Troubleshooting: LDAP.DirectoryUserLookup Intermittently Fails for New Experience Realms

Version Affected: All
 
 

Overview

LDAP.DirectoryUserLookup intermittently fails with "Exception: The user name or password is incorrect" for New Experience realms.

Cause

This occurs when the Data Store credential is configured using only the service account's SamAccountName (for example, service_account) rather than its fully qualified User Principal Name (UPN).

When the realm goes to sleep and requests get queued, the domain suffix gets appended to the service account name multiple times as the queued requests are processed, eventually producing a malformed value such as service_account@domain.com@domain.com. Active Directory rejects this malformed username, causing the intermittent lookup failure.

Debug logs show the domain suffix being appended repeatedly:

Message="LDAP.GetVaultCreds: _connectionUsername does not contain @"
Message="LDAP.GetVaultCreds: _connectionUsername does not contain @"
Message="LDAP.GetVaultCreds: _connectionUsername=service_account - _connectionDomain=@domain.com"
Message="LDAP.GetVaultCreds: _connectionUsername=service_account@domain.com"
Message="LDAP.GetVaultCreds: _connectionUsername=service_account@domain.com - _connectionDomain=@domain.com"
Message="LDAP.GetVaultCreds: _connectionUsername=service_account@domain.com@domain.com"

Resolution

In the New Experience Data Store configuration, set the service account credential to its fully qualified UPN (for example, service_account@domain.com) instead of the bare SamAccountName. This eliminates the repeated calls that append @domain.com to the service account name.
 
 
 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.