000031201 - Unable to create managed connection LDAP error in system activity report for RSA Authentication Manager 8.x

Document created by RSA Customer Support Employee on Jun 14, 2016•Last modified by RSA Customer Support on Jan 9, 2020
Version 3Show Document
  • Comment • 0
  • View in full screen mode

Article Content

Article Number000031201
Applies ToRSA Product Set: SecurID

RSA Product/Service Type: Authentication Manager

RSA Version/Condition: 8.x
IssueThe Directory User (or Windows account used to query the Microsoft Active Directory) used in the identity source configuration had a password change. The Directory Password was updated by an administrator in the identity source configuration.

Users are displayed when querying the identity source using the Security Console however the system activity reports the following error:
 
javax.resource.spi.ResourceAdapterInternalException: Unable to create managed connection
[LDAP: error code 49 - 80090308: LdapErr: DSID-0C0903C8, comment: AcceptSecurityContext error,
data 775, v23f0 ].


 
CauseRSA Authentication Manager is caching the Directory User ID and Directory Password and the LDAP error being generated is related to the Directory User (or Windows account used to query the Microsoft Active Directory) used in the identity source configuration being locked out.
ResolutionIdentity sources are configured via the Operations Console (Deployment Configuration > Identity Sources > Manage Existing then click on the identity source name and select Edit). Under the Connection(s) tab an administrator can change the Directory User ID and/or Directory Password. The Directory User ID and Directory Password can be tested with the Test Connection button.

Stopping and starting the Authentication Manager instance will ensure any cached data is cleared.
  1. Launch an SSH client, such as PuTTY.
  2. Login to the primary Authentication Manager server as rsaadmin and enter the operating system password.

Note that during Quick Setup another user name may have been selected. Use that user name to login.



  1. Navigate to /opt/rsa/am/server:


login as: rsaadmin
Using keyboard-interactive authentication.
Password: <enter operating system password>
Last login: Wed Jan  8 17:48:17 2020 from jumphost.vcloud.local
RSA Authentication Manager Installation Directory: /opt/rsa/am
rsaadmin@am82p:~> cd /opt/rsa/am/server


  1.  Stop the Authentication Manager services:


rsaadmin@am82p:~> ./rsaserv stop all


  1. Start the Authentication Manager services:


rsaadmin@am82p:~> ./rsaserv start all




 
NotesUse the following link for a list of Common Active Directory bind errors.  The site allows an administrator to enter the data HEX value (i.e. 775) to provide a description/information on the LDAP error code.

Attachments

    Outcomes