由于(强制实施)通道绑定,使用安全 LDAP 的操作失败
适用场景
- ONTAP 9
- Microsoft LDAP服务器
- 安全LDAP
- LDAPS
- Start-TLS
问题描述
- 需要在ONTAP 和MS LDAP服务器之间建立LDAP连接的操作(例如、AD站点发现)将失败。
- 更改文件上的ACL (Windows客户端上的错误消息)
cannot determine whether the computer is joined to a domain
- 在端口636上启用LDAP客户端
vserver services name-service ldap client modify
失败 -
LDAP服务器需要设置用户绑定参数
[-bind-dn <ldap_dn>] - Bind DN (User)
- 在EMS和SECD日志中
Invalid credentials
、这些日志似乎与启动安全LDAP连接时的故障相关。
EMS
secd: secd.conn.auth.failure:notice]: Vserver (<vserver>) could not authenticate over the network to server (
). Error: Invalid credentials (Service: LDAP (Active Directory), Operation: SiteDiscovery).
- 根据使用的是LDAPS还是START-TLS、它在SECD日志中的表现形式会略有不同。
SECD (用于AD LDAP连接的LDAPS)
00000013.007e944b 0fc9a7d2 Mon Nov 02 2020 06:14:14 +01:00 [kern_secd:info:8211] Failure Summary:
00000013.007e944c 0fc9a7d2 Mon Nov 02 2020 06:14:14 +01:00 [kern_secd:info:8211] Error: User authentication procedure failed
00000013.007e944d 0fc9a7d2 Mon Nov 02 2020 06:14:14 +01:00 [kern_secd:info:8211] CIFS SMB2 Share mapping - Client Ip = 1.2.3.4
00000013.007e944e 0fc9a7d2 Mon Nov 02 2020 06:14:14 +01:00 [kern_secd:info:8211] ...
00000013.007e944f 0fc9a7d2 Mon Nov 02 2020 06:14:14 +01:00 [kern_secd:info:8211] [ 9988] Successfully connected to ip 1.2.3.51, port 636 using TCP
00000013.007e9450 0fc9a7d2 Mon Nov 02 2020 06:14:14 +01:00 [kern_secd:info:8211] [ 10202] Unable to start LDAPS: Invalid credentials
00000013.007e9451 0fc9a7d2 Mon Nov 02 2020 06:14:14 +01:00 [kern_secd:info:8211] [ 10202] Additional info: 80090346: LdapErr: DSID-0C090588, comment: AcceptSecurityContext error, data 80090346, v2580
00000013.007e9452 0fc9a7d2 Mon Nov 02 2020 06:14:14 +01:00 [kern_secd:info:8211] [ 10202] Unable to connect to LDAP (Active Directory) service on <server.domain> (Error: Invalid credentials)
up.
SECD (用于AD LDAP连接的START-TLS)
00000013.007e944b 0fc9a7d2 Mon Nov 02 2020 06:14:14 +01:00 [kern_secd:info:8211] Failure Summary:
00000013.007e944c 0fc9a7d2 Mon Nov 02 2020 06:14:14 +01:00 [kern_secd:info:8211] Error: User authentication procedure failed
00000013.007e944d 0fc9a7d2 Mon Nov 02 2020 06:14:14 +01:00 [kern_secd:info:8211] CIFS SMB2 Share mapping - Client Ip = 1.2.3.4
00000013.007e944e 0fc9a7d2 Mon Nov 02 2020 06:14:14 +01:00 [kern_secd:info:8211] ...
00000013.007e944f 0fc9a7d2 Mon Nov 02 2020 06:14:14 +01:00 [kern_secd:info:8211] [ 9988] Successfully connected to ip 1.2.3.51, port 389 using TCP
00000013.007e9450 0fc9a7d2 Mon Nov 02 2020 06:14:14 +01:00 [kern_secd:info:8211] [ 10202] Unable to start LDAPS: Invalid credentials
00000013.007e9452 0fc9a7d2 Mon Nov 02 2020 06:14:14 +01:00 [kern_secd:info:8211] [ 10202] Unable to connect to LDAP (Active Directory) service on <server.domain> (Error: Invalid credentials)