Unable to get refresh token to make API calls in Aria Automation.

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

• Unable to get refresh token to make API calls in Aria Automation.
• Receive error in Postman and also in identity-service-app logs
  • 400 Bad Request
  • invalid_grant
  • Invalid username or password

• In the vIDM UI when trying to "Test Connection" for the LDAP AD intergration an error is shown:
  
  • "Connector communication failed because of invalid data: The specified Bind DN and password could not be used to successfully authenticate against the directory."

           

• Error in the /opt/vmware/horizon/workspace/logs/connector-dir-sync.log is similar to below:

        ERROR (pool-####-thread-#) [;;;] com.vmware.horizon.directory.ldap.TrustedForestSearchService - Could not get value of RootDSE. Unable to get ObjectSid value for domain component of current directory settings.
        com.vmware.horizon.directory.DirectoryServiceException: Authentication failed for the given user name and password
           at com.vmware.horizon.directory.ldap.LdapConnector.createLdapContext(LdapConnector.java:####) ~[adapter-ldap-0.1.jar:3.3.7.0 Build 21173100]
           at com.vmware.horizon.directory.ldap.DirectoryHostResolutionService.setHostWhenUsingSrv(DirectoryHostResolutionService.java:##) ~[adapter-ldap-0.1.jar:3.3.7.0 Build 21173100]
      Caused by: com.vmware.horizon.directory.ldap.exceptions.KerberosAuthenticationException: Authentication failed for the given user name and password
           at com.vmware.horizon.directory.ldap.dc.service.KerberosConnectServiceWithOptimizedKDCLookup.getKerberosAuthenticatedSubject(KerberosConnectServiceWithOptimizedKDCLookup.java:###) ~[adapter-ldap-0.1.jar:3.3.7.0 Build 21173100]
           at com.vmware.horizon.directory.ldap.dc.service.DirectoryConnectService.getLdapContextForIwaDirectoryWithoutProvidedADHost(DirectoryConnectService.java:##) ~[adapter-ldap-0.1.jar:3.3.7.0 Build 21173100]
            ... 15 more
      Caused by: javax. security. auth. login. LoginException: KDC has no support for encryption type (14)
         at com. sun. security. auth. module.Krb5LoginModule. attemptAuthentication (Unknown Source) ~[jdk. security. auth: ?]  
            

 

 

 

Environment

Aria Automation 8.x

vIDM 3.3.x

Cause

• Permissions have been changed on the Bind user.

      OR

• Bind user was moved to a different OU without read permissions.

      OR

• Incorrect credentials of the Bind User 

 

Resolution

Please validate the user credentials and review the permissions of the Bind account and allow access to perform account searches in Active Directory.