Cannot connect to a domain controller on the specified domain

[Inbaselvan R]

Hello,
I'm trying to add account for a domain controller but Im getting below error and the this domain controller are running on a valid SSL cert.
"PAM-CM-3432-Cannot connect to a domain controller on the specified domain"
What can be the issue here.Below is the tomcat logs for this issue.We are using PAM 3.3.


Mar 12, 2020 11:03:33 AM com.cloakware.cspm.server.app.impl.UpdateTargetAccountVerifiedFalseCmd validateParametersINFO: UpdateTargetAccountDescriptorCmd.validate accountID:11001Mar 12, 2020 11:03:33 AM com.cloakware.cspm.server.app.impl.UpdateTargetAccountVerifiedFalseCmd invokeINFO: UpdateTargetAccountVerifiedFlagCmd.invoke starting.Mar 12, 2020 11:03:33 AM com.cloakware.cspm.server.app.impl.UpdateTargetAccountCmd invokeWARNING: UpdateTargetAccountCmd.invoke exception: com.cloakware.cspm.server.app.ApplicationException: UpdateTargetAccountCmd.invoke Failed to synchronize password with target at com.cloakware.cspm.server.app.impl.UpdateTargetAccountCmd.invoke(UpdateTargetAccountCmd.java:1050) at com.cloakware.cspm.server.app.impl.ApplicationContextImpl.invokeCommand(ApplicationContextImpl.java:263) at com.cloakware.cspm.server.app.impl.ApplicationContextImpl.invokeCommand(ApplicationContextImpl.java:122) at com.cloakware.cspm.server.app.impl.ApplicationContextImpl.invokeCommand(ApplicationContextImpl.java:114) at com.cloakware.cspm.server.app.impl.ApplicationContextImpl.invokeCommand(ApplicationContextImpl.java:110) at com.ca.pam.rest.TargetAccountService.update(TargetAccountService.java:378) at sun.reflect.GeneratedMethodAccessor546.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at com.sun.jersey.spi.container.JavaMethodInvokerFactory$1.invoke(JavaMethodInvokerFactory.java:60) at com.sun.jersey.server.impl.model.method.dispatch.AbstractResourceMethodDispatchProvider$TypeOutInvoker._dispatch(AbstractResourceMethodDispatchProvider.java:185) at com.sun.jersey.server.impl.model.method.dispatch.ResourceJavaMethodDispatcher.dispatch(ResourceJavaMethodDispatcher.java:75) at com.sun.jersey.server.impl.uri.rules.HttpMethodRule.accept(HttpMethodRule.java:302) at com.sun.jersey.server.impl.uri.rules.RightHandPathRule.accept(RightHandPathRule.java:147) at com.sun.jersey.server.impl.uri.rules.ResourceClassRule.accept(ResourceClassRule.java:108) at com.sun.jersey.server.impl.uri.rules.RightHandPathRule.accept(RightHandPathRule.java:147) at com.sun.jersey.server.impl.uri.rules.RootResourceClassesRule.accept(RootResourceClassesRule.java:84) at com.sun.jersey.server.impl.application.WebApplicationImpl._handleRequest(WebApplicationImpl.java:1542) at com.sun.jersey.server.impl.application.WebApplicationImpl._handleRequest(WebApplicationImpl.java:1473) at com.sun.jersey.server.impl.application.WebApplicationImpl.handleRequest(WebApplicationImpl.java:1419) at com.sun.jersey.server.impl.application.WebApplicationImpl.handleRequest(WebApplicationImpl.java:1409) at com.sun.jersey.spi.container.servlet.WebComponent.service(WebComponent.java:409) at com.sun.jersey.spi.container.servlet.ServletContainer.service(ServletContainer.java:558) at com.sun.jersey.spi.container.servlet.ServletContainer.service(ServletContainer.java:733) at javax.servlet.http.HttpServlet.service(HttpServlet.java:731) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:303) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208) at org.apache.catalina.filters.ExpiresFilter.doFilter(ExpiresFilter.java:1179) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208) at com.ca.pam.RestAuthenticationFilter.doFilter(RestAuthenticationFilter.java:259) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208) at com.ca.pam.AuthFilter.doFilter(AuthFilter.java:102) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208) at com.ca.pam.CSRFFilter.doFilter(CSRFFilter.java:96) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208) at com.ca.pam.EncodingFilter.doFilter(EncodingFilter.java:18) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:220) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:122) at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:505) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:170) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:423) at org.apache.coyote.ajp.AjpAprProcessor.process(AjpAprProcessor.java:188) at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:620) at org.apache.tomcat.util.net.AprEndpoint$SocketProcessor.doRun(AprEndpoint.java:2476) at org.apache.tomcat.util.net.AprEndpoint$SocketProcessor.run(AprEndpoint.java:2465) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) at java.lang.Thread.run(Thread.java:748)

Regards,
Inbaselvan R

[Andreas Mueller]

Hello Inbaselvan        

 

To confirm if indeed the DC returns the cert can you please run this command on any openssl implementation:

 

# openssl s_client -connect IP_of_DC:636

 

Should the issue remain, please do not hesitate to open a formal Support case with us and we shall have a closer look.

 

Best Regards,

Andreas

 

[Julian Riano]

Hi inbaselvan


Do you have port 636 enabled between the PAM nodes and the domain controller?

[Ralf Prigl]

Hi Inbaselvan, The exception you show here is just a generic exception showing that the job failed. There must be errors prior to that come from the Windows Domain Service/Active Directory target connector that would be much more useful in trying to figure out what problem you ran into. Also make sure to set tomcat log level to INFO (and wait 30 seconds after getting the log level change confirmation message on the UI), reproduce the problem and then take a look at the logs. If we are able to connect to a domain controller on port 636, the log at INFO level will show the certificate of the server we connected to. You can copy that out, put it in a .crt file on a Windows box and open the certificate to see which host it belongs to. Once you are done, set the log level back to what it was.