Resolving 'AD Internal Error' During Login - Identity Manager

Products

• CA Identity Manager
• CA Identity Suite

Issue/Introduction

This article addresses the "Error: AD Internal Error: Check AD" message that occurs during user authentication when the Active Directory Authentication Module is configured with the Base Distinguished Name (BASEDN) set to the root of the AD domain.

Environment

Identity Manager 14.5

Cause

When the BASEDN is set to the domain root (e.g., DC=lab,DC=local), Active Directory responds to queries with referrals. The current version of the Authentication Module does not correctly handle these referrals, resulting in an authentication failure despite valid credentials.

Resolution

To resolve this issue, apply one of the following configurations:

Option A: Use the Global Catalog

Configure the SERVERS property to point to the Global Catalog port. This bypasses the need for referral handling in many AD architectures.

1. Navigate to the Active Directory Authentication Module configuration.
2. Update the SERVERS property:
   • For standard connections: SERVERS=<adserver>:3268
   • For SSL connections: SERVERS=<adserver>:3269

Option B: Scope the BASEDN

Narrow the search scope by adding a specific container to the BASEDN.

1. Navigate to the Active Directory Authentication Module configuration.
2. Update the BASEDN property to point to a specific container rather than the domain root.
   • Example: CN=Users,DC=lab,DC=local

Additional Information

• SSL Configuration: If using SSL connections, ensure the trusted keystore is correctly configured. The default path for the trusted keystore is %JAVA_HOME%\jre\lib\security\cacerts.
• Authentication Testing: After applying these changes, restart the relevant service and verify that the authentication failure is resolved in the application logs.

To speak with a customer representative or a Support Engineer see Contact Support. Scroll to the bottom of the page and click on your respective region.