Unable to login to Enforce UI with AD credentials

Products

• Data Loss Prevention Oracle Standard Edition 2
• Data Loss Prevention

Issue/Introduction

AD users are unable to login, only Administrator or local accounts can log in.

 

Environment

Example tomcat log output:

Source: org.apache.catalina.core.ContainerBase.[Catalina
Message: Servlet.service() for servlet [default] in context with path [/ProtectManager] threw exception
Cause:
org.springframework.orm.ObjectOptimisticLockingFailureException: Object of class [com.vontu.enforceentities.users.ProtectUser] with identifier [xxx]: optimistic locking failed; nested exception is org.hibernate.StaleObjectStateException: Row was updated or deleted by another transaction (or unsaved-value mapping was incorrect) : [com.vontu.enforceentities.users.ProtectUser#xxx]org.springframework.orm.ObjectOptimisticLockingFailureException: Object of class [com.vontu.enforceentities.users.ProtectUser] with identifier [xxx]: optimistic locking failed; nested exception is org.hibernate.StaleObjectStateException: Row was updated or deleted by another transaction (or unsaved-value mapping was incorrect) : [com.vontu.enforceentities.users.ProtectUser#xxx]
    at org.springframework.orm.jpa.vendor.HibernateJpaDialect.convertHibernateAccessException(HibernateJpaDialect.java:298)
    at org.springframework.orm.jpa.vendor.HibernateJpaDialect.translateExceptionIfPossible(HibernateJpaDialect.java:225)

.......

Caused by: org.hibernate.StaleObjectStateException: Row was updated or deleted by another transaction (or unsaved-value mapping was incorrect) : [com.vontu.enforceentities.users.ProtectUser#xxx]

.......

org.hibernate.StaleObjectStateException: Row was updated or deleted by another transaction (or unsaved-value mapping was incorrect) : [com.vontu.enforceentities.users.ProtectUser#xxx]org.hibernate.StaleObjectStateException: Row was updated or deleted by another transaction (or unsaved-value mapping was incorrect) : [com.vontu.enforceentities.users.ProtectUser#xxx]

Additional Warnings may be seen below

Level: WARNING
Source: com.symantec.dlp.login.spring.SymantecKerberosAuthenticationProvider
Message: Kerberos authentication failed: user=<user>@domain.local

Cause

AD server is unavailable for authentication requests.

Resolution

Confirm Active Directory server is available. Address issues with accessing port 389 (unsecure) or port 636 (secure) on the Active Directory server.

 

Additional Information

How to test connectivity with powershell 

Use the following command to test connectivity with the AD Server

tnc <servername> -port 389

Example output:

If returned false then there is an issue with reaching the AD environment 

In some of the cases you may notice that PingSucceeded=False  while TcpTestSucceeded=True. This is normal behavior when ICMP Ping is prohibited.