Login to Univiewer of LDAP users is no longer working after upgrading UVMS

Products

• CA Automic Dollar Universe

Issue/Introduction

After upgrading UVMS to version 6.3.41 or 6.4.01, the Ldap authentication without any changes in the ldap settings will fail.

On UVC, when login using a LDAP user, the authentication fails with the following popup error message:

================================================
The server cannot be reached: LDAP Access denied
================================================

On UVMS, when launching unicheckldap, we see that the user is no longer found:

<uvms_dir>/app/bin/unicheckldap -login username -password XXXX
UniViewer Management Server environment loaded.

UVMS configured with INTERNAL authentication.

Loading ldap.xml
********************
ldap.xml loaded. 1 configuration(s) found(s)
********************

Checking configuration: [LDAP Repository]:
Host: ldap_server Port: 389 SSL: false

---------------------------------------------
supported SASL mechanisms:
 + GSSAPI
 + GSS-SPNEGO
 + EXTERNAL
 + DIGEST-MD5
DIGEST-MD5 mechanism supported.
---------------------------------------------
SUCCESS Host: domain.com configuration is OK
 User search filter: (samaccountname=!login!)
 User list search filter: objectclass=person
 Group list search filter: (objectClass=group)
 Nested group: false
 Referral: false
FAILURE Login: username not found on the LDAP server
********************

Cause

Cause type: Defect
Root Cause: If the UserSearchBase field in ldap.xml is configured without selecting a OU or CN like OU=Users,DC=domain,DC=com
Following the upgrade of UVMS, the users can't be found.

Resolution

Solution:

Update to a fix version listed below or a newer version if available.

Fix Version(s):
Component: Univiewer.Management.Server
Version: Dollar.Universe 6.4.21

Additional Information

We have two workarounds if you have to stay in 6.3.41 or 6.4.01:

a) In case all your users on the LDAP are stored on the same folder:

-- Configuring the UserSearchBase to start with a sub-tree of the LDAP tree like

CN=Users, DC=domain,DC=com
or
OU=Users, DC=domain,DC=com


The choice may depend on the structure of the LDAP tree.

b) In case the users on the LDAP are stored on different folders:

Edit the file ldap.xml and set followReferral to YES

Warning: In case there are many users / groups on the LDAP, this could slow down the performance of the queries to the LDAP since we will have to look on the whole tree instead of only several folders.