返回
-
标题
LDAP login fails but Test Configuration works -
说明
When using Test Configuration in the Directory Services Settings dashboard, the user account is found successfully. But trying to use that same account to log into Foglight fails to authenticate.
Enabling debug level for the com.quest.nitro.service.security.auth.spi.NitroExtendedLdapLoginModule class (see internal KB 4320862) reveals an LDAP error:
javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: ldapErr: DSID-0C090439, comment: AcceptSecurityContext error, data 568, v4563 ]
Domain controller also shows a login error with status code: 0xC000015A. -
原因
This LDAP error code 49 data 568 corresponds to ERROR_TOO_MANY_CONTEXT_IDS.
This generally means that there are more than 1010 groups that this user is a member of.
Microsoft published this issue in their docs with diagnostics and a couple of workarounds, but these should be reviewed and implemented by the Active Directory administrators for the affected domain.
How to determine how many SIDs are in the token for a specific user from a Domain Controller with AD Management Tools installed.- Open a Command Prompt
- Run dsmgmt
- Input gro mem eva
- Input run DOMAIN_NAME USERNAME
- To exit, input quit
-
解决办法
Microsoft published this issue in their docs with diagnostics and methods for resolution, but these should be reviewed and implemented by the Active Directory administrators for the affected domain. These solutions aim to reduce the number of security groups that the user is a member of by segregating domains or users.
Alternatively, consider implementing SAML 2.0 authentication on Foglight to avoid this issue.