How to enable TLS1.2 for LDAP Authentication in Pega 7.1.7
Hi Team,
We had been using Ldap authentication in Pega 7.1.7 where we had configured the ldap server,port and bind details and the url was starting with ldap://. Recently we got a mail asking us to change the ldap server and bind details like bind name and password. The new ldap protocol is ldaps://. After we made all changes when we login to application it is throwing below error. We have even installed SSL certificates given by ldap team too. Can anyone help me on how to resolve this issue.
Error:
External authentication with LDAP failed : javax.naming.CommunicationException: simple bind failed: <<LDAP server: port>>. Root exception is java.net.SocketException: Connection reset.
Thanks,
Chiru
***Edited by Moderator Marissa to update Pega Academy to Product; product/version tags****
Updated: 18 Feb 2020 15:02 EST
Pegasystems Inc.
US
After you configure LDAP over SSL, first and foremost is to check if Test Connection is successful from Auth Service.
Can you share the complete stack trace from the server from which Pega step invokes the error? We need to understand if it's a Connection issue OR a failure of the TLS protocol version mismatch?
The ROOT exception shows Connection Reset, verify if port number is changed for ldaps and ensure free-flow of connection between JVM (hosting Pega) and LDAP server over SSL.
If the problem is due to TLS protocol version, I would recommend to check this article and change it as described to set the protocol version in your auth service.
Let me know if that helps!
Cognizant Technology Solutions
IN
Hi Harish,
Test connection is successful from authentication service rule. This was verified first.
Ldap team asked us to change server and port as part of their server migration to ldaps://. When we do telnet on this server and port , it is successful.
I had already referred the article a month ago and made that fix, but it is of no use.
Please refer attached complete stack trace which i found in logs. Please let me know if any details are required further.
Thanks,
Chiru
Updated: 19 Feb 2020 14:29 EST
Pegasystems Inc.
US
Thank you for the stackTrace. Caused by: java.net.SocketException: Connection reset at java.net.SocketInputStream.read(SocketInputStream.java:209) at java.net.SocketInputStream.read(SocketInputStream.java:134) at com.ibm.jsse2.b.a(b.java:88) at com.ibm.jsse2.b.a(b.java:83) at com.ibm.jsse2.sc.a(sc.java:716) at com.ibm.jsse2.sc.h(sc.java:359) at com.ibm.jsse2.sc.a(sc.java:13) at com.ibm.jsse2.i.write(i.java:5) at java.io.BufferedOutputStream.flushBuffer(BufferedOutputStream.java:94) at java.io.BufferedOutputStream.flush(BufferedOutputStream.java:152) at com.sun.jndi.ldap.Connection.writeRequest(Connection.java:466) at com.sun.jndi.ldap.Connection.writeRequest(Connection.java:439) at com.sun.jndi.ldap.LdapClient.ldapBind(LdapClient.java:372) at com.sun.jndi.ldap.LdapClient.authenticate(LdapClient.java:227)
Pega uses LDAP libraries from JDK and it seems like the WebSphere server couldn't read the response from the LDAP server during authenticate call.
Connection Reset errors indicate that the service provider closed the connection while Pega(app server) was reading data off the network socket input stream.
Try exploring the below JVM argument and see if you can set it to a higher value in Websphere. The Pega platform has no interference with this.
com.sun.jndi.ldap.read.timeout