• State Verified Answer
  • Replies replies
    23
  • Subscribers subscribers
    28
  • Views views
    702
  • Users 0 members are here

dxcmd login fails, ldap and imonitor work in IDM 4.8.7 - unable to update IDM/IDV to the version 4.9

mjuricek

Hi,

I want to update my IDM lab to the version 4.9, but it does not work. eDir/IDV update fails.

%%% Get the administrator credentials -

Enter administrator DN for instance /etc/opt/novell/eDirectory/conf/nds.conf (e.g: cn=admin.o=administrators): cn=admin.ou=sa.o=system

Enter administrator password for instance /etc/opt/novell/eDirectory/conf/nds.conf:

Login for cn=admin.ou=sa.o=system.MY_IDM_DEMO_TREE: failed, invalid request (-641)

Bad password

but I am sure the PW was correct. Then I tried to use dxcmd to verify the password and it failed as well.

NetIQ Identity Manager Command Line Utility

version 4.8.7.0100

Copyright (c) 2023 NetIQ Corporation. All Rights Reserved

Enter user name: admin.sa.system

Enter user's password:

Logging in using:

        host: my-idm-demo/192.168.1.250:524

        user: admin.sa.system

Using NDAP protocol

novell.jclient.JCException: login -641 ERR_INVALID_REQUEST

        at novell.jclient.JCContext.login(Native Method)

        at com.novell.nds.dirxml.util.DxCommand.jclientLogin(DxCommand.java:1173)

        at com.novell.nds.dirxml.util.DxCommand.login(DxCommand.java:1121)

        at com.novell.nds.dirxml.util.DxCommand.commandLine(DxCommand.java:560)

        at com.novell.nds.dirxml.util.DxCommand.main(DxCommand.java:522)

So, it looks the issue in the authentication process but I have no clue what is wrong. Login works over LDAP, and login works in iMonitor too.

Because Lothar had a similar issue a few years ago, I tried:

dxcmd -host 192.168.1.250 -user admin.sa.system -password myPassword

...but it did not work.

Any idea what's wrong?

Milan

  • 0  

    Any chance there is a funny character that would break a script like & or \ in the password? Make another admin user with a simpler password and try that first?

  • 0 in reply to   

    no, no special characters. I also created a new "badmin" and made it a supervisor in eDir. Still, the same. I wonder whether there is a conflict in some libraries or so. I did an update from 4.8.6 to 4.8.7 first...

  • 0 in reply to   

    ...this is weird. Login works when I run dxcmd as a normal user.

    I put some debug message in the dxcmd command:

    ...

echo "===== DUBUG ====="

echo $dirxml

echo $cp

echo $LD_LIBRARY_PATH

$JAVA -version

echo "================="

....


    ##### NOT WORKING example #####

    mf-idm-demo:~ # dxcmd

===== DUBUG =====

/opt/novell/eDirectory/bin/../lib/dirxml/classes

/opt/novell/eDirectory/bin/../lib/dirxml/classes/dirxml_misc.jar:/opt/novell/eDirectory/bin/../lib/dirxml/classes/nxsl.jar:/opt/novell/eDirectory/bin/../lib/dirxml/classes/xp-1.0.0.jar:/opt/novell/eDirectory/bin/../lib/dirxml/classes/ldap.jar:/opt/novell/eDirectory/bin/../lib64/jclient.jar

/opt/novell/eDirectory/bin/../lib64:/opt/novell/eDirectory/bin/../lib64/nds-modules:/opt/novell/eDirectory/bin/../../lib64:/opt/novell/eDirectory/bin/../lib64/jclnt:

openjdk version "11.0.19" 2023-04-18 LTS

OpenJDK Runtime Environment Zulu11.64+19-CA (build 11.0.19+7-LTS)

OpenJDK 64-Bit Server VM Zulu11.64+19-CA (build 11.0.19+7-LTS, mixed mode)

=================



NetIQ Identity Manager Command Line Utility

version 4.8.7.0100

Copyright (c) 2023 NetIQ Corporation. All Rights Reserved



Enter user name: admin.sa.system

Enter user's password:

Logging in using:

        host: mf-idm-demo/192.168.1.250:524

        user: admin.sa.system

Using NDAP protocol

novell.jclient.JCException: login -641 ERR_INVALID_REQUEST

        at novell.jclient.JCContext.login(Native Method)

        at com.novell.nds.dirxml.util.DxCommand.jclientLogin(DxCommand.java:1173)

        at com.novell.nds.dirxml.util.DxCommand.login(DxCommand.java:1121)

        at com.novell.nds.dirxml.util.DxCommand.commandLine(DxCommand.java:560)

        at com.novell.nds.dirxml.util.DxCommand.main(DxCommand.java:522)

    ##### WORKING example #####

    mjuricek@mf-idm-demo:~> dxcmd

===== DUBUG =====

/opt/novell/eDirectory/bin/../lib/dirxml/classes

/opt/novell/eDirectory/bin/../lib/dirxml/classes/dirxml_misc.jar:/opt/novell/eDirectory/bin/../lib/dirxml/classes/nxsl.jar:/opt/novell/eDirectory/bin/../lib/dirxml/classes/xp-1.0.0.jar:/opt/novell/eDirectory/bin/../lib/dirxml/classes/ldap.jar:/opt/novell/eDirectory/bin/../lib64/jclient.jar

/opt/novell/eDirectory/bin/../lib64:/opt/novell/eDirectory/bin/../lib64/nds-modules:/opt/novell/eDirectory/bin/../../lib64:/opt/novell/eDirectory/bin/../lib64/jclnt:

openjdk version "11.0.19" 2023-04-18 LTS

OpenJDK Runtime Environment Zulu11.64+19-CA (build 11.0.19+7-LTS)

OpenJDK 64-Bit Server VM Zulu11.64+19-CA (build 11.0.19+7-LTS, mixed mode)

=================



NetIQ Identity Manager Command Line Utility

version 4.8.7.0100

Copyright (c) 2023 NetIQ Corporation. All Rights Reserved



Enter user name: admin.sa.system

Enter user's password:

Logging in using:

        host: mf-idm-demo/192.168.1.250:524

        user: admin.sa.system

Using NDAP protocol

DirXML version is 4.8.7.0000 AE.

Driver set driverset1.system.MF_IDM_DEMO_TREE. is associated with the server.





DirXML commands



 1: Start driver

 2: Stop driver

 3: Driver operations...

 4: Driver set operations...

 5: Log events operations...

 6: Get DirXML version

 7: Job operations...

 8: Get JVM statstics

99: Quit

    It looks the dxcmd is using the same variables, so I do not understand what's different and why it does not work when I am the root user.

    Any idea?

  • 0   in reply to 

    641 errors seem to usually be related to functions related to IDM that are not working/supported. So if you did not install a driver on some server and make an IDM call (LDAP or NDAP) to use that function you get a 641.

    There are no major schema extensions between 4.8.6 and 4.8.7 (There must be some in4.9 due to changes in how some passwords are stored).  I woudl wonder if you tried a different target host, mayeb it has different IDM modules loaded?

  • 0 in reply to   

    But it does not work when I am using root or sudo, but it works when I am logged it as a normal user. This is so weird.

  • 0   in reply to 

    Probably because root or sudo do not have the paths properly set?  I.e. The context for users vs the context for root may have different environments...  So perhaps the library path is not properly set for root?  Maybe binary paths are incorrect?

    I think it was ndsstat that would update the path locally, so you might need to sudo ndsstat   and then on the same command line (Syntax for joinging commands elludes me) execute dxcmd.

  • 0  

    Enter administrator password for instance /etc/opt/novell/eDirectory/conf/nds.conf:

    Login for cn=admin.ou=sa.o=system.MY_IDM_DEMO_TREE: failed, invalid request (-641)

    Bad password

    That means that your password is wrong, it could be that it has expired, it could be that the account is locked.

    The best tool to verify the password is 'ndslogin':

    $ ndslogin admin.sa.system <enter>

    Provide password, if that does not work, then try to change the password and see if it then works.

    Otherwise have a look at "ndstrace +time +tags +nmas +auth +misc"  to see if there is something interesting being shown.

  • 0 in reply to 

    is it a docker container? they use a local user for all the nds utils 

  • 0 in reply to 

    no, it is installed on SLES

  • 0 in reply to   

    mf-idm-demo:~ # ndslogin -t MF_IDM_DEMO_TREE admin.sa.system

    Password:

    Login for admin.sa.system.MF_IDM_DEMO_TREE: failed, invalid request (-641)

    mf-idm-demo:~ # logout

    mjuricek@mf-idm-demo:~> ndslogin -t MF_IDM_DEMO_TREE admin.sa.system

    Password:

    eDirectory Login: logged in as .CN=admin.OU=sa.O=system.MF_IDM_DEMO_TREE.

    mjuricek@mf-idm-demo:~>

    ...as you can see, it works well when I login from non-privilege user's Linux profile. But not from root. I checked the paths and they look the same.

    Here are my env. variables in the working user's profile:

    mjuricek@mf-idm-demo:~> printenv
LS_COLORS=no=00:fi=00:di=01;34:ln=00;36:pi=40;33:so=01;35:do=01;35:bd=40;33;01:cd=40;33;01:or=41;33;01:ex=00;32:*.cmd=00;32:*.exe=01;32:*.com=01;32:*.bat=01;32:*.btm=01;32:*.dll=01;32:*.tar=00;31:*.tbz=00;31:*.tgz=00;31:*.rpm=00;31:*.deb=00;31:*.arj=00;31:*.taz=00;31:*.lzh=00;31:*.lzma=00;31:*.zip=00;31:*.zoo=00;31:*.z=00;31:*.Z=00;31:*.gz=00;31:*.bz2=00;31:*.tb2=00;31:*.tz2=00;31:*.tbz2=00;31:*.xz=00;31:*.avi=01;35:*.bmp=01;35:*.dl=01;35:*.fli=01;35:*.gif=01;35:*.gl=01;35:*.jpg=01;35:*.jpeg=01;35:*.mkv=01;35:*.mng=01;35:*.mov=01;35:*.mp4=01;35:*.mpg=01;35:*.pcx=01;35:*.pbm=01;35:*.pgm=01;35:*.png=01;35:*.ppm=01;35:*.svg=01;35:*.tga=01;35:*.tif=01;35:*.webm=01;35:*.webp=01;35:*.wmv=01;35:*.xbm=01;35:*.xcf=01;35:*.xpm=01;35:*.aiff=00;32:*.ape=00;32:*.au=00;32:*.flac=00;32:*.m4a=00;32:*.mid=00;32:*.mp3=00;32:*.mpc=00;32:*.ogg=00;32:*.voc=00;32:*.wav=00;32:*.wma=00;32:*.wv=00;32:
HOSTTYPE=x86_64
XAUTHLOCALHOSTNAME=mf-idm-demo
LESSCLOSE=lessclose.sh %s %s
XKEYSYMDB=/usr/X11R6/lib/X11/XKeysymDB
LANG=en_SK.UTF-8
WINDOWMANAGER=xterm
LESS=-M -I -R
DISPLAY=localhost:10.0
HOSTNAME=mf-idm-demo
CSHEDIT=emacs
GPG_TTY=/dev/pts/0
LESS_ADVANCED_PREPROCESSOR=no
COLORTERM=1
MACHTYPE=x86_64-suse-linux
MINICOM=-c on
OSTYPE=linux
XDG_SESSION_ID=1
USER=mjuricek
PAGER=less
TEXTDOMAINDIR=/opt/novell/eDirectory/share/locale
MORE=-sl
PWD=/home/mjuricek
HOME=/home/mjuricek
HOST=mf-idm-demo
XNLSPATH=/usr/X11R6/lib/X11/nls
XDG_DATA_DIRS=/usr/share
LIBGL_DEBUG=quiet
PROFILEREAD=true
SSH_TTY=/dev/pts/0
FROM_HEADER=
MAIL=/var/mail/mjuricek
LESSKEY=/etc/lesskey.bin
TERM=xterm-256color
SHELL=/bin/bash
LS_OPTIONS=-N --color=tty -T 0
PYTHONSTARTUP=/etc/pythonstart
SHLVL=1
MANPATH=/usr/local/man:/usr/share/man:/opt/novell/man:/opt/novell/man:/opt/novell/eDirectory/man:/usr/share/man:/usr/local/man:/usr/X11R6/man:/opt/gnome/share/man:/usr/man
LOGNAME=mjuricek
DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus
XDG_RUNTIME_DIR=/run/user/1000
XDG_CONFIG_DIRS=/etc/xdg
PATH=/home/mjuricek/bin:/usr/local/bin:/usr/bin:/bin:/usr/lib/mit/bin:/opt/novell/eDirectory/bin:/opt/novell/eDirectory/sbin
G_BROKEN_FILENAMES=1
HISTSIZE=1000
CPU=x86_64
SSH_SENDS_LOCALE=yes
LESSOPEN=lessopen.sh %s
BASH_FUNC_mc%%=() {  . /usr/share/mc/mc-wrapper.sh
}
_=/usr/bin/printenv

    Here root's env. variables:

    mf-idm-demo:~ # printenv
LS_COLORS=no=00:fi=00:di=01;34:ln=00;36:pi=40;33:so=01;35:do=01;35:bd=40;33;01:cd=40;33;01:or=41;33;01:ex=00;32:*.cmd=00;32:*.exe=01;32:*.com=01;32:*.bat=01;32:*.btm=01;32:*.dll=01;32:*.tar=00;31:*.tbz=00;31:*.tgz=00;31:*.rpm=00;31:*.deb=00;31:*.arj=00;31:*.taz=00;31:*.lzh=00;31:*.lzma=00;31:*.zip=00;31:*.zoo=00;31:*.z=00;31:*.Z=00;31:*.gz=00;31:*.bz2=00;31:*.tb2=00;31:*.tz2=00;31:*.tbz2=00;31:*.xz=00;31:*.avi=01;35:*.bmp=01;35:*.dl=01;35:*.fli=01;35:*.gif=01;35:*.gl=01;35:*.jpg=01;35:*.jpeg=01;35:*.mkv=01;35:*.mng=01;35:*.mov=01;35:*.mp4=01;35:*.mpg=01;35:*.pcx=01;35:*.pbm=01;35:*.pgm=01;35:*.png=01;35:*.ppm=01;35:*.svg=01;35:*.tga=01;35:*.tif=01;35:*.webm=01;35:*.webp=01;35:*.wmv=01;35:*.xbm=01;35:*.xcf=01;35:*.xpm=01;35:*.aiff=00;32:*.ape=00;32:*.au=00;32:*.flac=00;32:*.m4a=00;32:*.mid=00;32:*.mp3=00;32:*.mpc=00;32:*.ogg=00;32:*.voc=00;32:*.wav=00;32:*.wma=00;32:*.wv=00;32:
HOSTTYPE=x86_64
LESSCLOSE=lessclose.sh %s %s
XKEYSYMDB=/usr/X11R6/lib/X11/XKeysymDB
LANG=POSIX
WINDOWMANAGER=xterm
LESS=-M -I -R
HOSTNAME=mf-idm-demo
CSHEDIT=emacs
GPG_TTY=/dev/pts/0
LESS_ADVANCED_PREPROCESSOR=no
COLORTERM=1
MACHTYPE=x86_64-suse-linux
MINICOM=-c on
OSTYPE=linux
USER=root
PAGER=less
TEXTDOMAINDIR=/opt/novell/eDirectory/share/locale
MORE=-sl
PWD=/root
HOME=/root
LC_CTYPE=en_US.UTF-8
HOST=mf-idm-demo
XNLSPATH=/usr/X11R6/lib/X11/nls
XDG_DATA_DIRS=/usr/share
PROFILEREAD=true
FROM_HEADER=
MAIL=/var/spool/mail/root
LESSKEY=/etc/lesskey.bin
TERM=xterm-256color
SHELL=/bin/bash
LS_OPTIONS=-A -N --color=tty -T 0
PYTHONSTARTUP=/etc/pythonstart
SHLVL=1
MANPATH=/usr/share/man:/usr/local/man:/opt/novell/man:/opt/novell/man:/opt/novell/eDirectory/man:/usr/share/man:/usr/local/man:/usr/X11R6/man:/opt/gnome/share/man:/usr/man
LOGNAME=root
XDG_CONFIG_DIRS=/etc/xdg
PATH=/sbin:/usr/sbin:/usr/local/sbin:/root/bin:/usr/local/bin:/usr/bin:/bin:/usr/lib/mit/bin:/opt/novell/eDirectory/bin:/opt/novell/eDirectory/sbin
G_BROKEN_FILENAMES=1
HISTSIZE=1000
CPU=x86_64
LESSOPEN=lessopen.sh %s
BASH_FUNC_mc%%=() {  . /usr/share/mc/mc-wrapper.sh
}
_=/usr/bin/printenv

    I did not see much in the ndsstrace. Actually nothing. Like the login request even does not go there. But I will check one more time. 

    I also tried to force reinstallation of eDir but it did not help. I hoped it will fix something, but no.

Resources

Support
Documentation
Learning Services
Partner Programs
Privacy
Compliance
Help
Company
Privacy Policy
Terms of Use
Cookies Preferences
Accessibility
Anti-Slavery Statement
Support
Contact Us
Careers
Code of Business Conduct and Ethics
The opinions expressed above are the personal opinions of the authors, not of OpenText. By using this site, you accept the Terms of Use. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.), Hewlett Packard Enterprise Company, or Micro Focus. As of January 31, 2023, the Material is now offered by OpenText, a separately owned and operated company. Any reference to the HP, Hewlett Packard Enterprise/HPE, and Micro Focus marks is historical in nature and the HP, Hewlett Packard Enterprise/HPE, and Micro Focus marks are the property of their respective owners.