Status code 500 when authenticating on Management Center with local account

Products

• Management Center - VA
• Management Center

Issue/Introduction

While authenticating with a locally created user account on Management Center, an admin or user may experience the following message: "The system has returned a 500 status code".

Reviewing the appliance "clp_services.log" and "user_syslog.log" within the diagnostics file, entries are found that depict errors related to authentication. Examples include:

• Oct  9 12:06:26 localhost X.X.X.X ERROR class com.bluecoat.clp.auth.LocalRealmAuthenticator- LoginName admin2 does not exist in CDB for the given Realm name localRealm
• Oct 31 11:39:08 localhost     org.springframework.ldap.UncategorizedLdapException: Uncategorized exception occured during LDAP processing; nested exception is javax.naming.NamingException [Root exception is java.lang.IllegalStateException: Cannot write application data until initial handshake completed.]
  
• Oct 31 11:39:08 localhost     at org.springframework.ldap.support.LdapUtils.convertLdapException(LdapUtils.java:228)
... ... ...
  
• Oct 31 11:39:08 localhost cli_auth_mc.py[3442]: Unexpected HTTP server response code '500' from MC HTTPS API endpoint:
  
• Oct 31 11:39:08 127.0.0.1 X.X.X.X  WARN  EventLog.confd- AuditNotification[logno=148, user=admin2, usid=0, msg="external authentication failed via maapi from 0.0.0.0:0 with unknown: "]
  
• Oct 31 11:39:08 127.0.0.1 X.X.X.X  WARN  EventLog.confd- AuditNotification[logno=150, user=admin2, usid=0, msg="login failed via maapi from 0.0.0.0:0 with unknown: noauth"]

Environment

• Management Center 3.3.2.1, where the following conditions exist:
  • There is a locally created user account other than the built-in "admin" user.
  • There is an LDAP realm with an unreachable server configured.

Cause

For any user accounts other than the default "admin" account, LDAP authentication is performed first (if the LDAP realm is configured). Management Center will attempt to reach the configured LDAP server twice prior to falling back or failing over to local realm authentication.

If the LDAP communication times out before falling back to local, the end result is a "Status code 500" message.

Resolution

Validate your LDAP authentication realm configuration and confirm the servers in question are reachable by Management Center or disable LDAP authentication (if applicable).