Invalid Credentials when logging into Harvest SCM via LDAP
Article ID: 448316
Updated On:
Products
Issue/Introduction
Harvest administrator is able to login to Harvest Workbench and Admin tool using an LDAP account, but other users are not successful. Error message returns "Invalid Credentials". After several attempts, the LDAP account gets locked out, confirming that LDAP rejects the authentication.
Environment
CA Harvest Software Change Manager
LDAP / Active Directory
Cause
Authentication succeeds for some users but fails for others when LDAP server rules, attribute mismatches, or search filter restrictions prevent specific accounts from being validated. Since the account locks out in LDAP, the Harvest Broker is successfully communicating with the LDAP server, but the server rejects the provided credentials for those specific users.
Resolution
Follow these steps to identify the discrepancy between working and non-working accounts:
- Use the
hauthtstutility from the Harvest broker machine to test authentication for a failing user independently of the broker. - Verify that failing users reside within the Organizational Unit (OU) specified in the
-ldapbasednparameter in theHServer.argfile. - Confirm the
-ldapattrusrnameattribute inHServer.arg(typicallysAMAccountName) matches the format users enter during login. - Review LDAP server security logs for error code 49 to identify specific subcodes (e.g., 52e for invalid credentials, 533 for disabled account).
- Compare LDAP object attributes of a working user against a failing user to identify missing or restricted attributes.
Additional Information
Feedback
