Symantec Identity Governance 15.0 failing with AD Authentication

Products

• CA Identity Suite

Issue/Introduction

After upgrading the Identity Governance from 14.5.1 to V15.0, the AD Authentication stopped working; it is failing with the error below.

 ERROR [stderr] (default task-24) org.springframework.ldap.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C09055B, comment: AcceptSecurityContext error, data 52e, v65f4]

ERROR [com.eurekify.web.Login] (default task-24) Invalid Login Details. [GENPRT007]com.eurekify.security.AuthenticationException: Failed to authenticate LFAD\B926PB against LDAP. Check your username/password...

This Environment was working fine in IG 14.5.1

 

Environment

IGA 15.0

Cause

 In 14.5.1, Identity Governance uses the older Acegi Security framework. As part of the technology stack upgrade in 15.0.0, IG has moved to the spring-ldap-core security framework.

Resolution

 This issue is reported to the Engineering team, and they are actively working to fix the issue. They identified that 14.5.1 performed a Direct Bind to Active Directory, whereas the new 15.0.0 implementation defaults to a Search-and-Bind approach. Due to this architectural change, the authentication is failing due to reasons like strict search base, search filter, and lookup attribute.

The team is working on the required changes to ensure the exact 14.5.1 AD authentication behavior (including domain padding, multi-domain routing, and direct binding) is respected and maintained in 15.0.0.

This issue is addressed in IGA 15.0 Fixpack 6 release. After applying it, the IG is getting authenticated with AD successfully.

Additional Information

Please refer to DE669143