Veritas NetBackup™ Security and Encryption Guide

To troubleshoot the issue

1. Check if the nbatd logs contain the following error:

   (authldap.cpp) CAuthLDAP::validatePrpl - ldap_simple_bind_s() failed for user 'CN=Test User,OU=VTRSUsers,DC=VRTS,DC=com', error = -1, errmsg = Can't contact LDAP server,9:debugmsgs,1

2. Check if any of the following scenarios is true and carry out the steps provided for that scenario.

   The LDAP server URL (-s option) that is provided with the vssat addldapdomain may be wrong	Run the following command to validate: ldapsearch -H <LDAP_URI> -D "<admin_user_DN>" -w <passwd> -d <debug_level> -o nettimeout=<seconds> Example: ldapsearch -H ldaps://example.veritas.com:389 -D "CN=Test User,OU=VRTSUsers,DC=VRTS,DC=com" -w ******** -d 5 -o nettimeout=60 TLS: can't connect: TLS error -8179:Peer's Certificate issuer is not recognized. ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)
   The server certificate issuer is not a trusted CA	This is applicable if the ldaps option is used and can be validated using the ldapsearch command: set env var LDAPTLS_CACERT to cacert.pem ldapsearch -H <LDAPS_URI> -D "<admin_user_DN>" -w <passwd> -d <debug_level> -o nettimeout=<seconds> File path for cacert.pem: On Windows: <Install_path>\NetBackup\var\global\vxss\eab\data\systemprofile\certstore\trusted\pluggins\ldap\cacert.pem On Unix: /usr/openv/var/global/vxss/eab/data/root/.VRTSat/profile/certstore/trusted/pluggins/ldap/cacert.pem Example: ldapsearch -H ldaps://example.veritas.com:389 -D "CN=Test User,OU=VRTSUsers,DC=VRTS,DC=com" -w ******** -d 5 -o nettimeout=60 TLS: can't connect: TLS error -8179:Peer's Certificate issuer is not recognized.. ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)
   The NetBackup Authentication Service (nbatd) does not trust the certificate authority that has signed the LDAP server's security certificate See Certificate authorities trusted by the NetBackup Authentication Service.	Use the -f option of the vssat addldapdomain command to add the CA certificate in the Authentication Service (nbatd) trust store.

To troubleshoot the issue

1. Check if the nbatd logs contain the following error:

   CAuthLDAP::validatePrpl - ldap_simple_bind_s() failed for user 'CN=Test User,OU=VRTSUsers,DC=VRTS,DC=com', error = 49, errmsg = Invalid credentials,9:debugmsgs,1

2. Check if the following scenario is true and carry out the steps provided for the scenario.

   Invalid admin user DN or password provided while adding an LDAP domain using the vssat addldapdomain command

   Run the following command to validate: ldapsearch -H <LDAP_URI> -D "<admin_user_DN>" -w <passwd> -d <debug_level> -o nettimeout=<seconds> Example: ldapsearch -H ldap://example.veritas.com:389 -D "CN=Test User,OU=VRTSUsers,DC=VRTS,DC=com" -w ******** -d 5 - o nettimeout=60 ldap_bind: Invalid credentials (49)

To troubleshoot the issue

1. Check if the nbatd logs contain the following error:

   CAuthLDAP::validatePrpl - ldap_search_s() error = 10, errmsg = Referral,9:debugmsgs,1 CAuthLDAP::validatePrpl - ldap_search_s() error = 34, errmsg = Invalid DN syntax,9:debugmsgs,1

2. You may see the errors in the logs if user base DN (the -u option) or group base DN (the -g option) values are incorrect.

   Run the following command to validate:

   Example:

   ldapsearch -H ldap://example.veritas.com:389 -D "CN=Test User,OU=VRTSUsers,DC=VRTS,DC=com" -w ****** -b "OU=VRTSUsers,DC=VRTS,DC=con" "(&(cn=test user)(objectClass=user))"

   ldapsearch -H ldap://example.veritas.com:389 -D "CN=Test User,OU=VRTSUsers,DC=VRTS,DC=com" -w ****** -b "VRTS" "(&(cn=test user)(objectClass=user))"

To troubleshoot the issue

1. Check if the nbatd logs contain the following error:

   CAuthLDAP::validateGroup - search returned '2' entries for group name 'team_noone', even with referrals set to OFF,9:debugmsgs,1

2. This is applicable if user search attribute (-a option) and group search attribute (-y option) do not have unique values for the existing user base DN and group base DN respectively.

   Validate the number of matching entries for the existing base DN using the ldapsearch command.

   ldapsearch -H <LDAP_URI> -D "<admin_user_DN>" -w <passwd> -d <debug_level> -o nettimeout=<seconds> -b <BASE_DN> <search_filter>

   Example:

To troubleshoot the issue

1. Check if the nbatd logs contain the following error:

   CAuthLDAP::validatePrpl - user 'test user' NOT found,9:debugmsgs,4 CAuthLDAP::validateGroup - group 'test group' NOT found,9:debugmsgs,4

2. If a user or group exists in the LDAP domain, but the vssat validateprpl or the vssat validategroup command fails with this error, validate if the user or the group exists in the current base DNs (-u and -g options) using the following command.

   ldapsearch -H <LDAP_URI> -D "<admin_user_DN>" -w <passwd> -d <debug_level> -o nettimeout=<seconds> -b <BASE_DN> <search_filter>