServiceTargetManager loginToActiveDirectoryServer INFO: Failed authentication to Active Directory using account 'ExampleAccount' com.cloakware.cspm.server.plugin.targetmanager.WindowsDomainServiceTargetManager$LDAPSSLException: java.security.cert.CertificateException: No subject alternative names matching IP address #.#.#.# found

Resolution

There are two options to resolve the issue:

1. Re-issue the Active Directory certificate with the IP address included in the SAN list
2. Update the device in PAM and have it use the FQDN or IP within the certificate SAN list