Ldapmodify returns Invalid Credentials

I have a peculiar problem with my SUN Directory Server 5.2 P4 deployment. I am able to login into the Admin console with the directory manager credentials. However when I using the same credentials for a ldapmodify operation it fails giving me a Invalid Credentials error.
$ ldapsearch -h <LDAPHost> -p <LDAPPort> -D "cn=Directory Manager" -w <password> -b uid=some_uid,ou=people,dc=example,dc=com objectclass=*
ldap_simple_bind: Invalid credentials
The access logs give a err=50 which means a Invalid password, but am using the right password.
I have mulitple instances of Directory Server running on this machine. Each Directory has a virtual IP assigned to it so that external clients can connect.
Thanks in Advance.

By any chance, would the directory manager credentials contain any special, non-ascii, non-7bit character ?
The character set used by Java is unicode and transcoded in UTF-8
The ldapsearch tool uses the charset and locale specified by your environment. Which is probably not UTF-8...
Aa passwords are supposed to be treated as binary blobs by the directory server, and the clients are providing different representations of it, one works, the other ones don't.
Regards,
Ludovic.

Similar Messages

Invalid Credentials

Hi LDAP Gurus,
I'm a novice in LDAP and JNDI.i installed OPENLDAP on my linux system and its working fine but when i try the example of JNDI, it is giving me the error of INVALID_CREDENTIALS. The Error is :
javax.naming.AuthenticationException: [LDAP: error code 49 - Invalid Credentials]
The JNDI code is:
import javax.naming.Context;
import javax.naming.InitialContext;
import javax.naming.NamingException;
import javax.naming.NameAlreadyBoundException;
import javax.naming.directory.*;
import java.util.*;
public class MakeRoot {
final static String ldapServerName = "10.10.10.38:389" ;
final static String rootdn = "cn=Manager, o=jndiTest";
final static String rootpass = "secret";
final static String rootContext = "o=jndiTest";
public static void main( String[] args ) {
Properties env = new Properties();
env.put( Context.INITIAL_CONTEXT_FACTORY,
"com.sun.jndi.ldap.LdapCtxFactory" );
env.put( Context.PROVIDER_URL, "ldap://" + ldapServerName + "/" );
               //env.put(Context.SECURITY_AUTHENTICATION, "simple");
     env.put( Context.SECURITY_PRINCIPAL, rootdn );
          System.out.println("Harry");
env.put( Context.SECURITY_CREDENTIALS, rootpass );
try {
// obtain initial directory context using the environment
DirContext ctx = new InitialDirContext( env );
// now, create the root context, which is just a subcontext
// of this initial directory context.
ctx.createSubcontext( rootContext );
} catch ( NameAlreadyBoundException nabe ) {
System.err.println( rootContext + " has already been bound!" );
} catch ( Exception e ) {
System.err.println( e );
I'm badly stuck. can anyone help me out of this... Thanks in advance.
REgards
Harjinder

I am also brand new to Java and JNDI, but here is a sample program that I wrote yesterday that seems to be working.
import java.util.*;
import javax.naming.*;
import javax.naming.directory.*;
public class bind_jndi {
public static void main(String[] args) {
int numberOfArgs = args.length;
if (numberOfArgs!=3) {
System.out.println("Invalid number of parameters\n");
System.out.println("Usage is : bind_jndi ldap_url bindDN password\n");
System.out.println("Where:");
System.out.println(" ldap_url : The LDAP Server to communicate with\n");
System.out.println(" bindDN : The DN to perform the bind with\n");
System.out.println(" password : The password for the above DN\n");
System.out.println("Ex: bind_jndi ldap://localhost:389 cn=userid pswd");
return;
System.out.println("Starting...");
// Set up the environment for creating the initial context
Hashtable env = new Hashtable();
env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
env.put(Context.PROVIDER_URL, args[0]);
// Specify the LDAP protocol version
env.put("java.naming.ldap.version", "3");
// Valid values are 'simple' and 'none'
// 'simple' -> Use clear-text password
// 'none' -> No auth, anonymous
// If the client does not specify any authentication environment
// properties, then the default authentication mechanism is "none".
// The client will then be treated as an anonymous client.
// If the client specifies authentication information without explicitly
// specifying the Context.SECURITY_AUTHENTICATION property, then the
// default authentication mechanism is "simple".
env.put(Context.SECURITY_AUTHENTICATION, "simple");
// Authenticate as Mitch and password "mysecret"
env.put(Context.SECURITY_PRINCIPAL, args[1]);
env.put(Context.SECURITY_CREDENTIALS, args[2]);
try {
// Initiate a bind, if it fails, the 'catch' will print an error
DirContext ctx = new InitialDirContext(env);
System.out.println("Authentication passed");
// Close the connection
ctx.close();
} catch (NamingException e) {
System.err.println("Authentication failed");
String err = e.getExplanation();
System.err.println("Extended message " + err);
Hope this helps.

ORA-31202: DBMS_LDAP: LDAP client/server error: Invalid credentials

Hey Guys,
I have an application with LDAP authentication and a custom login page (pg 101). When I run this app, the login page displays first, logs me in and logs out fine. However, when I branch to this application from another application, the login page shows up with the following error:
ORA-31202: DBMS_LDAP: LDAP client/server error: Invalid credentials
Error ERR-1082 Error in executing authorization scheme code.
I looked at debug and this is happening because when this page is loaded, it goes to my authentication scheme and tries to authenticate me even though I havnt logged in and because no user exists at this point the error happens.
I have set the login page to 'Page is Public' and have also used the following code in the authentication scheme's Page Sentry Function:
IF APEX_CUSTOM_AUTH.CURRENT_PAGE_IS_PUBLIC = TRUE THEN;
RETURN TRUE;
ELSE
RETURN FALSE;
END IF;
Any ideas of how I can stop my login page from being authenticated? Or where I am going wrong
Thanks
-Mark

Jes,
I could get it work !!!! my complete code
DECLARE
l_attributes wwv_flow_global.vc_arr2;
l_attribute_values wwv_flow_global.vc_arr2;
l_msg dbms_ldap.message;
l_entry DBMS_LDAP.message;
l_session DBMS_LDAP.session;
l_ber_element DBMS_LDAP.ber_element;
l_attr dbms_ldap.string_collection;
l_attr_name VARCHAR2(256);
l_vals DBMS_LDAP.string_collection;
retval PLS_INTEGER;
BEGIN
l_session := DBMS_LDAP.init('server', '389');
retval := DBMS_LDAP.simple_bind_s(l_session,'cn=myid,cn=na', 'mypwd');
dbms_output.put_line('Retval -> ' || retval);
l_attr(1) := '*'; -- retrieve all attributes
retval := DBMS_LDAP.search_s(
ld => l_session,
base => 'ou=xx,o=xx',
scope => DBMS_LDAP.SCOPE_SUBTREE,
filter => 'uid=myid',
attrs => l_attr,
attronly => 0,
res => l_msg);
dbms_output.put_line('Retval 2 -> ' || retval);
dbms_output.put_line('msg : ' || l_msg);
IF DBMS_LDAP.count_entries(ld => l_session, msg => l_msg) > 0 THEN
-- Get all the entries returned by our search.
l_entry := DBMS_LDAP.first_entry(ld => l_session,
msg => l_msg);
<< entry_loop >>
WHILE l_entry IS NOT NULL LOOP
-- Get all the attributes for this entry.
DBMS_OUTPUT.PUT_LINE('---------------------------------------');
l_attr_name := DBMS_LDAP.first_attribute(ld => l_session,
ldapentry => l_entry,
ber_elem => l_ber_element);
<< attributes_loop >>
WHILE l_attr_name IS NOT NULL LOOP
-- Get all the values for this attribute.
l_vals := DBMS_LDAP.get_values (ld => l_session,
ldapentry => l_entry,
attr => l_attr_name);
<< values_loop >>
FOR i IN l_vals.FIRST .. l_vals.LAST LOOP
DBMS_OUTPUT.PUT_LINE('ATTIBUTE_NAME: ' || l_attr_name || ' = ' || SUBSTR(l_vals(i),1,200));
END LOOP values_loop;
l_attr_name := DBMS_LDAP.next_attribute(ld => l_session,
ldapentry => l_entry,
ber_elem => l_ber_element);
END LOOP attibutes_loop;
l_entry := DBMS_LDAP.next_entry(ld => l_session,
msg => l_entry);
END LOOP entry_loop;
END IF;
retval := DBMS_LDAP.unbind_s(l_session);
END;
thank you :D

DIServer Login Question - Invalid Credentials Web Service Hangs

Hi everybody,
I was able to successfully configure the DIServer and connect via a web service (similar to the SDK Samples provided). I am now able to login using a valid username/password and the <dis:Login> SOAP message, but if I provide a bad username or password it seems to just hang forever, without returning an 'invalid user/password' message - just nothing. Anyone else have this problem?
The only workaround I can think of now is to just set the timeout on my web request to a short time span with a generic error message. But I'd like to be able to differentiate between invalid credentials and just a problem with the DI Server connection.
Thanks for any help.

Looks like a reboot of the DI Server has fixed the problem. Probably should've tried that before posting.

Sapcontrol - invalid credentials

Hello
we're currently upgrading our PI-System.
Source: SAP-Netweaver PI 7.1 SPS6
Target: SAP-Netweaver PI 7.1 EHP1 SPS 8
In Downtimephase we get the following error:
Could not start AS Java instance with name SCS01 and number 1 of the XITsystem. Could not execute operating system process for action start on
instance 1. Process ID is 17, process name is sapcontrol. Return code
condition success evaluated to false for process sapcontrol for action start.
Next the log-file:
Oct 14, 2011 9:28:36 AM [Info ]: Starting to detect the Jcontrol or JStart process ID for instance SCS01
Oct 14, 2011 9:28:36 AM [Warning]: The dev_jcontrol or dev_jstart file of the central instance was not found under /usr/sap/<SID>/SCS01/work; possible
reason is that the instance was never started before
Oct 14, 2011 9:28:36 AM [Info ]: The JControl process ID for instance SCS01 has been detected.
Oct 14, 2011 9:28:36 AM [Info ]: Process ID 26, name sapcontrol has been started.
Oct 14, 2011 9:28:36 AM [Info ]: Command line: /usr/sap/<SID>/SCS01/exe/sapcontrol -nr 1 -host <HOST> -user <SID>adm <SecureField> -function Start
Oct 14, 2011 9:28:36 AM [Info ]: Standard out: /usr/sap/<SID>/SUM/sdt/log/SUM/SAPCONTROL_START_1ENGINECONTROLLERSERVICE_20.OUT
Oct 14, 2011 9:28:36 AM [Info ]: Process ID 26 has been started.
Oct 14, 2011 9:28:36 AM [Info ]: Waiting for process ID 26, name sapcontrol to finish.
Oct 14, 2011 9:28:36 AM [Info ]: Process ID 26, name sapcontrol has been finished, e<SID> code 1.
Oct 14, 2011 9:28:36 AM [Error ]: The following problem has occurred during step execution com.sap.sdt.util.diag.DiagException: Could not start AS Java instance with name SCS01 and number 1 of the <SID> system.
Could not execute operating system process for action start on instance 1. Process ID is 26, process name is sapcontrol.
Return code condition success evaluated to false for process sapcontrol for action start.
14.10.2011 09:28:36
Start
FAIL: Invalid Credentials
I've added the startprofile parameter:
service/protectedwebmethods = NONE
and adjusted the permissions of the following files:
<HOST>:<SID>adm 790% ls -l sapstartsrv sapuxuserchk
-rwxr-xr-x 1 <SID>adm sapsys 20538968 Aug 6 04:26 sapstartsrv
-rwsr-x--- 1 root sapsys 736896 Okt 14 07:03 sapuxuserchk
<HOST>:<SID>adm 791%
But the error still remains.
Best regards
Christian Kaiser

Hi Christian,
just double check on the permission of kernel exe directory for your AS Java instance with name SCS01, then try to manually run the sapcontrol command to start up the SCS01 manually, with explicitly user/pw option.
Regards,
Vincent

Remove ACI failure: Invalid credentials

# ldapmodify -h hostname -p 1389 -D "cn=Directory Manager" -w Password
dn: o=testdemo.com
changetype: modify
delete: aci
aci: (targetattr="dspswuserlink || dspswloop || dspswvalidate")(version 3.0; acl "deny write access to dspswuserlink, dspswloop, dspswvalidate"; deny(write) userdn="ldap:///self";)
modifying entry o=testdemo.com
ldap_modify: Invalid credentials
ldap_modify: matched: o=testdemo.com

It looks like the "Invalid Credentials" message appears after you have submitted the modification. The best explanation I have for this is that your ldapmodify is getting and following a referral, likely to a server with different rootdn credentials.
Depending on the ldapmodify tool you are using, you may be able to prevent it from following referrals. The Sun tool had the "-R" option for this. Using the verbose argument may also give you information about which server you are getting the referral to.

Invalid Credentials: The Network location cannot be reached

I am working with MDT 2010, and I am getting the error, "Invalid Credentials: The Network location cannot be reached." When I run the LiteTouch 64 bit, I don't think the network is working. It's like there is not driver for the network card in
the LiteTouch 64 bit to make the network connection. When I hit F8 key, it brings a DOS box up for testing, and I found out these things.
- I can ping the loop back address 127.0.0.1.
- Cannot use the net use command to connect to the server share \\server01\DeploymentSahre$.
- I can not ping by name or IP address the server that is holding my Deployment Share.
This is the first time I am working with this technology, and I was following a guide off the Technet library. It almost like I am missing the driver for the network card. I have Windows Deployment installed on server01, the server will answer,
and I am able to put in my user name and password, it accepts and starts loading.
I did figure out how to inject the network drivers into Windows Deployment for the Motherboard I was using, do I have to do the same thing here again? MDT is using the Windows Deployment Images on the server01; MDT is setup on server01. I would have
thought that since the driver was already injected into the Image MDT would use that as well. So, do I need to put a driver into the LiteTouch 64bit image and if I do how do I do that?
thanks very much for your help,
Rick Arnold
ArnoldConsult
Rick Arnold Arnoldconsult, MCP

If you haven't updated the deployment share after adding the proper drivers to OOBD then your LiteTouch boot images will not have them included. Just right click the deployment share and click on Update Deployment Share, it will take a while but it
will rebuild the boot images with the drivers you've included in OOBD. Then it's just a matter of either recreating the flash drives or loading the updated image into WDS.
Another thought:
We had an issue with some HP's that had Main Boards replaced. the BIOS time was WAY off and the UUID wasn't setting itself because the network was denying it access to our servers (because of the horribly wrong time). Once we corrected the time
in the BIOS everything ran fine. The error we got while trying to do the deployment was the same as what you describe and we could still ping various machines on the network too.

Could not connect to Orchestrator web service - Unauthorized: Access is denied due to invalid credentials

I am trying to set up the Orchestrator Connector for Service Manager, when running the test, I get the error
<h2>401 - Unauthorized: Access is denied due to invalid credentials.</h2>
<h3>You do not have permission to view this directory or page using the credentials that you supplied.</h3>
The account I am using is the system account for Service Manager. I have added that account to the local admin group on the Orchestrator server as well as the Orchestrator admin group. But to no avail.
Now when I am logged on to the Orchestrator server locally with my account, I can access the Orchestration Console with no problem, however when I try to connect to it remotely using my account, it will not accept my credentials. I need to sort this out,
can anyone help?
Paul Arbogast

I found the solution, using the IIS Manager I changed the Windows authentication providers by moving NTLM above negotiate.
Paul Arbogast

REP-2103: PL/SQL formula returned invalid value or no value

Hi all,
Before clone the report GEPS FA Prepare Mass Addition Report runs fine. But after cloned from production, it shows error:
Enter Password:
REP-0004: Warning: Unable to open user preference file.
REP-2103: Column 'G_MASS_ADDITION_INVOICE' : PL/SQL formula returned invalid value or no value.
REP-0069: Internal error
REP-57054: In-process job terminated:Terminated with error:
REP-2103: Column 'G_MASS_ADDITION_INVOICE' : PL/SQL formula returned invalid value or no value.
Actually I didn't have such column 'G_MASS_ADDITION_INVOICE'. This is a group name. I tried a lot, such as widden the formula column width or delete the formula column, but it still show this error. I didn't have any trigger or other formula column. Even I create a new report use the same name with a single query( select sysdate from dual), but it still shows the same error.
Is there anyone faced this issue before or can help me ? Thanks
ares
Edited by: 930967 on Jun 13, 2012 12:46 AM

Hi;
Please see:R12 GL Account Balances Across Ledgers (GLRGCBGT) Report Errors With: REP-0004 MSG-00025 MSG-00104 MSG-01221 REP-2103 REP-0069 REP-57054, Program Exited With Status 1 [ID 1316929.1]
Regard
Helios

MDT user credentials error: Invalid credentials: The network path was not found

I have DELL E5400 and DELL Optiplex 760 pc. In the before, DELL630 is working with my MDT service, but now, DELL E5400 and DELL Optiplex 760 not working with my MDT.
When PE loaded and go to User Credentials interface, I input the user name and password(I confirm the user name and password is correct), it will display error message "Invalid credentials: The network path was not found". I checked that the network driver is correct.
After search some information in the website, someone said that maybe the network initializing timeout issue, so I according to Tim Quan guide to add following to startnet.cmd
wpeutil InitializeNetwork
ping localhost
wpeinit
Then I update the deploy location in MDT and then re-loaded it again, but unlucky, I still meet the same issue. I tried to use ipconfig /all command to check the network status, I couldn't find out local network connection. I click "Cancel" to check the error message, it will display"A connection to the deployment share could not be made. The deployment will not proceed. DHCP lease was not obtained for any networking device!Possible cause: check physical connection".
It seems that PE not loaded network driver successfully, but it is very strange that the network driver is correct.
Have someone can help me?
Thanks a lot

Hi,
Are you deploying Windows Vista 32bit or 64bit? Please obtain he latest network card drivers from the following sites:
Dell Latitude E5400:
http://support.dell.com/support/downloads/driverslist.aspx?c=us&cs=19&l=en&s=dhs&ServiceTag=&SystemID=LAT_E5400&os=WLH&osl=en&catid=&impid=
Dell OptiPlex 760:
http://support.dell.com/support/downloads/driverslist.aspx?c=us&cs=19&l=en&s=dhs&ServiceTag=&SystemID=PLX_760&os=WLH&osl=en&catid=&impid=
Please make sure you add the correct network driver to deployment point.
Additional Information:
http://www.techtalkz.com/windows-deployment/501217-deployment-share-connection-issue-since-mdt-2008-waik-1-1-a.html
http://www.deploymentforum.com/Community/Forums/tabid/124/forumid/16/postid/737/view/topic/Default.aspx
Hope it helps.
Tim Quan - MSFT

Scan to Email not working - Invalid Credentials error (using gmail and 2-factor authentication)

I configured the HP OfficeJet 8600 printer for scan to email using the Embedded Web Server interface. In the Web interface, I added/entered an email address for my gmail account, and set the correct SMTP server details, and entered 465 for the port number. I checked the "Always use secure connection" box, as well as the "SMTP requires authentication for outgoing email messages" box. I entered correct SMTP user ID and password. Yet when I did a test, I got an error "Invalid credentials" After a lot of frustration, and trying all sorts of things, I eventually got the idea to try another email account. This time I tried a different email account, a netzero email account, configured the smtp server details for it etc. And this time when I tested the netzero email address it worked. I tried the scan to email on the printer, and it worked for the Netzero email account. it just didnt work for the gmail account. I had a while back turned on 2-factor authentication. I went to gmail settings and requested an "App password" for my HP printer. Google/gmail displayed a 16 character password, which I then entered into the password box in the HP OfficeJet printer Embedded Web Server interface (instead of my usual password), for the gmail account. And this time when I tested the email account - it worked! Problem solved! .. I share this just in case anyone else is having the same problem I had, and is going through the same frustrating experience I endured!

Thank you. This helped TREMENDOUSLY!

Column exist but ResultSet.getString(String) return invalid column name

With oracle 7 db the ResultSet.getString(String) works fine but after the upgrade to oracle 8 db it return invalid column name. ResultSet.getString(int) method works fine.
Is this a bug in the driver?
Thanks
-Reda

Yes I'm 100 % sure that the columns exist.
-RedaWell then maybe it's a bug in the Oracle driver. Lord knows it wouldn't be the first time that's happened.

Suppress HTTP Authentication dialog for invalid credentials

If I want a custom login screen with domain, username and password fields for my AIR application, that uses Basic Authentication on the server, I can use
<code>
URLRequestDefaults.setLoginCredentialsForHost(myDomain, myUsername, myPassword);
</code>
and it works fine. But if I enter invalid credentials, the "built-in" authentication dialog pops up. How can I suppress that? I read somewhere that I could use URLRequestDefaults.authenticate = false; but that just seems to kill the authentication process altogether.
Any ideas?

No, that's not the case. I am talking about the user authentication dialog that is shown whenever you access a member restricted web site.
Through Java, we can pass the user name and password values if we know, and the dialog will not be shown. But, I face the problem in NS 4.7x.
-JP

SSGD 4.40.907 and SLES10-SP1 64bit - Invalid credentials while logging in

Hello everybody.
As a test, I installed SSGD 4.40.907 on a SLES10-SP1 64bit virtual operating system (it's operating using the XEN hypervisor, paravirtualized mode).
The installation went well (I had to copy old libraries - namely, libexpat.so.0.5.0 and libgdbm.so.2.0.0 - from a previous version of SLES + ldconfig) and I was able to get to the login prompt but as soon as I entered the "root" password I got "Invalid credentials".
I tried again (in my test environment, the root password is VERY simple) but no dice; I checked the root password by logging into the system using SSH and it worked fine.
I tried with different local accounts (eg, ttaserv and ttasys) but got the same message.
Please notice that, under the very same piece of HW but using a SLES10-SP1 *32bit* under XEN, everything works as expected so it seems a 64bit OS related issue.
Thanks,
Rob

Casper,
Can you please try the following.
On the protected server please try to remove the account and remove the DPM agent. Reboot, after that please manually reinstall the DPM agent on the protected server -
http://technet.microsoft.com/en-us/library/hh757789.aspx. Run the setdpmserver command and after completing successfully check the account to ensure the following.
1) It is set for the password not to expire and user cannot change password
2) Is included in the following groups, DCOM Distributed Users, DPMRADCOMTrustedMachines, and DPMRADmTrustedMachines.
If that all checks out, please goto the DPM console and tried to attach from the DPM console first and then try the powershell command if the console errors out.
Here are some other things to check as well:
Step 1) Ensure NTLM is working - UNC from DPM to PS and back
Step 2) Ensure DCOM is enabled on protected server - Type DCOMCNFG > Computers > My Computer, right click and select properties, go to Default Properties and ensure "Enable Distributed COM on this computer" is checked
Step 3) Ensure all firewalls have needed ports open -
http://technet.microsoft.com/en-us/library/hh758204.aspx
Step 4) Ensure user account is set to never expire and user cannot change password
Step 5) Try attach from DPM console first then DPM powershell
If that still does not work please ensure you are on the latest DPM patch and try again.
For DPM2012 SP1 that is DPM3.6(Note: you will need to have RU3 installed prior)
4.1.3419.0 - DPM RU3.6 - Hotfix for System Center 2012 SP1 Data Protection Manager (KB2886362)
http://www.microsoft.com/en-us/download/details.aspx?id=40318
4.1.3417.0 - DPM RU3 - Description of Update Rollup 3 for System Center 2012 Service Pack 1
http://support.microsoft.com/kb/2836751
Regards, A.Nadar, This posting is provided "AS IS" with no warranties, and confers no rights.

Netweaver CE 7.1 gives Invalid credentials

Hi,
I am new to SAP NetWeaver Composition Environment 7.1. I tried to install the CE 7.1. when I try to start, it asks me for OS user id and password. The OS user by default is my laptop user id which has admin rights and I don't have a password set. Every time it throws error "invalid credentials" and I am stuck up having no clue.
Appreciate your help.

Hi Naveen,
The systemrequirements.htm page in the download package says:
"Note: If you use a Windows XP account without a password , SAP Management Console can not start/stop your instance via Web Service - use system services instead"
I believe the "Start Application Server" shortcut in the Start Menu should also work in this case.
HTH!
-- Vladimir

Ldapmodify returns Invalid Credentials

Similar Messages

Maybe you are looking for