Intermittent vIDM Login and Directory Connection Failures due to LDAPS Certificate Mismatch

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

• You may experience intermittent or complete login failures when attempting to authenticate through VMware Identity Manager. When this occurs, the user interface or authentication logs will display the following error message:

  call to directory service failed

• /opt/vmware/horizon/workspace/logs/connector.log will report following error

  Caused by: com. vmware.horizon. directory. DirectoryServiceException: Directory connectivity or configuration error (Err #002a)
  . . 
  Caused by: javax. net . ss1 . SSLHandshakeException
  . . 
  Caused by: java. security. cert. CertificateException
  . . 

Environment

VMware Identity Manager 3.3.7

Cause

This issue occurs when Active Directory Domain Controllers has different LDAPS certificates being served across various Domain Controllers. If VMware Identity Manager is only configured to trust a single specific certificate, it will fail the SSL handshake when attempting to connect to a Domain Controller that serves a different, yet valid, certificate.

Resolution

Prerequisite : Obtain all the required Root CA certificates for your configured Domain Controllers

Update the VMware Identity Manager directory configuration to include the certificate chain for all active Domain Controller certificates.

1. Take a non memory snapshot of vIDM nodes

2. Log in to the VMware Identity Manager administration console.

3. Navigate to Identity & Access Management > Directories.

4. Select your Active Directory to edit the configuration.

5. In the SSL Certificate section, add all the certificates one after another. Make sure each certificate is in the PEM format with the delimiter lines 'BEGIN CERTIFICATE' and 'END CERTIFICATE'.

6. Save the configuration and click Test Connection to verify that the directory service connects successfully.