LDAPS Connection Failure to AWS LDAP Server via Identity Manager

Products

• CA Identity Manager
• CA Identity Suite

Issue/Introduction

When configuring or connecting to an AWS OpenLDAP server (or other secure LDAP providers) via LDAPS (port 636), Identity Manager may fail to establish a connection even when network connectivity and credentials are valid. This typically occurs due to strict security validations introduced in modern Java environments.

"Could not connect to LDAP server #####:636 with User DN uid=idmadmin,ou=ServiceAccounts,dc=###,dc=com and specified password

Environment

Identity Manager 14.x

Cause

Starting from Java release 1.8.0_181, endpoint identification is enabled by default for LDAPS connections to improve security. If the LDAP server's certificate does not have a Subject Alternative Name (SAN) that matches the hostname used in the connection URL, Java will reject the connection.

Resolution

To resolve this connection issue, you must disable the strict endpoint identification check in the Java options used by the Identity Manager server.

1. Locate the startup configuration file for your Identity Manager environment (e.g., standalone.conf, system.properties, or the startup script).
2. Add the following line to the JAVA_OPTS or default_java_opts section:

   -Dcom.sun.jndi.ldap.object.disableEndpointIdentification=true

3. Note: Ensure the syntax matches the existing options. For example: JAVA_OPTS="$JAVA_OPTS -Dcom.sun.jndi.ldap.object.disableEndpointIdentification=true"
4. Restart the Identity Manager (or API Gateway) service.
5. Retry the connection to the LDAPS server.

Additional Information

For further details, see "Java Upgrade LDAP Issue" in the Known Issues document