NetWorker: authc_config scripts/commands to modify external authority fail with LDAP error 49 data 52e

• The NetWorker authentication server (AUTCH) is installed on a Linux operating system.
• The AUTHC external authority scripts or authc_config command is being used to integrate or update the NetWorker external authority resource.
• The script fails with due to incorrect service account password:

/opt/nsr/authc-server/scripts/authc-create-ad-config.sh
Enter password:
Error executing command. Failure: 400 Bad Request. Server message: Failed to verify configuration lab: An authentication error occurred while accessing the naming or directory service: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C090421, comment: AcceptSecurityContext error, data 52e, v23f0]

• The password is correct, the same credentials can be used to successfully authenticate on another system.

There is an operating system security setting preventing the password from being specified as plain text; subsequently, this impacts the AD and LDAP configuration scripts and commands. The bind account password must be specified in the authc_config command when creating or modifying the external authority resource.

There are two options available.

Option 1:

Use the NetWorker Management Console (NMC) or NetWorker Web User Interface (NWUI) to integrate AD or LDAP with the NetWorker server:

• NetWorker: How To Set up AD/LDAP Authentication
• NetWorker: How to configure "AD over SSL" (LDAPS) from The NetWorker Web User Interface (NWUI)

The user interface methods are not impacted by this symptom since no password is being specified as plain text on a shell prompt.

Option 2:

1. Confirm that the credentials are correct without using NetWorker (for example: ldapsearch).

Syntax:

ldapsearch [-V[V]] [-d debuglevel] [-n] [-v] [-c] [-u] [-t[t]] [-T path] [-F prefix] [-A] [-L[L[L]]] [-S attribute] [-b searchbase] [-s {base|one|sub|children}] [-a {never|always|search|find}] [-l timelimit] [-z sizelimit] [-f file] [-M[M]] [-x] [-D binddn] [-W] [-w passwd] [-y passwdfile] [-H ldapuri] [-h ldaphost] [-p ldapport] [-P {2|3}] [-e [!]ext[=extparam]] [-E [!]ext[=extparam]] [-o opt[=optparam]] [-O security-properties] [-I] [-Q] [-N] [-U authcid] [-R realm] [-X authzid] [-Y mech] [-Z[Z]] filter [attrs...]

Example:

ldapsearch -h dc -D "amer\Administrator" -x -W > ldap_details.txt
Enter LDAP Password: ************

head ldap_details.txt
# extended LDIF
#
# LDAPv3
# base <dc=amer,dc=lan> (default) with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#
# amer.lan
dn: DC=amer,DC=lan

PASSWD=`cat /.sapass.txt`

authc_config -u administrator  -e add-config \
-D "config-tenant-id=1" \
-D "config-active-directory=y" \
-D "config-name=amerad" \
-D "config-domain=amer.lan" \
-D "config-server-address=ldap://dc.amer.lan:389/DC=amer,DC=lan" \
-D "config-user-dn=CN=Administrator,CN=Users,DC=amer,DC=lan" \
-D "config-user-dn-password=$PASSWD" \
-D "config-user-search-path=CN=Users" \
-D "config-user-id-attr=sAMAccountName" \
-D "config-user-object-class=user" \
-D "config-group-search-path=CN=NetWorker Admins" \
-D "config-group-name-attr=cn" \
-D "config-group-object-class=group" \
-D "config-group-member-attr=member" \
-D "config-user-search-filter=" \
-D "config-group-search-filter=" \
-D "config-search-subtree=y" \
-D "config-user-group-attr=memberOf" \
-D "config-object-class=objectClass"

/opt/nsr/authc-server/scripts/authc-create-ad-config.sh
Enter password: ************
Configuration amerad is created successfully.

nsrlogin -t default -d amer.lan -u bkupadmin
130136:nsrlogin: Please enter password:
Authentication succeeded

nsrlogout