Troubleshooting: Bind Authentication Fails With 'Invalid Password' for Some Users' Distinguished Names

Version Affected: All
 
 

Overview

When a realm's Validate User Type is set to Bind, a subset of users always receive an "Invalid Password" error, even though their username and password are correct.

Cause

Bind authenticates using a user's Distinguished Name (DN). If a special character appears anywhere in that DN, the Bind fails -- even though the username itself is correct.

Resolution:

Check what the affected users have in common. For example, if they are all in an Organizational Unit (OU) whose name contains a / character, that character in the DN is likely breaking the Bind lookup.

If the special character can be removed (for example, by renaming the OU), do so. If it cannot be removed, switch the realm's Validate User Type from Bind to Search instead -- Search is not affected by special characters in the DN the same way.

Special Considerations

A fix for this Bind behavior is planned for 19.07.01 HF38, 20.06 HF17, 21.04 HF12, 22.02 HF9, and 22.12 HF2, once each is released -- check current release notes to confirm whether it has shipped for the version in use.


 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.