NetBackup™ Web UI Administrator's Guide

Connection cannot be established with the AD or the LDAP server

If NetBackup could not establish a connection with the AD or the LDAP server, the nbatd logs contain the following error:

Example of error message:

(authldap.cpp) CAuthLDAP::validatePrpl - ldap_simple_bind_s() 
failed for user CN=Test User,OU=VTRSUsers,DC=VRTS,DC=com', 
error = -1, errmsg = Can't contact LDAP server,9:debugmsgs,1

The LDAP server URL (-s option) that is entered using the vssat addldapdomain command does not pass the validation test.

Validate the URL:

ldapsearch -H <LDAP_URI> -D "<admin_user_DN>" -w <passwd> 
-d <debug_level> -o nettimeout=<seconds>

Example of validation error message:

ldapsearch -H ldaps://example.veritas.com:389 -D 
"CN=Test User,OU=VRTSUsers,DC=VRTS,DC=com" -w ******** 
-d 5 -o nettimeout=60 

TLS: can't connect: TLS error -8179:Peer's Certificate issuer 
is not recognized. ldap_sasl_bind(SIMPLE): 
Can't contact LDAP server (-1)

If you use the ldaps option you can validate the certificate issuer using the ldapsearch command.

Validate the certificate issuer:

set env var LDAPTLS_CACERT to cacert.pem

ldapsearch -H <LDAPS_URI> -D "<admin_user_DN>" -w <passwd> 
-d <debug_level> -o nettimeout=<seconds>

Example of validation message:

ldapsearch -H ldaps://example.veritas.com:389 -D 
"CN=Test User,OU=VRTSUsers,DC=VRTS,DC=com" -w ******** 
-d 5 -o nettimeout=60

TLS: can't connect: TLS error -8179:
Peer's Certificate issuer is not recognized..ldap_sasl_bind(SIMPLE): 
Can't contact LDAP server (-1)

The file path for cacert.pem is:

Windows:

install_path\NetBackup\var\global\vxss\eab\data
\systemprofile\certstore\trusted\pluggins\ldap\cacert.pem

UNIX:

/usr/openv/var/global/vxss/eab/data/root/.VRTSat/profile
/certstore/trusted/pluggins/ldap/cacert.pem

Use the -f option of the vssat addldapdomain command to add the certificate to the nbatd command's truststore.

This option is necessary if the CA that signed the certificate is other than the following: