AD/LDAP credentials do not work and test fails with "Invalid Credentials" or "Certificate is missing or invalid" errors in VCF Operations

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

• Logging into VCF Operations using AD/LDAP account fails intermittently.
• Using the nslookup command against the FQDN used in the AD integration, multiple IP addresses are returned.
• Test the AD integration and Accept/Save the certificate presented allows logins to work for a limited time.
  • After some time the system loses the certificate connection with the Domain Controller, DC, and then LDAP login stops working.
• The UI shows the following error message: "Login server is unreachable"
• Analytics logs (/storage/vcops/log/analytics-*.log) display message: 
  

  javax.net.ssl.SSLHandshakeException: PKIX path building failed... unable to find valid certification path to requested target.

• While adding the LDAP authentication source in VCF Operations, it failed with the error  "Test unsuccessful for ldap: <FQDN>. Reason: Certificate is missing or invalid.  Importing CA certificate may resolve the issue." or "Test unsuccessful for ldap: <FQDN>. Invalid Credentials."
  

  Caused by: org. bouncycastle. tls. TlsFatalAlert: certificate unknown (46)
  at org. bouncycastle. jsse.provider. ProvSSLSocketWrap. checkServerTrusted (ProvSSLSocketWrap. java: 132)
  at org. bouncycastle. jsse.provider. ProvTlsClient$1.notifyServerCertificate (ProvTlsClient. java: 385)
  ..
  Caused by: java. security. cert.CertificateException: Unable to construct a valid chain
  at org.bouncycastle.jsse.provider. ProvX509TrustManager. validateChain (ProvX509TrustManager. java: 321)
  at org.bouncycastle.jsse.provider. ProvX509TrustManager.checkTrusted (ProvX509TrustManager. java: 276)
  ..
  Caused by: java. security. cert. CertPathBuilderException: No issuer certificate for certificate in certification path found.
  at org. bouncycastle. jcajce. provider. PKIXCertPathBuilderSpi_8. engineBuild (Unknown Source)
  at java.base/java. security. cert . CertPathBuilder. build (Unknown Source)
  

Environment

Aria Operations 8.18.x

VCF Operations 9.x

Cause

The issue is caused by an incomplete SSL certificate chain. VCF Operations fails to build a valid trust path because the Root or Intermediate (Sub-Root) CA certificates are missing from its internal trusted certificate store.

Resolution

If the FQDN used in the VCF Operations Active Directory integration resolves to multiple IP addresses, it is required that the certs presented by each Domain Controller are imported into VCF Operations manually.

Or if this is not possible, then the VCF Operations Active Directory integration must be configured to contact a single Domain Controller instead.

Additionally, the following steps can also be followed to address the issue:

• Obtain the Root and Sub-Root (Intermediate) CA certificates for your Active Directory environment.
• Log in to VCF Operations.
• Navigate to Administration > Control Panel > Trusted Certificates.
• Click Import and upload the Root CA certificate. Repeat for any Sub-Root certificates.

Note: If you encounter any issues while importing the certificate, please refer to the Configure LDAP/AD Authentication Source with SSL for troubleshooting guidance.

• Navigate to Administration > Authentication Sources.
• Edit the AD integration. (Note: Ensure that the 'Use SSL/TLS' checkbox is selected for LDAPS (Lightweight Directory Access Protocol over SSL/TLS))
• Ensure the Host FQDN field uses the correct FQDN.
• Click Test Connection. Accept any newly prompted leaf certificates and Save the configuration. Test the connection multiple times to accept all the leaf certificates if there are multiple Domain Controllers.

Additional Information

Review article Certificate overview for VMware Aria Operations section 'Adapter and authentication sources' for more information on endpoint certificates and potential caveats.

Active Directory integration fails with "Test unsuccessful for ldap: Invalid Credentials" error in VCF Operations

AD integration is not working, returning "Invalid credentials" error