mbertolina opened a new issue, #14061:
URL: https://github.com/apache/cloudstack/issues/14061
### problem
LDAP authentication stopped working after upgrading to 4.23, reporting the
below java exceptions.
This feature was working before the upgrade, CA and ldap server certificates
are added to "ldap.keystore" defined in the configuration and in the systemwide
keystores.
```
2026-09-04 20:54:27,086 INFO [o.a.c.l.LdapContextFactory]
(qtp1390913202-453:[ctx-cc4e4ab8]) (logid:235b6ae1) LDAP SSL enabled.
2026-09-04 20:54:27,107 DEBUG [o.a.c.l.LdapContextFactory]
(qtp1390913202-453:[ctx-cc4e4ab8]) (logid:235b6ae1) initializing ldap with
provider url: ldaps://ldap.test.com:636
2026-09-04 20:54:27,125 TRACE [c.c.u.n.NioServer]
(AgentManager-NioConnectionHandler-1:[]) (logid:) Keys Processing: 0
2026-09-04 20:54:27,125 TRACE [c.c.u.n.NioServer]
(AgentManager-NioConnectionHandler-1:[]) (logid:) Keys Done Processing.
2026-09-04 20:54:27,175 TRACE [c.c.u.n.NioServer]
(AgentManager-NioConnectionHandler-1:[]) (logid:) Keys Processing: 0
2026-09-04 20:54:27,175 TRACE [c.c.u.n.NioServer]
(AgentManager-NioConnectionHandler-1:[]) (logid:) Keys Done Processing.
2026-09-04 20:54:27,225 TRACE [c.c.u.n.NioServer]
(AgentManager-NioConnectionHandler-1:[]) (logid:) Keys Processing: 0
2026-09-04 20:54:27,226 TRACE [c.c.u.n.NioServer]
(AgentManager-NioConnectionHandler-1:[]) (logid:) Keys Done Processing.
2026-09-04 20:54:27,276 TRACE [c.c.u.n.NioServer]
(AgentManager-NioConnectionHandler-1:[]) (logid:) Keys Processing: 0
2026-09-04 20:54:27,276 TRACE [c.c.u.n.NioServer]
(AgentManager-NioConnectionHandler-1:[]) (logid:) Keys Done Processing.
2026-09-04 20:54:27,305 DEBUG [o.a.c.l.LdapManagerImpl]
(qtp1390913202-453:[ctx-cc4e4ab8]) (logid:235b6ae1) LDAP Exception:
javax.naming.CommunicationException: simple bind failed: ldap.test.com:636
[Root exception is javax.net.ssl.SSLHandshakeException: (certificate_unknown)
PKIX path building failed:
sun.security.provider.certpath.SunCertPathBuilderException: unable to find
valid certification path to requested target]
at
java.naming/com.sun.jndi.ldap.LdapClient.authenticate(LdapClient.java:219)
at java.naming/com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2897)
at java.naming/com.sun.jndi.ldap.LdapCtx.<init>(LdapCtx.java:349)
at
java.naming/com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxFromUrl(LdapCtxFactory.java:229)
at
java.naming/com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:189)
at
java.naming/com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(LdapCtxFactory.java:247)
at
java.naming/com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(LdapCtxFactory.java:154)
at
java.naming/com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(LdapCtxFactory.java:84)
at
java.naming/javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:520)
at
java.naming/javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:305)
at
java.naming/javax.naming.InitialContext.init(InitialContext.java:236)
at
java.naming/javax.naming.ldap.InitialLdapContext.<init>(InitialLdapContext.java:154)
at
org.apache.cloudstack.ldap.LdapContextFactory.createInitialDirContext(LdapContextFactory.java:65)
at
org.apache.cloudstack.ldap.LdapContextFactory.createBindContext(LdapContextFactory.java:54)
at
org.apache.cloudstack.ldap.LdapContextFactory.createBindContext(LdapContextFactory.java:48)
at
org.apache.cloudstack.ldap.LdapManagerImpl.getUser(LdapManagerImpl.java:319)
at
org.apache.cloudstack.ldap.LdapAuthenticator.authenticate(LdapAuthenticator.java:124)
at
org.apache.cloudstack.ldap.LdapAuthenticator.authenticate(LdapAuthenticator.java:91)
at
com.cloud.user.AccountManagerImpl.getUserAccount(AccountManagerImpl.java:3137)
at
com.cloud.user.AccountManagerImpl.authenticateUser(AccountManagerImpl.java:3044)
at
java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at
java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
at
java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:569)
at
org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:344)
at
org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:198)
at
org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:163)
at
org.springframework.aop.interceptor.ExposeInvocationInterceptor.invoke(ExposeInvocationInterceptor.java:97)
at
org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:186)
at
org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:215)
at jdk.proxy3/jdk.proxy3.$Proxy104.authenticateUser(Unknown Source)
at com.cloud.api.ApiServer.loginUser(ApiServer.java:1292)
at
com.cloud.api.auth.DefaultLoginAPIAuthenticatorCmd.authenticate(DefaultLoginAPIAuthenticatorCmd.java:156)
at
com.cloud.api.ApiServlet.processRequestInContext(ApiServlet.java:303)
at com.cloud.api.ApiServlet$1.run(ApiServlet.java:191)
at
org.apache.cloudstack.managed.context.impl.DefaultManagedContext$1.call(DefaultManagedContext.java:56)
at
org.apache.cloudstack.managed.context.impl.DefaultManagedContext.callWithContext(DefaultManagedContext.java:103)
at
org.apache.cloudstack.managed.context.impl.DefaultManagedContext.runWithContext(DefaultManagedContext.java:53)
at com.cloud.api.ApiServlet.processRequest(ApiServlet.java:188)
at com.cloud.api.ApiServlet.doPost(ApiServlet.java:147)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:665)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:750)
at
org.eclipse.jetty.servlet.ServletHolder$NotAsync.service(ServletHolder.java:1450)
at
org.eclipse.jetty.servlet.ServletHolder.handle(ServletHolder.java:799)
at
org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:554)
at
org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:143)
at
org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:600)
at
org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127)
at
org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:235)
at
org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:1624)
at
org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:233)
at
org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1440)
at
org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:188)
at
org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:505)
at
org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:1594)
at
org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:186)
at
org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1355)
at
org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141)
at
org.eclipse.jetty.server.handler.gzip.GzipHandler.handle(GzipHandler.java:772)
at
org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.java:146)
at org.eclipse.jetty.server.Server.handle(Server.java:516)
at
org.eclipse.jetty.server.HttpChannel.lambda$handle$1(HttpChannel.java:487)
at
org.eclipse.jetty.server.HttpChannel.dispatch(HttpChannel.java:732)
at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:479)
at
org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:277)
at
org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:311)
at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:105)
at
org.eclipse.jetty.io.ChannelEndPoint$1.run(ChannelEndPoint.java:104)
at
org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.runTask(EatWhatYouKill.java:338)
at
org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.doProduce(EatWhatYouKill.java:315)
at
org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.tryProduce(EatWhatYouKill.java:173)
at
org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.run(EatWhatYouKill.java:131)
at
org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:409)
at
org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:883)
at
org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:1034)
at java.base/java.lang.Thread.run(Thread.java:840)
Caused by: javax.net.ssl.SSLHandshakeException: (certificate_unknown) PKIX
path building failed:
sun.security.provider.certpath.SunCertPathBuilderException: unable to find
valid certification path to requested target
at
java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131)
at
java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:383)
at
java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:326)
at
java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:321)
at
java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(CertificateMessage.java:1294)
at
java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.onConsumeCertificate(CertificateMessage.java:1169)
at
java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.consume(CertificateMessage.java:1112)
at
java.base/sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:396)
at
java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:481)
at
java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:459)
at
java.base/sun.security.ssl.TransportContext.dispatch(TransportContext.java:206)
at
java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:172)
at
java.base/sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1509)
at
java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1424)
at
java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:455)
at
java.base/sun.security.ssl.SSLSocketImpl.ensureNegotiated(SSLSocketImpl.java:925)
at
java.base/sun.security.ssl.SSLSocketImpl$AppOutputStream.write(SSLSocketImpl.java:1295)
at
java.base/java.io.BufferedOutputStream.flushBuffer(BufferedOutputStream.java:81)
at
java.base/java.io.BufferedOutputStream.flush(BufferedOutputStream.java:142)
at
java.naming/com.sun.jndi.ldap.Connection.writeRequest(Connection.java:418)
at
java.naming/com.sun.jndi.ldap.Connection.writeRequest(Connection.java:391)
at
java.naming/com.sun.jndi.ldap.LdapClient.ldapBind(LdapClient.java:359)
at
java.naming/com.sun.jndi.ldap.LdapClient.authenticate(LdapClient.java:214)
... 76 more
Caused by: sun.security.validator.ValidatorException: PKIX path building
failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to
find valid certification path to requested target
at
java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:439)
at
java.base/sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:306)
at
java.base/sun.security.validator.Validator.validate(Validator.java:264)
at
java.base/sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:231)
at
java.base/sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:132)
at
java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(CertificateMessage.java:1278)
... 94 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException:
unable to find valid certification path to requested target
at
java.base/sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:148)
at
java.base/sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:129)
at
java.base/java.security.cert.CertPathBuilder.build(CertPathBuilder.java:297)
at
java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:434)
... 99 more
```
### versions
ACS: 4.23.0.0
Ldap ssl enabled
Redhat 9
### The steps to reproduce the bug
1.
2.
3.
...
### What to do about it?
_No response_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
