Open LDAP Fails with Permission Denied and Certificate Verification Error in Usage Meter 9.1

Products

• VMware Usage Meter

Issue/Introduction

• Usage Meter (UM) 9.1 integration with Open LDAP (Oracle Unified Directory) fails to authenticate users. The nslcd debug logs indicate repeated failed bind attempts, returning the following error: 
  

  failed to bind to LDAP server ldaps://<LDAP_IP>:636/: Can't contact LDAP server: Permission denied

• Additionally, testing the connection via 'openssl s_client' returns TLS SNI failures 'Can't use SSL_get_servername' and the following verification code:
  

  Verify return code: 19 (self-signed certificate in certificate chain)

Environment

• Usage Meter 9.1
• Oracle Unified Directory (LDAPS)

Cause

The LDAPS bind is rejected due to a TLS certificate verification failure. This is caused by a misconfiguration in 'nslcd.conf' where 'tls_cacertfile' incorrectly points to a Java KeyStore (JKS) binary instead of a required PEM-formatted certificate.

Additionally, an SNI mismatch occurs because the uri is configured with an IP address instead of a Fully Qualified Domain Name (FQDN), and the Root CA is untrusted by the appliance.

Resolution

1. Obtain the internal Root CA certificate from the directory team in PEM format (.pem or .crt).

2. Place the certificate file on the Usage Meter appliance at /etc/ssl/certs/<ca-certificate>.pem.

3. Set the correct ownership and permissions for the certificate file by running the following commands:

   • chown root:root /etc/ssl/certs/<ca-certificate>.pem 
     chmod 644 /etc/ssl/certs/<ca-certificate>.pem

4. Edit the '/etc/nslcd.conf' file to remove or comment out the incorrect 'tls_cacertdir' and 'tls_cacertfile' entries that point to the JKS directory.

5. Add the correct path to the PEM certificate in '/etc/nslcd.conf': 'tls_cacertfile /etc/ssl/certs/<ca-certificate>.pem'

6. Add or uncomment the following line to enforce certificate validation: 'tls_reqcert demand'

7. Change the 'uri' parameter in '/etc/nslcd.conf' to use the FQDN instead of the IP address (e.g., uri ldaps://LDAP_FQDN/).

8. Restart the 'nslcd' service to apply the configuration changes:

   • systemctl restart nslcd

9. Instruct users to log in using their uidNumber standard UID format, without appending a domain suffix.