LDAP Authentication Fails Due to Renamed Organizational Unit

Products

• CA Directory

Issue/Introduction

You experience an LDAP authentication outage across your environment. This issue occurs when the Distinguished Name (DN) structure is modified, specifically when ou=people is renamed to ou=people_xyz within the directory. This article provides the verified procedure to restore the service and original configuration.

Environment

CA Directory 14.1.x

Resolution

To restore the LDAP service, perform the following recovery procedure on each impacted DSA:

1. Perform an online backup: Execute the following command to back up your current state:
     dxserver onlinebackup ####

2. Temporarily disable access configuration: Navigate to your configuration directory and modify the file servers/####.dxi. Comment out the "access" configuration lines, then restart the DSA to apply the change.

3. Update the Distinguished Name (DN): Connect to the directory using Apache Directory Studio or other LDAP Browser. Bind using a DN located under ou=people_xyz and rename the Organizational Unit back to the original ou=people.

4. Verify the change: Disconnect Apache Directory Studio or other LDAP Browser, then reconnect and confirm you can successfully bind using a DN located under the restored ou=people.

5. Re-enable access configuration: Restore your original access/####_access.dxc file. Uncomment the access configuration in the servers/####.dxi file and restart the DSA.

6. Final Verification: Using Apache Directory Studio or other LDAP Browser, verify that you can access the directory with a binding DN under ou=people across all DSA nodes and the router DSA.