GitHub user anirudh09041 created a discussion: LDAP Authentication Fails with Error 531 Despite Successful LDAPS Connectivity and User Discovery (CloudStack 4.22.1.0)
<html> <body> <!--StartFragment--><html><head></head><body><h1><span>LDAP Authentication Fails with Error 531 Despite Successful LDAPS Connectivity and User Discovery (CloudStack 4.22.1.0)</span></h1><h2><span>Environment</span></h2><ul><li><p><strong><span>Apache CloudStack Version:</span></strong><span> 4.22.1.0</span></p></li><li><p><strong><span>Deployment:</span></strong><span> Three Management Servers in HA configuration</span></p></li><li><p><strong><span>LDAP Provider:</span></strong><span> Microsoft Active Directory</span></p></li><li><p><strong><span>Protocol:</span></strong><span> LDAPS</span></p></li><li><p><strong><span>LDAP Port:</span></strong><span> 636</span></p></li></ul><h2><span>Active Directory Configuration</span></h2><ul><li><p><strong><span>Domain:</span></strong><span> </span><code><span>corp.a10networks.com</span></code></p></li><li><p><strong><span>Base DN:</span></strong><span> </span><code><span>DC=corp,DC=a10networks,DC=com</span></code></p></li><li><p><strong><span>D omain Controller:</span></strong><span> </span><code><span>SJ-SV2-DC2.corp.a10networks.com</span></code></p></li><li><p><strong><span>Bind Principal:</span></strong><span> </span><code><span>[email protected]</span></code></p></li><li><p><strong><span>Username Attribute:</span></strong><span> </span><code><span>sAMAccountName</span></code></p></li><li><p><strong><span>First Name Attribute:</span></strong><span> </span><code><span>givenname</span></code></p></li><li><p><strong><span>Last Name Attribute:</span></strong><span> </span><code><span>sn</span></code></p></li><li><p><strong><span>Email Attribute:</span></strong><span> </span><code><span>mail</span></code></p></li><li><p><strong><span>LDAP Provider:</span></strong><span> </span><code><span>microsoftad</span></code></p></li></ul><p><span>The LDAP server has been added through the CloudStack UI with the following details:</span></p><ul><li><p><span>Host: </span><code><span>SJ-SV2-DC2.corp.a10networks.com</spa n></code></p></li><li><p><span>Port: </span><code><span>636</span></code></p></li></ul><h2><span>LDAP Truststore Configuration</span></h2><p><span>The CA certificate was imported into a Java JKS truststore.</span></p><p><span>Truststore location:</span></p><p><code><span>/etc/cloudstack/management/cloudstack-ldap-truststore.jks</span></code></p><p><span>CA certificate location:</span></p><p><code><span>/etc/cloudstack/management/cloudstack-root-ca.crt</span></code></p><p><span>The truststore was distributed across all three management servers.</span></p><ul><li><p><span>Truststore type: JKS</span></p></li><li><p><span>Alias: </span><code><span>corp-sj-dc01-ca</span></code></p></li><li><p><span>Ownership: </span><code><span>root:cloud</span></code></p></li><li><p><span>Permissions: </span><code><span>640</span></code></p></li></ul><p><span>The truststore is readable by the CloudStack service user on all three management servers.</span></p><h2><span>LDAP Global Settings</span></h2><p> <span>The following settings have been configured:</span></p> Setting | Value -- | -- ldap.basedn | DC=corp,DC=a10networks,DC=com ldap.bind.principal | [email protected] ldap.provider | microsoftad ldap.username.attribute | sAMAccountName ldap.firstname.attribute | givenname ldap.lastname.attribute | sn ldap.email.attribute | mail ldap.user.object | user ldap.group.object | groupOfUniqueNames ldap.group.user.uniquemember | member ldap.user.memberof.attribute | memberOf ldap.read.timeout | 100000 ldap.request.page.size | 1000 ldap.search.group.principle | CN=cloudstack-users,OU=Security-Group,OU=Groups,OU=US-HQ,DC=corp,DC=a10networks,DC=com ldap.truststore | /etc/cloudstack/management/cloudstack-ldap-truststore.jks <p><span>The LDAP truststore password and bind password have been configured but are intentionally not included here.</span></p><h2><span>Tests Performed</span></h2><h3><span>1. LDAPS Connectivity and Certificate Validation</span></h3><p><span>Successfully connected to the Domain Controller using:</span></p><p><code><span>SJ-SV2-DC2.corp.a10networks.com:636</span></code></p><p><span>Certificate validation using the CA certificate was successful.</span></p><h3><span>2. LDAP Bind Using the Service Account</span></h3><p><span>Successfully authenticated using:</span></p><p><code><span>[email protected]</span></code></p><h3><span>3. LDAP User Discovery</span></h3><p><span>A search against the configured base DN successfully returned multiple Active Directory users.</span></p><p><span>Initially, a group restriction was configured using an AD group that contained only one direct member.</span></p><p><span>After discussing this with our IT team, a new AD group was created: </span></p><p><code><span>CN=cloudstack-users,OU=Security-Group,OU=Groups,OU=US-HQ,DC=corp,DC=a10networks,DC=com</span></code></p><p><span>The group was configured in </span><code><span>ldap.search.group.principle</span></code><span>.</span></p><p><span>CloudStack now successfully discovers two users through the Add LDAP Account interface:</span></p><ul><li><p><code><span>akaushal</span></code></p></li><li><p><code><span>tdhake</span></code></p></li></ul><h3><span>4. Independent Authentication Test Using My AD Account</span></h3><p><span>I also tested LDAP authentication independently using my own AD credentials:</span></p><pre><code><span>ldapsearch -LLL -x \ -H ldaps://SJ-SV2-DC2.corp.a10networks.com:636 \ -o TLS_CACERT=/etc/cloudstack/management/cloudstack-root-ca.crt \ -D '[email protected]' \ -W \ -b 'DC=corp,DC=a10networks,DC=com' \ '(&(objectCategory=person)(objectClass=user)(sAMAccountName=akaushal))' \ dn sAMAccountName userPrincipalName</span></code></pre><p><span>This command completed successfully and returned:</span></p><pre><code><span>dn: CN=Anirudh Kaushal,OU=Users,OU=IND,DC=corp,DC=a10networks,DC=com sAMAccountName: akaushal userPrincipalName: [email protected]</span></code></pre><p><span>This confirms that the supplied AD credentials are accepted by the Domain Controller and that the user can be searched successfully.</span></p><h2><span>Current Issue</span></h2><p><span>Despite successful LDAP connectivity, service-account binding, user discovery and independent authentication testing, I am unable to log in to CloudStack using my AD credentials.</span></p><p><span>I have attempted login using both:</span></p><ul><li><p><code><span>akaushal</span></code></p></li><li><p><code><span>[email protected]</span></code></p></li></ul><p><span>The UI returns:</span></p><pre><code><span>Error 531: Failed to authenticate user akaushal in domain 1; please provide valid credentials.</span></code></pre><p><span>The LDAP user has also been added/discovered through the Add LDAP Account interface.</span></p><p><span>The CloudStack domain selected for login is </span><code><span>ROOT</span></code><span> (domain ID 1).</span></p><h2><span>Questions for the Community</span></h2><ol start="1"><li><p><span>Is there any additional configuration required for Microsoft Active Directory authentication in CloudStack 4.22.1.0, beyond configuring the LDAP server, bind principal, base DN and truststore?</span></p></li><li><p><span>Does CloudStack expect the LDAP username to be supplied as </span><code><span>sAMAccountName</span></code><span>, </span><code><span>userPrincipalName</span></code><span>, or another format during authentication?</span></p></li><li><p><span>Is there any additional mapping or configuration required between an LDAP-discovered user and a CloudStack account to enable authentication?</span></p></li><li><p><span>Could the </ span><code><span>ldap.group.object</span></code><span> setting (</span><code><span>groupOfUniqueNames</span></code><span>) cause authentication issues with Microsoft Active Directory, even though user discovery works?</span></p></li><li><p><span>Are there any known issues in CloudStack 4.22.1.0 that could cause Error 531 when LDAP connectivity and user discovery are successful?</span></p></li></ol><p><span>I would appreciate any guidance on which component or configuration I should investigate next.</span></p><p><span>Thank you.</span></p></body></html><!--EndFragment--> </body> </html> GitHub link: https://github.com/apache/cloudstack/discussions/14577 ---- This is an automatically sent email for [email protected]. To unsubscribe, please send an email to: [email protected]
