Skip to main content
Question

Functional account test password is failing- Password Safe

  • November 7, 2024
  • 8 replies
  • 321 views

Functional Account test password is failing and so we are recieving the below error. Can anyone please help on this.

 

Verify Managed Account on Active Directory system: Domain=UGNX.local, PreferredController=, UseSsl=True, EnforceCertificateValidation=True, Account=(AccountName=s_pr, DistinguishedName=, SamAccountName=s_pr, UserPrincipalName=s_pr@ugnx.local, DomainName=UGNX.local, Privilege=, SID=S-1-5-21-2902959944-561351360-3437842006-37045, DisableAtRest=False) FunctionalAccount=(AccountName=srv_BT_Win_FA, DistinguishedName=srv_BT_Win_FA, SamAccountName=srv_BT_Win_FA, UserPrincipalName=srv_BT_Win_FA@ugnx.local, DomainName=UGNX.local, Privilege=, SID=, DisableAtRest=False) Querying managed account attributes... Search attributes for SID=S-1-5-21-2902959944-561351360-3437842006-37045 ValidateActiveDirectoryCredentials - domain: 'UGNX.local'; username: 's_pr'; useSsl: 'True'; domainController: 'UGNX.local'. Ignore Errors=False, Trust First Certificate=False Subject=CN=UGX1ADDC11N01.UGNX.local Host=UGNX.local Port=636 Thumbprint=7A47C1B860C8058ACCC12B55CCDA40D8BD9E461A Validity=False Certificate presented by the LDAP server was not valid. Enable Debug logs for more details. The revocation function was unable to check revocation for the certificate. The revocation function was unable to check revocation because the revocation server was offline. VerifyServerCertificate callback returned=False Error[8] - code: 81, error: The LDAP server is unavailable. -> retrying with user name 's_pr'. ValidateActiveDirectoryCredentials - domain: 'UGNX.local'; username: 's_pr'; useSsl: 'True'; domainController: ''. Ignore Errors=False, Trust First Certificate=False Subject=CN=UGX1ADDC11N01.UGNX.local Host=UGNX.local Port=636 Thumbprint=7A47C1B860C8058ACCC12B55CCDA40D8BD9E461A Validity=False Certificate presented by the LDAP server was not valid. Enable Debug logs for more details. The revocation function was unable to check revocation for the certificate. The revocation function was unable to check revocation because the revocation server was offline. VerifyServerCertificate callback returned=False Error[9] - code: 81, error: The LDAP server is unavailable. . Error[11]: System.DirectoryServices.ActiveDirectory.ActiveDirectoryServerDownException: The LDAP server is unavailable. at PasswordSafe.PlatformPlugin.ActiveDirectory.Services.VerificationService.ValidateActiveDirectoryCredentials(ILogger log, String domainController, String domain, String username, String password, Boolean useSsl, Boolean enforceSslCertificateValidation) at PasswordSafe.PlatformPlugin.ActiveDirectory.Services.VerificationService.ValidateActiveDirectoryCredentials(ILogger log, String domainController, String domain, String username, String password, Boolean useSsl, Boolean enforceSslCertificateValidation) at PasswordSafe.PlatformPlugin.ActiveDirectory.Services.VerificationService.VerifyManagedAccount(PluginActionResult result, ILogger logger, String preferredDomainController, Boolean useSSL, Boolean enforceSslCertificateValidation, AccountParameter managedAccount, String passwordMA, AccountParameter functionalAccount, String passwordFA) Account verification failed Plugin: Name=Active Directory, Id=25DE9C14-C9CF-43F8-BB94-99AD6323EF87, Version=3.8.1.0, Publisher=BeyondTrust

 

8 replies

  • BeyondTrust Employee
  • November 8, 2024

Hello,

The error indicates your CRL server cannot be contacted. 

“ The revocation function was unable to check revocation because the revocation server was offline.”

Have a look at this kb on the error.

https://beyondtrustcorp.service-now.com/csm?id=kb_article_view&sysparm_article=KB0021411


  • Author
  • Rising Star
  • November 12, 2024

Yes, we have checked this but still we are facing the same port connectivity issue


  • BeyondTrust Employee
  • November 12, 2024

It could be an issue with the LDAPS certificate. Also make sure the CRL distribution point is published as an “http” and not a “https” url. 


  • Author
  • Rising Star
  • November 12, 2024

For Password Safe cloud configuration do we need the LDAP Certificate?. If yes, can you please guide me how to configure the certificate with any KB article or the instructions to be followed.


  • BeyondTrust Employee
  • November 12, 2024

I have found this Microsoft KB on troubleshooting LDAP over SSL that may help you.

https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/ldap-over-ssl-connection-issues

 

 


  • Author
  • Rising Star
  • November 12, 2024

Thank you for sharing this.

Anything needs to be configured on  Beyond Trust Password Safe cloud for the LDAP certificate?


  • BeyondTrust Employee
  • November 12, 2024

The only certificate validation setting to configure are Configuration > System >  Site and the options on the Certificate Validation section. 

And your resource brokers need to trust your ldaps certificate.


  • Author
  • Rising Star
  • November 12, 2024

ok thank you for the update. We shall look into this.