VNX: The LDAP Settings Were Not Successfully Installed from The FILE Side

Customer configures ldaps for Unisphere login on VNX array.

Customer configured LDAPS for Unisphere login on VNX array, after that, customer can log in to Unisphere using LDAPS, the LDAPS server is Windows AD. But there is an Error message in the Unisphere alarm page.

[nasadmin@XXX-VNX5400-CS0 log]$ nas_logviewer sys_log|grep -i 748f
Aug 18 10:31:39 2016:CS_PLATFORM:NaviEventMonitor:ERROR:3:::::VNX Storage Array event number 0x748f Host XXX-VNX5400-SPA Storage Array N/A SP N/A SoftwareRev 7.33.8 (3.7) BaseRev 05.33.008.5.119 Description The LDAP settings were not successfully installed on the File side of the VNX.

We cannot decode the certificates through openssl.

[root@5700CS139 ldap]# openssl x509 -in /nas/http/domain/ldap/apacheDomain.primary_ldap_certificate.crt -text
unable to load certificate
2550:error:0906D064:PEM routines:PEM_read_bio:bad base64 decode:pem_lib.c:756:
[root@5700CS139 ldap]# openssl x509 -in /nas/http/domain/ldap/apacheDomain.backup_ldap_certificate.crt -text
unable to load certificate
2668:error:0906D064:PEM routines:PEM_read_bio:bad base64 decode:pem_lib.c:756:

After customer configure two ldaps servers on the VNX array, two certificates are pushed from SP to the control station.
/nas/http/domain/ldap/apacheDomain.backup_ldap_certificate.crt
/nas/http/domain/ldap/apacheDomain.primary_ldap_certificate.crt

On the control station, we cannot use openssl to decode it, the certificate is not a valid Base-64 encode X.509 certificate.

To resolve this issue:

1. Confirm that the certificate is valid.

1. User must verify the certificate (or certificate chain) for the LDAP Server.

2. An easy way to verify is, open the certificate file in a text editor. If it displays texts with "--BEGIN CERTIFICATE---" and "---END CERTIFICATE----" that is correct format. If the certificate is binary characters, the certificate is compressed and encrypted, which is why the control station could not get this properly.

3. User can open the certificate chain (usually in .p7b format) on Windows by copying to a Windows folder, then right click and Open. Under the "Details" tab -> "Copy to File" can be used to export the certificate to "Base-64 encoded X.509 (.CER)" format, which is valid format.

4. If the certificate contains many certificates inside, each certificate must be exported using above step, for example, "cert1.cer," "cert2.cer," so on

5. Log in to Unisphere and reimport these certificates to Unisphere.
   Log in to Unisphere using any global administrator (like sysadmin/global scope)
   Go to Domain -> Manage LDAP settings page > Primary > Modify > Change certificate -> "Copy as Text"
   Open previously converted certificates in notepad and copy and paste everything including the BEGIN and END Certificate lines. You must copy and paste every certificate in a chain one below another's END CERTIFICATE.
   Press OK after all copy and pastes and if we got a complete chain, Unisphere accepts without error. If not, ensure that the conversion and all certificates in the chain is obtained. Involve your Windows/Certificate Admins if required.
   Repeat the same for Backup LDAP server if configured.

2. Verify from Control Station:

1. Run the following to refresh again

   /nas/http/webui/bin/update_domain_directory.pl

2. Run the followings to ensure that the certificate can be decoded by openssl.

   openssl x509 -in /nas/http/domain/ldap/apacheDomain.primary_ldap_certificate.crt -text

   openssl x509 -in /nas/http/domain/ldap/apacheDomain.backup_ldap_certificate.crt -text

   Certificate:

   Data:
       Version: 3 (0x2)
       Serial Number:
           1c:03:b6:a7:e9:3f:9e:ac:4e:88:39:91:b9:f8:4e:2d
       Signature Algorithm: sha256WithRSAEncryption
       Issuer: DC=com, DC=vnx, CN=vnx-DC0-CA

3. Run the following and ensure no errors.

   /nas/sbin/cstadmin validate-config LDAP 'LDAP PRIMARY' -cstdir=/nas/site/cst -passphrase=$(/nas/sbin/cst_setup -getKey cst)

4. If no error on the above command, the LDAP login should work successfully on Unisphere

5. If an error like "LDAP Server is down" is reported, ensure that the "server name" is matching with what is in the certificate. If we define an IP address but certificate got "name," then we must update the LDAP Setting to hostname, not IP address, this also means that, DNS must be configured using "nas_cs -set" to resolve the hostname correctly.

6. Also ensure that the domain user is a direct member of the group that is defined in Role Mapping.

To escalate this issue (if required), you must provide the following information:

1. LDAP settings details (Bind user login name and password).
2. Certificate to be used for LDAPS.
3. A Windows user login and password details to test.

The above information is required for troubleshooting (using WebEx) by Technical Support and quotes from this article.