AD LDAP接続にチャネルバインドを使用すると、マシンアカウントの作成に失敗します

最後の更新
PDFとして保存

Views:: 124

Visibility:: Public

Votes:: 0

Category:: ontap-9

Specialty:: nas

Last Updated:

環境

ONTAP 9.10.1以降
Active Directory LDAP
CIFSサーバ
LDAPチャネルバインディング

問題

LDAP local error AD LDAP接続でチャネルバインドを使用すると、でマシンアカウントの作成に失敗しました

Cluster::> vserver active-directory create -account-name svm1 -domain ntap.local -ou OU=test,OU=netapp -vserver svm1

In order to create an Active Directory machine account, you must supply the name and password of a Windows account with sufficient privileges to add computers to the "OU=test,OU=netapp" container within the "NTAP.LOCAL" domain.

Enter the user name: <account>

Enter the password:

Error: Machine account creation procedure failed

[20336] Loaded the preliminary configuration.

[ 20361] Successfully connected to ip 10.10.10.11, port 88 using TCP

[20429] Successfully connected to ip 10.10.10.11, port 636 using TCP

[ 20719] Successfully connected to ip 10.10.10.11, port 88 using TCP

[ 20751] FAILURE: Unable to SASL bind to LDAP server using GSSAPI: Local error

[ 20751] Additional info: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure.  Minor code may provide more information (Server not found in Kerberos database)

[ 20753]Unable to start LDAPS: Local error

[ 20753] Additional info: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure.  Minor code may provide more information (Server not found in Kerberos database)

[ 20753] Unable to connect to LDAP (Active Directory) service on dc01.ntap.local (Error: Local error)

[ 20753] Unable to make a connection (LDAP (Active Directory):NTAP.LOCAL), result: 7643

Error: command failed: Failed to create the ActiveDirectory machine account "svm01". Reason: LDAP Error: Local error occurred.

SecD に、 Spenegoを使用したLDAP SASLバインドが 'Invalid credentials" エラーで失敗し、 "local error" GSSAPIとチャネルバインドを使用した場合にレポートを示します。

00000014.00099b77 0169eaf8 Thu Sep 09 2022 14:40:04 +02:00 [kern_secd:info:10469] | [020.526.942]  info :  Successfully connected to ip 10.10.10.11, port 636 using TCP { in _connect() at src/connection_manager/secd_connection_shim.cpp:497 }

00000014.00099b78 0169eaf8 Thu Sep 09 2022 14:40:04 +02:00 [kern_secd:info:10469] | [020.619.995]  debug:  ldap_sasl_bind_s returned 49  { in ldapSaslBindSpnego() at src/connection_manager/secd_connection.cpp:774 }

00000014.00099b79 0169eaf8 Thu Sep 09 2022 14:40:04 +02:00 [kern_secd:info:10469] | [020.620.026]  ERR  :  RESULT_ERROR_LDAPSERVER_INVALID_CREDENTIALS:7627 in ldapSaslBindSpnego() at src/connection_manager/secd_connection.cpp:780

00000014.00099b7a 0169eaf8 Thu Sep 09 2022 14:40:04 +02:00 [kern_secd:info:10469] | [020.620.035]  ERR  :  ldapSaslBindSpnego: LDAP Error: (49): 'Invalid credentials':

00000014.00099b7b 0169eaf8 Thu Sep 09 2022 14:40:04 +02:00 [kern_secd:info:10469] | [020.620.517]  debug: Invalid credentials. Trying with SIGN  { in ldapSaslBind() at src/connection_manager/secd_connection.cpp:1010 }

00000014.00099c19 0169eb00 Thu Sep 09 2022 14:40:04 +02:00 [kern_secd:info:10469] | [020.786.549]  info :  [krb5 context 08CE2E00] Received answer from stream 10.10.10.11:88

00000014.00099c1a 0169eb00 Thu Sep 09 2022 14:40:04 +02:00 [kern_secd:info:10469] | [020.786.597]  info :  [krb5 context 08CE2E00] TGS request result: -1765328377/Server not found in Kerberos database

00000014.00099c1b 0169eb00 Thu Sep 09 2022 14:40:04 +02:00 [kern_secd:info:10469] | [020.786.830]  ERR  : LDAP SASL bind failed using GSSAPI and channel binding. Error: -2(Local error) { in ldapSaslBindGssapi() at src/connection_manager/secd_connection.cpp:633 }

00000014.00099c1c 0169eb00 Thu Sep 09 2022 14:40:04 +02:00 [kern_secd:info:10469] | [020.786.836]  debug:  Retrying bind without channel binding  { in ldapSaslBindGssapi() at src/connection_manager/secd_connection.cpp:637 }