Unable to SSH into Management Center using LDAP credentials

Products

• Management Center
• Management Center - VA

Issue/Introduction

When attempting to log in to the Management Center (MC) CLI or SSH interface using LDAP user, the users receive an "Access Denied" error, even though LDAP authentication works correctly for the Web UI.

You will see below errors in the logs:

LoginName <user> does not exist in CDB for the given Realm name localRealm
Unexpected HTTP server response code '403' from MC HTTPS API endpoint

Cause

Management Center features a security restriction called security allowed-hosts.
If configured, this feature strictly limits network requests to authorized hosts.
The internal CLI authentication service makes API calls to the local system (127.0.0.1).
If 127.0.0.1 or localhost is not explicitly added to the allowed-hosts list, the system blocks the local authentication call, resulting in a 403 Forbidden/Access Denied error for CLI/SSH logins.

 

Resolution

To resolve this issue, add the local loopback address to the allowed hosts list via the CLI:

1. Log in to the Management Center Web UI.
2. Access the CLI terminal directly from the Web UI.
3. Enter configuration mode:
   mc> enable
   Password: *******
   mc#conf t
   
4. Add the local host IP to the allowed list:

     mc(config)# security allowed-hosts add 127.0.0.1

Note: After adding the loopback address, the MC will restart automatically.