Troubleshooting: AD LDS Login Fails with "Password Does Not Match" Because the User Account Is Disabled – SecureAuth Support

Version Affected: All

Overview

When logging in to a realm that uses AD LDS (Active Directory Lightweight Directory Services) as its membership provider, entering the password fails with Password does not match, even though the password is correct:

A login form with a Username field showing bob and a Password field, showing Password does not match in red below the Submit button.

The realm's warning.log also shows an entry similar to:

<Root><EventID>51101</EventID><SeverityLevel>Error</SeverityLevel><Message>LDAPMembershipProvider.ValidateUserWithLDAPConnectionBind: username: bob, Exception: The supplied credential is invalid.</Message></Root>

If the realm's Workflow is instead set to request only a username, the user can log in, which confirms the realm can successfully query the AD LDS membership provider.

Cause

The user object is disabled in AD LDS. Newly created objects in AD LDS default to a disabled state.

Resolution

Enable the user object in AD LDS using a tool capable of writing to AD LDS, such as ADSI Edit or PowerShell. In ADSI Edit, edit the object's msDS-UserAccountDisabled attribute and set it to False:

ADSI Edit showing a user object's Attribute Editor with msDS-UserAccountDisabled set to TRUE, and a Boolean Attribute Editor dialog changing that value to False.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.