XtremIO: LDAP authentication failed due to ldap_bind: Invalid credentials (49)

Issues while trying to log in to the LDAP.

Getting and error that Authentication fails and it is unable to log in using LDAP credentials.

Check the XMS xms.log file and find the following example:

2016-09-01 11:14:11,382 - XmsLogger - DEBUG - executor::authenticate_external_user:8522 - checking external auth for username
2016-09-01 11:14:11,383 - XmsLogger - DEBUG - xioad2::authenticate_section:250 - TRYING ldap://ldapserver.net
2016-09-01 11:14:11,387 - XmsLogger - DEBUG - xioad2::authenticate_section:264 - ENVIRONMENT {'LDAPTLS_REQCERT': 'never'}
2016-09-01 11:14:11,387 - XmsLogger - DEBUG - xioad2::authenticate_section:266 - COMMAND 'ldapsearch' '-x' '-H' 'ldap://ldapserver.net' '-D' 'username@example.net' '-w' 'xxxxxxx' '-s' 'sub' '-
z' '10' '-l' '1500' '-b' 'OU=Infra,DC=mi,DC=example,DC=net' 'sAMAccountName=username' 'distinguishedName' 'dn'
2016-09-01 11:14:11,659 - XmsLogger - DEBUG - xioad2::authenticate_section:275 - # extended LDIF
#
# LDAPv3
# base <OU=Infra,DC=mi,DC=edeka,DC=net> with scope subtree
# filter: sAMAccountName=username
# requesting: distinguishedName dn
#
# search result
search: 2
result: 0 Success
# numResponses: 1
2016-09-01 11:14:11,974 - XmsLogger - ERROR - xmlrpc_server::authenticate_user_cb:77 - Unauthenticated user: username, IP: 10.10.81.21
2016-09-01 11:14:11,985 - XmsLogger - INFO - snmp::send_alert_trap:74 - Sending snmp alert trap: snmp version v2c alert type security object N/A
2016-09-01 11:14:11,985 - XmsLogger - INFO - snmp::send_alert_trap:77 - Trap target 10.68.10.20
2016-09-01 11:15:33,679 - XmsLogger - DEBUG - executor::authenticate_external_user:8522 - checking external auth for username@example.net
2016-09-01 11:15:33,680 - XmsLogger - DEBUG - xioad2::authenticate_section:250 - TRYING ldap://ldapbserver.net
2016-09-01 11:15:33,680 - XmsLogger - DEBUG - xioad2::authenticate_section:264 - ENVIRONMENT {'LDAPTLS_REQCERT': 'never'}
2016-09-01 11:15:33,680 - XmsLogger - DEBUG - xioad2::authenticate_section:266 - COMMAND 'ldapsearch' '-x' '-H' 'ldap://ldapbserver.net' '-D' 'username@example.net@example.net' '-w' 'xxxxxxx'
'-s' 'sub' '-z' '10' '-l' '1500' '-b' 'OU=Infra,DC=mi,DC=edeka,DC=net' 'sAMAccountName=username@example.net' 'distinguishedName' 'dn'
2016-09-01 11:15:34,011 - XmsLogger - DEBUG - xioad2::authenticate_section:275 -
2016-09-01 11:15:34,012 - XmsLogger - DEBUG - xioad2::authenticate_section:277 - ldap_bind: Invalid credentials (49)

The BIND credentials are incorrect, so the XMS is not able to connect as the Bind User to do a role or group lookup.

Correct the BIND credentials: BIND name or BIND Password

For arrays on XMS versions 6.XXX, certain special characters shown in KB article 29438: XtremIO: Invalid ASCII Characters Used for Infrastructure Authentication are not allowed when configuring the bind password using the WebUI.

The same special character limitation does not exist when configuring the bind password using the XMCLI (command line of the XMS). However, modifying the password using any of those special characters does prevent XMS Recovery from working later if needed, including situations where a new XMS is replacing an old XMS. It is highly recommended to use the WebUI when modifying the BIND password. XMCLI method for modifying password should only be used if avoiding the characters mentioned in the KB linked above.