I know the client(zabbix) that is making an API call and the truststore is configured correctly. I can login with zabbixuser/password via cloudera mananger and it works fine. Ldap is configured with port 389.     ... View more

After making changes to log4j and removing all entries from LDAP User Search Filter,LDAP User Search Base,LDAP Group Search Filter,LDAP Group Search Base . Which as you said are only used when ldap is present.    In-addition to following this doc : https://www.cloudera.com/documentation/enterprise/5-15-x/topics/cm_sg_external_auth.html using "Active directory" method i found the below    In the Active Directory Domain property, provide the domain to authenticate against. LDAP URL and Active Directory are the only settings required to allow anyone in Active Directory to log in to Cloudera Manager.    So i just provided LDAP URL and Active directory, after making this change and restarting cloudera-scm-server . I am able to login however "func_svc_zab_cdh"  is not able to login.    LDAP User Groups - same as screenshot above.    LOGS:    When i login:    2018-09-18 10:03:47,198 DEBUG 936018027@scm-web-6:org.springframework.security.ldap.authentication.ad.ActiveDirectoryLdapAuthenticationProvider: Processing authentication request for user: desind 2018-09-18 10:03:47,324 DEBUG 936018027@scm-web-6:org.springframework.security.ldap.SpringSecurityLdapTemplate: Searching for entry under DN '', base = 'dc=vsp,dc=sas,dc=com', filter = '(&(objectClass=user)(userPrincipalName={0}))' 2018-09-18 10:03:47,335 DEBUG 936018027@scm-web-6:org.springframework.security.ldap.SpringSecurityLdapTemplate: Found DN: cn=desind,ou=Users,ou=Consulting,ou=SAS,dc=vsp,dc=sas,dc=com 2018-09-18 10:03:47,345 INFO 936018027@scm-web-6:org.springframework.security.ldap.SpringSecurityLdapTemplate: Ignoring PartialResultException 2018-09-18 10:03:47,347 DEBUG 936018027@scm-web-6:org.springframework.security.ldap.authentication.ad.ActiveDirectoryLdapAuthenticationProvider: 'memberOf' attribute values: [CN=logon_elv_u_cicld_all,OU=Logon,OU=Groups,OU=CICLD,OU=Customers,OU=AWSSYD,OU=Sites,DC=gsp,DC=vsp,DC=sas,DC=com, CN=CICLD.LOB,OU=ServiceNow,OU=Groups,OU=CICLD,OU=Customers,OU=AWSSYD,OU=Sites,DC=gsp,DC=vsp,DC=sas,DC=com, CN=CICLD Jira - Confluence,OU=Atlassian,OU=Groups,OU=CICLD,OU=Customers,OU=AWSSYD,OU=Sites,DC=gsp,DC=vsp,DC=sas,DC=com, CN=logon_elv_w_cicld_all,OU=Logon,OU=Groups,OU=CICLD,OU=Customers,OU=AWSSYD,OU=Sites,DC=gsp,DC=vsp,DC=sas,DC=com, CN=logon_elv_w_ssovd_desind-dt,OU=Logon,OU=Groups,OU=SSOVD,OU=SL1,DC=vsp,DC=sas,DC=com, CN=SASDB.LOB,OU=ServiceNow,OU=Groups,OU=SASDB,OU=SL1,DC=vsp,DC=sas,DC=com, CN=logon_std_u_dig_dig93au,OU=Logon,OU=Groups,OU=DIG,OU=SL1,DC=vsp,DC=sas,DC=com, CN=logon_std_u_dig_dig95au,OU=Logon,OU=Groups,OU=DIG,OU=SL1,DC=vsp,DC=sas,DC=com, CN=logon_std_u_dig_dig96au,OU=Logon,OU=Groups,OU=DIG,OU=SL1,DC=vsp,DC=sas,DC=com, CN=logon_std_u_dig_dig99au,OU=Logon,OU=Groups,OU=DIG,OU=SL1,DC=vsp,DC=sas,DC=com, CN=logon_std_u_dig_dig97au,OU=Logon,OU=Groups,OU=DIG,OU=SL1,DC=vsp,DC=sas,DC=com, CN=logon_std_u_dig_dig98au,OU=Logon,OU=Groups,OU=DIG,OU=SL1,DC=vsp,DC=sas,DC=com, CN=logon_std_u_dig_dig94au,OU=Logon,OU=Groups,OU=DIG,OU=SL1,DC=vsp,DC=sas,DC=com, CN=logon_ncx_deny,OU=Logon,OU=Groups,OU=NCX,OU=SL1,DC=vsp,DC=sas,DC=com, CN=logon_std_u_dig_dig92au,OU=Logon,OU=Groups,OU=DIG,OU=SL1,DC=vsp,DC=sas,DC=com, CN=logon_std_u_dig_dig91au,OU=Logon,OU=Groups,OU=DIG,OU=SL1,DC=vsp,DC=sas,DC=com, CN=logon_tool_securevault,OU=Groups,OU=Infrastructure,OU=SAS,DC=vsp,DC=sas,DC=com, CN=logon_ncj_deny,OU=Logon,OU=Groups,OU=NCJ,OU=SL1,DC=vsp,DC=sas,DC=com, CN=sasdbasudo,OU=Groups,OU=SAS DBA,OU=SAS,DC=vsp,DC=sas,DC=com, CN=logon_std_u_dig_dig64au,OU=Logon,OU=Groups,OU=DIG,OU=SL1,DC=vsp,DC=sas,DC=com, CN=logon_std_u_dig_dig65au,OU=Logon,OU=Groups,OU=DIG,OU=SL1,DC=vsp,DC=sas,DC=com, CN=logon_elv_u_dig_all,OU=Logon,OU=Groups,OU=DIG,OU=SL1,DC=vsp,DC=sas,DC=com, CN=ITM.LOB,OU=ServiceNow,OU=Groups,OU=ITM,OU=SL1,DC=vsp,DC=sas,DC=com, CN=dba,OU=Unix Resources,OU=SAS,DC=vsp,DC=sas,DC=com, CN=SSO Hadoop Administration,OU=Groups,OU=Atlassian,OU=Functional,OU=SAS,DC=vsp,DC=sas,DC=com, CN=DIG Cloudera Manager Admins,OU=Groups,OU=DIG,OU=SL1,DC=vsp,DC=sas,DC=com, CN=CICLD.AllUsers,OU=Groups,OU=CICLD,OU=Customers,OU=AWSSYD,OU=Sites,DC=gsp,DC=vsp,DC=sas,DC=com, CN=digsudo,OU=Groups,OU=DIG,OU=SL1,DC=vsp,DC=sas,DC=com, CN=digsasauth,OU=Groups,OU=DIG,OU=SL1,DC=vsp,DC=sas,DC=com, CN=logon_elv_u_aid_all,OU=Logon,OU=Groups,OU=AID,OU=SL1,DC=vsp,DC=sas,DC=com, CN=sas_samviewer,OU=Groups,OU=Functional,OU=SAS,DC=vsp,DC=sas,DC=com, CN=DIG.LOB,OU=ServiceNow,OU=Groups,OU=DIG,OU=SL1,DC=vsp,DC=sas,DC=com, CN=logon_elv_w_dig_all,OU=Logon,OU=Groups,OU=DIG,OU=SL1,DC=vsp,DC=sas,DC=com, CN=logon_elv_w_aid_all,OU=Logon,OU=Groups,OU=AID,OU=SL1,DC=vsp,DC=sas,DC=com, CN=AID.LOB,OU=ServiceNow,OU=Groups,OU=AID,OU=SL1,DC=vsp,DC=sas,DC=com, CN=DIG Jira - Confluence,OU=Atlassian,OU=Groups,OU=DIG,OU=SL1,DC=vsp,DC=sas,DC=com, CN=digunix,OU=Groups,OU=DIG,OU=SL1,DC=vsp,DC=sas,DC=com, CN=digapp,OU=Groups,OU=DIG,OU=SL1,DC=vsp,DC=sas,DC=com, CN=DIG RDC,OU=Groups,OU=DIG,OU=SL1,DC=vsp,DC=sas,DC=com, CN=MISTK.LOB,OU=ServiceNow,OU=Groups,OU=MISTK,OU=SL1,DC=vsp,DC=sas,DC=com, CN=logon_tool_vpn_rdp,OU=Groups,OU=Infrastructure,OU=SAS,DC=vsp,DC=sas,DC=com, CN=SAS.LOBi,OU=Internal LOBs,OU=ServiceNow,OU=Functional,OU=SAS,DC=vsp,DC=sas,DC=com, CN=SASDB Jira - Confluence,OU=Atlassian,OU=Groups,OU=SASDB,OU=SL1,DC=vsp,DC=sas,DC=com, CN=SASDB.AllUsers,OU=Groups,OU=SASDB,OU=SL1,DC=vsp,DC=sas,DC=com, CN=SAS Solutions OnDemand.LOBi,OU=Internal LOBs,OU=ServiceNow,OU=Functional,OU=SAS,DC=vsp,DC=sas,DC=com, CN=MISTK.AllUsers,OU=Groups,OU=MISTK,OU=SL1,DC=vsp,DC=sas,DC=com, CN=ITM.AllUsers,OU=Groups,OU=ITM,OU=SL1,DC=vsp,DC=sas,DC=com, CN=AID.AllUsers,OU=Groups,OU=AID,OU=SL1,DC=vsp,DC=sas,DC=com, CN=dbasudo,OU=Groups,OU=SAS DBA,OU=SAS,DC=vsp,DC=sas,DC=com, CN=AID Jira - Confluence,OU=Atlassian,OU=Groups,OU=AID,OU=SL1,DC=vsp,DC=sas,DC=com, CN=SAS Internal - ASP,OU=Groups,OU=Atlassian,OU=Functional,OU=SAS,DC=vsp,DC=sas,DC=com, CN=jira-users,OU=Groups,OU=Atlassian,OU=Functional,OU=SAS,DC=vsp,DC=sas,DC=com, CN=confluence-users,OU=Groups,OU=Atlassian,OU=Functional,OU=SAS,DC=vsp,DC=sas,DC=com, CN=SAS Internal - All,OU=Groups,OU=Atlassian,OU=Functional,OU=SAS,DC=vsp,DC=sas,DC=com, CN=SSO Database Administration,OU=Groups,OU=Atlassian,OU=Functional,OU=SAS,DC=vsp,DC=sas,DC=com, CN=SSO Demo,OU=Groups,OU=Atlassian,OU=Functional,OU=SAS,DC=vsp,DC=sas,DC=com, CN=SSO Share Access,OU=Groups,OU=SSO,OU=SAS,DC=vsp,DC=sas,DC=com, CN=SAS Employees,OU=SAS,DC=vsp,DC=sas,DC=com, CN=ssosvn,OU=Groups,OU=SSO,OU=SAS,DC=vsp,DC=sas,DC=com, CN=SSO Developers,OU=Groups,OU=SSO,OU=SAS,DC=vsp,DC=sas,DC=com, CN=SSO Users,OU=Groups,OU=SSO,OU=SAS,DC=vsp,DC=sas,DC=com, CN=SW-UltraEdit32,OU=Groups,OU=SSO,OU=SAS,DC=vsp,DC=sas,DC=com, CN=SAS Admins,OU=Groups,OU=SASAdmins,OU=SAS,DC=vsp,DC=sas,DC=com, CN=sasdba,OU=Groups,OU=SAS DBA,OU=SAS,DC=vsp,DC=sas,DC=com, CN=SAS Admin Restricted,OU=Groups,OU=SASAdmins,OU=SAS,DC=vsp,DC=sas,DC=com] 2018-09-18 10:03:47,357 DEBUG 936018027@scm-web-6:org.springframework.security.ldap.userdetails.LdapUserDetailsMapper: Mapping user details from context with DN: cn=desind,ou=Users,ou=Consulting,ou=SAS,dc=vsp,dc=sas,dc=com 2018-09-18 10:03:48,209 INFO 936018027@scm-web-6:com.cloudera.server.web.cmf.AuthenticationSuccessEventListener: Authentication success for user: 'desind' from 10.99.195.186 2018-09-18 10:03:51,430 INFO avro-servlet-hb-processor-1:com.cloudera.server.common.AgentAvroServlet: (23 skipped) AgentAvroServlet: heartbeat processing stats: average=79ms, min=26ms, max=839ms.   #############When "func_svc_zab_cdh" user logins################   2018-09-18 10:04:40,227 DEBUG 1978563421@scm-web-13:org.springframework.security.ldap.authentication.ad.ActiveDirectoryLdapAuthenticationProvider: Processin g authentication request for user: func_svc_zab_cdh 2018-09-18 10:04:40,290 DEBUG 1978563421@scm-web-13:org.springframework.security.ldap.SpringSecurityLdapTemplate: Searching for entry under DN '', base = 'd c=vsp,dc=sas,dc=com', filter = '(&(objectClass=user)(userPrincipalName={0}))' 2018-09-18 10:04:40,290 INFO 1978563421@scm-web-13:org.springframework.security.ldap.SpringSecurityLdapTemplate: Ignoring PartialResultException 2018-09-18 10:04:40,292 ERROR 1978563421@scm-web-13:com.cloudera.server.web.cmf.CmfLdapAuthenticationProvider: LDAP/AD authentication failed org.springframework.dao.IncorrectResultSizeDataAccessException: Incorrect result size: expected 1, actual 0 at org.springframework.security.ldap.SpringSecurityLdapTemplate.searchForSingleEntryInternal(SpringSecurityLdapTemplate.java:239) at org.springframework.security.ldap.authentication.ad.ActiveDirectoryLdapAuthenticationProvider.searchForUser(ActiveDirectoryLdapAuthenticationProv ider.java:258) at org.springframework.security.ldap.authentication.ad.ActiveDirectoryLdapAuthenticationProvider.doAuthentication(ActiveDirectoryLdapAuthenticationP rovider.java:114) at org.springframework.security.ldap.authentication.AbstractLdapAuthenticationProvider.authenticate(AbstractLdapAuthenticationProvider.java:61) at com.cloudera.server.web.cmf.CmfLdapAuthenticationProvider.authenticate(CmfLdapAuthenticationProvider.java:107) at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:156) at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:174) at org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter.attemptAuthentication(UsernamePasswordAuthenticationFilter.j ava:94) at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:194) at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323) at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:105) at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323) at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:87) at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323) at org.springframework.security.web.session.ConcurrentSessionFilter.doFilter(ConcurrentSessionFilter.java:125) at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323) at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:173) at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:237) at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:167) at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1212) at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:88) at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:76) at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1212) at org.mortbay.jetty.servlet.ServletHandler.handle(ServletHandler.java:399) at org.mortbay.jetty.security.SecurityHandler.handle(SecurityHandler.java:216) at org.mortbay.jetty.servlet.SessionHandler.handle(SessionHandler.java:182) at org.mortbay.jetty.security.SecurityHandler.handle(SecurityHandler.java:216) at org.mortbay.jetty.security.SecurityHandler.handle(SecurityHandler.java:216) at org.mortbay.jetty.handler.ContextHandler.handle(ContextHandler.java:767) at org.mortbay.jetty.webapp.WebAppContext.handle(WebAppContext.java:450) at org.mortbay.jetty.handler.HandlerWrapper.handle(HandlerWrapper.java:152) at org.mortbay.jetty.handler.StatisticsHandler.handle(StatisticsHandler.java:53) at org.mortbay.jetty.handler.HandlerWrapper.handle(HandlerWrapper.java:152) at org.mortbay.jetty.Server.handle(Server.java:326) at org.mortbay.jetty.HttpConnection.handleRequest(HttpConnection.java:542) at org.mortbay.jetty.HttpConnection$RequestHandler.content(HttpConnection.java:945) at org.mortbay.jetty.HttpParser.parseNext(HttpParser.java:756) at org.mortbay.jetty.HttpParser.parseAvailable(HttpParser.java:218) at org.mortbay.jetty.HttpConnection.handle(HttpConnection.java:404) at org.mortbay.io.nio.SelectChannelEndPoint.run(SelectChannelEndPoint.java:410) at org.mortbay.thread.QueuedThreadPool$PoolThread.run(QueuedThreadPool.java:582) 2018-09-18 10:04:40,298 INFO 1978563421@scm-web-13:com.cloudera.server.web.cmf.AuthenticationFailureEventListener: Authentication failure for user: 'func_sv c_zab_cdh' from 10.99.195.186 2018-09-18 10:04:51,465 INFO avro-servlet-hb-processor-1:com.cloudera.server.common.AgentAvroServlet: (23 skipped) AgentAvroServlet: heartbeat processing stats: average=68ms, min=25ms, max=839ms.   func_svc_zab_cdh is like any other user and must be able to login and user is present in the vsp.sas.com domain and in group "cloudera_manager_API"       ... View more

@bgooley   1) So when i login into cloudera manager as func_svc_zab_cdh that will be converted to func_svc_zab_cdh@vsp.sas.com    I logged into AD and see the same in the "userPrincipalname" which looks correct. Please find the attachment.    2) Regarding the second point we want to keep it wide open . {0} will be replaced by the username that was used to login screen.    I also tried removing all groups from "LDAP User Groups"  as a test and allowing everyone to login. I , my colleage can login. however "func_svc_zab_cdh" cannot login with the same error. If i enter a wring password for this user i get bad credentials.    I also tried open the search filter to to wide open . event that does not work.    Can you look at maybe debug logs ?        ... View more

@Jayesh Seshadri   Is there any limitation on the character size or special characters in the password that are not allowed ?   I have the same issue and switching to ldap also does not work.    After looking firther, I am able to login with my password, however when i try with a functional user where the username is  "abc_efg_scd_dfc" password is   "a61Odc7zxxaGArlSInIUYu-iq"  it does not work    Do the username/password have any limitations ?  ... View more