LDAP logins stopped working after upgrading Java on the AAI server

Products

• Automation Analytics & Intelligence

Issue/Introduction

LDAP logins stopped working after upgrading Java on the AAI server.

 

After a test connection, the jaws.log has the error below:

WARN  [LdapLoginImpl] Error contacting ldap server at ldap://<hostname>:636; trying next. : javax.naming.CommunicationException: simple bind failed: ldap.server.com:636 [Root exception is javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target]
 at com.sun.jndi.ldap.LdapClient.authenticate(LdapClient.java:219)

Environment

Release : 6.4.2-5

Component : AUTOMIC AUTOMATION INTELLIGENCE ENGINE

Resolution

1. Copy the LDAPS root certificate to the AAI server.

 

2. Ensure JAVA_HOME variable is set to the current Java directory.

 

3. Run the following 

Windows:

keytool -import -v -file filename.cer -keystore "%JAVA_HOME%\jre\lib\security\cacerts" -storepass changeit -noprompt

 

4. Restart the AAI service after importing the certificate.

 

5. Launch AAI thick client, go to the Admin->User Management tab->Domains and Edit and Test the connection for your LDAP domain.

 

If it is still failing check the jaws.log for any errors.

Linux:

keytool -import -v -file filename.cer -keystore $JAVA_HOME\jre\lib\security\cacerts -storepass changeit -noprompt