Symptoms

Background In some cases, when the customer configures LDAP authentication for external users, authentication errors may occur.The following XtremIO environments may be impacted by this issue: Dell EMC Software: XtremIO 6.3.2 and later. Issue When the customer configures LDAP authentication for external users, authentication errors may occur under when all of the following conditions exist: The LDAP server serves via a secure channel ldaps instead of ldapThere exists a configuration item TLS_CIPHER_SUITE ALL:!ECDHE in /etc/openldap/ldap.confThe existing server side certification is generated via cipher ECDHE. Given the above conditions, server side will return error like, [root@vxms-xbrick820 tmp]# LDAPTLS_REQCERT=never ldapsearch '-x' '-H' 'ldaps://10.xx.xxx.xxx' '-s' 'base' '-D' 'CN=Administrator,CN=Users,DC=dts,DC=xio,DC=com' -w ********** '-l' '1500' '-b' 'CN=xioadmins,CN=Users,DC=dts,DC=xio,DC=com' 'member' 'uniquemember' 'memberUid' ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)

Cause

Software issue due to incompatibility of TLS_CIPHER_SUITE ALL:!ECDHE with server side certification being generated via cipher ECDHE

Resolution

To determine if LDAP is being used run the xmcli command show-user-accounts. The property External-Account is True when LDAP is being used: (tech)> show-user-accounts Name Index Role External-Account Inactivity-Timeout tech 1 technician False 10 sara 2 admin True 10 To prevent this error from happening, perform one of the following options: Regenerate the certification file along with cipher beyond ECDHE. Use openssl tool to generate a new certificate without using ECDHE cipher suite and then run command modify-ldap-config in xmcli console, for example: xmcli (tech)> modify-ldap-config ldap-config-id=1 ca-cert-data="-----BEGIN CERTIFICATE-----\n\ xmcli (tech)> ...MIIDxzCCAq+gAwIBAgIJAP6+MUDcIYMbMA0GCSqGSIb3DQEBCwUAMHoxCzAJBgNV\n\ xmcli (tech)> ...BAYTAlJVMQwwCgYDVQQIDANTUEIxDDAKBgNVBAcMA1NQQjENMAsGA1UECgwERGVs\n\ ... xmcli (tech)> ...IWm2qx8C+k891uD3kQp3ipG2c4GMp9y/QA2z8bJhYDVkPHj4k404vHO6CBYlgdMP\n\ xmcli (tech)> ...icN8dZwGqgfc58lct2zZORFJUAjduRGzB0rL4YYJwiuPLOqKTSma5cckef7bR4OB\n\ xmcli (tech)> ...dSvHlrWuRrrtDwk=\n\ xmcli (tech)> ...-----END CERTIFICATE-----" Modified LDAP Configuration [1] or Comment the configuration item TLS_CIPHER_SUITE ALL:!ECDHE in /etc/openldap/ldap.conf. If the XMS is being upgraded to XMS 6.3.2 or later this should be performed after the upgrade. 

Support Cases