LDAP Error 49: Active Directory Account Management Fails in Provisioning Manager - Identity Manager

Products

• CA Identity Manager

Issue/Introduction

Identity Manager may fail to manage Active Directory (ADS) accounts, resulting in synchronization errors, password update failures, or an inability to access the ADS Explore/Correlate page. The logs under ../ProvisioningServer/logs/ADS indicate an LDAP binding failure: ldap_simple_bind_s() .....ERROR: 49 / Invalid Credentials.

Environment

Identity Manager 14.5

Cause

This issue occurs when the Provisioning Manager GUI fails to properly propagate credential updates to the endpoint. Even if the password appears correct in the UI, the back-end Provisioning Server cache or configuration may be desynchronized, causing LDAP authentication failures.

Resolution

If the Update button in the Provisioning Manager fails to resolve the issue, force the credential update using the etautil command-line utility.

1. Verify the error in the ADS logs (../ProvisioningServer/logs/ADS) to confirm the Error: 49 (Invalid Credentials) status.
2. Open a command prompt on the Provisioning Server.
3. Run the following etautil command to force the update: etautil -u [SuperUserLogin] -p [Password] update 'eTNamespaceName=ActiveDirectory' eTADSDirectory eTADSDirectoryName='[Your_ADS_EndpointName]' eTADSAuthPwd='[The_New_Password]'
4. Close the Provisioning Manager.
5. Restart the Provisioning Server service to clear the internal cache and apply the changes.
6. Verify connectivity by attempting to perform an Explore/Correlate operation in the Provisioning Manager.

Additional Information

To speak with a customer representative or a Support Engineer see Contact Support. Scroll to the bottom of the page and click on your respective region.