VCF Operations for Network LDAP Authentication Fails When Adding Identity Source.

Products

• VCF Operations for Networks

Issue/Introduction

When attempting to add an LDAP identity source in VCF Operations for Network, the configuration fails with the error “LDAP authentication failed.”
The same LDAP configuration was previously working on an older vRNI instance in the same environment.

The issue is observed when using LDAPS (port 636). Switching the configuration to LDAP (port 389) allows the identity source to be added successfully.

Environment

VCF Operations for Networks 6.13.0
VCF Operations for Networks 6.14.0

VCF Operations for Networks 6.14.1

Cause

LDAPS (port 636) traffic was blocked or SSL trust was not established between VCF Operations for Network and the LDAP server.
LDAP over port 389 was allowed through the firewall and therefore succeeded.

The VCF Operations for Network appliance does not allow direct testing of SSL connectivity (e.g., openssl, nc), so certificate and port validation cannot be performed from the node itself.

Resolution

- Modify firewall/security policy to allow LDAP (389) and/or LDAPS (636) from all VCF Operations for Network nodes to the LDAP server.
- Add the identity source using port 389 to temporarily restore authentication.
- If LDAPS is required, ensure:

• Port 636 is open end-to-end

• LDAP server certificate is trusted by VCF Operations for Network 

• Certificate chain is imported into VCF Operations for Network if required

Once port 389 was enabled in the network security rule, LDAP identity source was added successfully across all VCF Operations for Network instances.

Additional Information

• The same LDAP credentials and Base DN were confirmed to work on vROps, which validates user and directory configuration.

• The issue was reproducible only on nodes using LDAPS. Port change resolved the failure.