LDAP login fails but Test Configuration works (4369894)

Return

Feedback Submitted

Did this article solve an issue for you?

Select Rating

Title

LDAP login fails but Test Configuration works
Description
When using Test Configuration in the Directory Services Settings dashboard, the user account is found successfully. But trying to use that same account to log into Foglight fails to authenticate.

Enabling debug level for the com.quest.nitro.service.security.auth.spi.NitroExtendedLdapLoginModule class (see internal KB 4320862) reveals an LDAP error:
```
javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: ldapErr: DSID-0C090439, comment: AcceptSecurityContext error, data 568, v4563 ]
```
Domain controller also shows a login error with status code: 0xC000015A.
Cause
This LDAP error code 49 data 568 corresponds to ERROR_TOO_MANY_CONTEXT_IDS.

This generally means that there are more than 1010 groups that this user is a member of.

Microsoft published this issue in their docs with diagnostics and a couple of workarounds, but these should be reviewed and implemented by the Active Directory administrators for the affected domain.

How to determine how many SIDs are in the token for a specific user from a Domain Controller with AD Management Tools installed.
1. Open a Command Prompt
2. Run dsmgmt
3. Input gro mem eva
4. Input run DOMAIN_NAME USERNAME
5. To exit, input quit
These steps generate a tsv file with the SIDs in the token.
Resolution

Microsoft published this issue in their docs with diagnostics and methods for resolution, but these should be reviewed and implemented by the Active Directory administrators for the affected domain. These solutions aim to reduce the number of security groups that the user is a member of by segregating domains or users.

Alternatively, consider implementing SAML 2.0 authentication on Foglight to avoid this issue.

Feedback Submitted

Did this article solve an issue for you?

Select Rating

Request a KB Article

LDAP login fails but Test Configuration works (4369894)

Title

Description

Cause

Resolution

Leave a Comment