Cannot bind to AWS Active Directory - PAM

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

An Active Directory connection has been configured with a valid AWS Certificate following instructions on documentation page How to Set Up LDAP Servers for User Authentication, but PAM is not binding successfully to the LDAPS port.

Environment

Privileged Access Management appliance running in AWS.

Cause

In PAM AWS and Azure deployments the DNS servers of the hosting platform are displayed only and cannot be changed.

In this case no DNS servers were available to the AWS account running the PAM instance. Therefore the PAM administrator configured the device with its IP as address. But the certificate of the Active Directory server doesn't include the IP address in the Subject Alternate Names (SAN) list, and attempts to connect using the IP run into a certificate validation error.

Resolution

PAM allows configuration of /etc/hosts file entries on the appliance for Fully Qualified Domain Names (FQDNs) that cannot be resolved by any available DNS server. Use the following procedure to resolve such a problem:

1. Update the Target Device to use the FQDN for Hostname and Address.
2. Go to PAM UI page Configuration > Network > Host File Entry.
3. Use the "Add" button to add an entry for your LDAP server.

Afterwards you should be able to validate the password of the Active Directory account you configured for this integration and also import LDAP groups as PAM user groups successfully.