How to check the connectivity and response time of an Identity source for RSA Authentication Manager using ldapsearch

3 years ago

Originally Published: 2016-07-18

Article Number

000067182

Applies To

RSA Product Set: SecurID
RSA Product/Service Type: Authentication Manager
RSA Version/Condition: 8.1,8.2,8.3

Issue

To Troubleshoot Identity source Issues, It may be needed to check the connectivity to the Identity source, and its response time from the AM server.

Resolution

The connectivity to an Identity source can be checked by following the below steps:

Open an SSH session to the AM server.
Run the below command:

# ldapsearch -LLL  -H <DC connection> -x  -D <User name> -w <password> -E pr=1000/noprompt -b <User Base DN> "(&(|(objectClass=User)(objectcategory=person))(SAMAccountName=<Any User ID>))" SAMAccountName

e.g:

# ldapsearch -LLL  -H ldap://2k8r2-dc1.2k8r2-vcloud.local:389 -x  -D 'administrator@2k8r2-vcloud.local' -w 'pa$$w0rd' -E pr=1000/noprompt -b 'cn=Users, dc=2k8r2-vcloud, dc=local' "(&(|(objectClass=User)(objectcategory=person))(SAMAccountName=newuser))" SAMAccountName

If the connectivity is OK , the output of the command should look like:

dn: CN=new user,CN=Users,DC=2k8r2-vcloud,DC=local
sAMAccountName: newuser

# pagedresults: cookie=

If the credentials are incorrect you will get the below error:

ldap_bind: Invalid credentials (49)
        additional info: 80090308: LdapErr: DSID-0C0903A9, comment: AcceptSecurityContext error, data 52e, v1db1

If there is a network connectivity error you will get the below error:

ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)

The response time of the Identity source can be checked by just pre-pending the "time" command to the "ldapsearch" command as shown below:

# time ldapsearch -LLL  -H <DC connection> -x  -D <User name> -w <password> -E pr=1000/noprompt -b <User Base DN> "(&(|(objectClass=User)(objectcategory=person))(SAMAccountName=<Any User ID>))" SAMAccountName

e.g:

# time ldapsearch -LLL  -H ldap://2k8r2-dc1.2k8r2-vcloud.local:389 -x  -D 'administrator@2k8r2-vcloud.local' -w 'pa$$w0rd' -E pr=1000/noprompt -b 'cn=Users, dc=2k8r2-vcloud, dc=local' "(&(|(objectClass=User)(objectcategory=person))(SAMAccountName=newuser))" SAMAccountName

the response time is the highlighted value besides "real" at the end of the output as shown below:

dn: CN=new user,CN=Users,DC=2k8r2-vcloud,DC=local
sAMAccountName: newuser

# pagedresults: cookie=

real    0m0.010s
user    0m0.000s
sys     0m0.000s

Notes

When trying to connect using LDAPS (usually on port 636) instead of LDAP (usually port 389), you may get the below error if the LDAP certificate used is not signed by a CA trusted on the AM server.

ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1)
additional info: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed (unable to get local issuer certificate)

The workaround is setting the LDAPTLS_REQCERT environmental variable to "never", and then running the "ldapsearch" command as shown below:

# export LDAPTLS_REQCERT=never
# time ldapsearch -LLL  -H ldaps://2k8r2-dc1.2k8r2-vcloud.local:636 -x  -D 'administrator@2k8r2-vcloud.local' -w 'support1!' -E pr=1000/noprompt -b 'cn=Users, dc=2k8r2-vcloud, dc=local' "(&(objectClass=User)(objectcategory=person)(SAMAccountName=newuser))" SAMAccountName

Don't see what you're looking for?

Related Articles

Trending Articles