AD integration is not working, returning "Invalid credentials" error

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

1. You are adding an Active Directory (AD) authentication source in Aria Operations.

2. The credentials are valid, and you can log in to your AD server with the credentials.

3. You are experiencing an error "Test unsuccessful for ldap:example.com. Invalid Credentials" when testing the connection of the configuration.

4. The following log trace is observed in /storage/vcops/log/web.log:

YYYY-MM-DDTHH:MM:SS,894+0000 ERROR [ajp-nio-127.0.0.1-8009-exec-98] com.vmware.vcops.ui.action.UtilityAction.execute - JavaScript Error - Msg:Uncaught Error: You're trying to decode an invalid JSON String: [{"functionName":"testLdapConnection","succeededPartially":false,"errorMessage":"Test unsuccessful for ldap: example.com. [LDAP: error code 52 - 00000000: LdapErr: DSID-0C0916C7, comment: Error initializing SSL/TLS, data 0, ######]"}], Url: https://#.#.#.#/vcf-operations/plug/ops/lib/extjs6.6/core/ext-all.js, Line: 11

5. You get a "Can't contact LDAP server" response when running the following command on the Aria Operations primary node:

ldapsearch -x -H ldaps://domain.com -W -b"DC=domain,DC=com" "CN=*" SAMAccountName userPrincipleName -D "DOMAIN\username"

Note: Replace domain.com with the actual domain, and replace DOMAIN\username (upper cases for DOMAIN) with the user for the integration.

Example:

 

6. There is no SSL cert shown for the AD server when running the following command on the Aria Operations primary node:

 openssl s_client -showcerts -connect domain.com:636

Example:

Environment

Aria Operations 8.18.x

Cause

• An SSL connection is required by the LDAP/AD server; however, the server is not presenting a valid SSL certificate to Aria Operations.

• This can also occur if the AD server certificate has expired, causing the LDAP SSL handshake to fail and resulting in an "Invalid credentials" error.

Resolution

Note: The following resolution requires users' configuration on the LDAP/AD server, which is out of Broadcom Global Support's scope.

1. Turn off the SSL requirement on the LDAP/AD server.

or

2. If you prefer to enable the SSL requirement, create an SSL cert for the LDAP/AD server for the SSL connection with Aria Operations.

Additional Information

To check the certificate expiration status, run the following command from the VCF Operations Primary node to validate the SSL handshake and review the certificate chain. 

openssl s_client -showcerts -connect <FQDN>:636