Active Directory integration fails with "Test unsuccessful for ldap: Invalid Credentials" error in VCF Operations

Products

• VCF Operations

Issue/Introduction

This article outlines the steps to resolve Active Directory (AD) integration issues in VCF Operations 9.1. When attempting to configure an AD authentication source via the Administration console, the system returns the error: "Test unsuccessful for ldap: <domain> Invalid Credentials." This symptom prevents the successful addition of the identity source and subsequent user authentication within the platform.

Environment

VCF Operations 9.x

Cause

The "Invalid Credentials" error during an LDAP connection test is typically caused by incorrect parameters in the Authentication Source configuration:

1. Incorrect Base DN: The provided Base Distinguished Name (DN) string does not correctly point to the directory structure, preventing the system from querying the target partition.

2. Service Account Username Format: Providing a shortname (e.g., "username") rather than a fully qualified format (e.g., "DOMAIN\username", "[email protected]", or "CN=username,DC=domain,DC=com") prevents the identity provider from successfully binding to the LDAP server, resulting in an authentication failure.

Resolution

Ensure you have administrative access to both the VCF Operations console and the Active Directory Domain Controller before proceeding.

1. Retrieve Correct Base DN:

   • Log in to the Active Directory Domain Controller or a management machine with domain tools installed.

   • Open the command prompt and execute the following command to retrieve the full path for the service account: dsquery user -name "<username>"

   • Copy the output path to use in the subsequent steps.

2. Update Authentication Source Configuration:

   • Log in to the VCF Operations console.

   • Navigate to Operate > Administration > Control Panel > Authentication Sources.

   • Locate the AD Authentication Source configuration and click Edit.

   • Base DN: Update this field with the correct path retrieved from the dsquery command.

   • User Name: Update this field from the current shortname to a fully qualified format (e.g., DOMAIN\username, [email protected], or the full DN format CN=username,DC=domain,DC=com).

3. Validate Configuration:

   • Click Test to confirm authentication is successful.

   • Once the test succeeds, click Save to commit the configuration changes.

Additional Information

If the test continues to fail after applying these corrections, review the VCF Operations support bundle for more granular error codes related to LDAP binding or certificate trust mismatches. Ensure that the service account being used has the necessary permissions within the specified Base DN to perform search and bind operations.