Active Directory authentication fails with Invalid Username or Password when using OU in Base DN

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

• After integrating Active Directory (AD) with VMware Identity Manager, users were unable to log in using their domain credentials.
  • The login attempts resulted in an "invalid username or password" error in the UI. 
• Authentication fails with the below error when using Postman or curl to retrieve access tokens.

  • REST error received: {"error": "invalid_grant", "error_description": "Invalid username or password"}, status code: 400 BAD_REQUEST

• The /opt/vmware/horizon/workspace/logs/connector.log may contain an error similar to:

  • The account does not exist under base DN [Incorrect DN]

Environment

VMware Identity Manager 3.3.x

Cause

• The issue could be due to the Base DN been set to a specific Organizational Unit (OU) in the VMware Identity Manager directory configuration
  • For example (OU=Users,DC=example,DC=com).
  • When an OU is specified in the Base DN, VMware Identity Manager limits its LDAP search scope to that specific OU and its sub-OUs.
  • If the user attempting to log in does not reside within that defined OU hierarchy, VMware Identity Manager is unable to locate the user object and subsequently fails to authenticate the login request.

Resolution

To resolve the issue, please follow the below steps:

1. Take a non memory snapshot of VMware Identity Manager.
2. Log in to the VMware Identity Manager admin console.
3. Navigate to Identity & Access Management > Directories.
4. Scroll down to locate Base DN.
5. Update the Base DN to use the domain-level format.
   • For example: DC=example,DC=com
6. Save the configuration

This configuration allows VMware Identity Manager to perform LDAP searches across the entire directory structure and authenticate users correctly, regardless of their OU location.