AD integration is not working, returning "Invalid credentials" error

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

1. You are adding an Active Directory (AD) authentication source in Aria Operations.

2. The credentials are valid, and you can log in to your AD server with the credentials.

3. You are experiencing an error "Test unsuccessful for ldap:example.com. Invalid Credentials" when testing the connection of the configuration.

4. The following log trace is observed in /storage/vcops/log/web.log:

YYYY-MM-DDTHH:MM:SS,894+0000 ERROR [ajp-nio-127.0.0.1-8009-exec-98] com.vmware.vcops.ui.action.UtilityAction.execute - JavaScript Error - Msg:Uncaught Error: You're trying to decode an invalid JSON String: [{"functionName":"testLdapConnection","succeededPartially":false,"errorMessage":"Test unsuccessful for ldap: example.com. [LDAP: error code 52 - 00000000: LdapErr: DSID-0C0916C7, comment: Error initializing SSL/TLS, data 0, v4f7c^@]"}], Url: https://#.#.#.#/vcf-operations/plug/ops/lib/extjs6.6/core/ext-all.js, Line: 11

5. You get a "Can't contact LDAP server" response when running the following command on the Aria Operations primary node:

ldapsearch -x -H ldaps://domain.com -W -b"DC=domain,DC=com" "CN=*" SAMAccountName userPrincipleName -D "DOMAIN\username"

Note: Replace domain.com with the actual domain, and replace DOMAIN\username (upper cases for DOMAIN) with the user for the integration.

Example:

 

6. There is no SSL cert shown for the AD server when running the following command on the Aria Operations primary node:

 openssl s_client -showcerts -connect domain.com:636

Example:

Environment

Aria Operations 8.18.x

Cause

An SSL connection is required by the LDAP/AD server. But the LDAP/AD server does not present an SSL cert for the connection with Aria Operations.

 

Resolution

Note: The following resolution requires users' configuration on the LDAP/AD server, which is out of Broadcom Global Support's scope.

1. Turn off the SSL requirement on the LDAP/AD server.

or

2. If you prefer to enable the SSL requirement, create an SSL cert for the LDAP/AD server for the SSL connection with Aria Operations.