LDAP Connector is Offline

Knowledge Articles
, ,
1

Overview

This article explains a potential cause of the following error after executing the LDAP "node troubleshoot.js" script.

“Local and server certificates don’t match”

Here is an example of the output from the command.

C:\Program Files (x86)\Auth0\AD LDAP Connector>node troubleshoot.js

 Troubleshooting AD LDAP connector

Reading CA certificates from Windows Store
Adding 40 certificates
16:36:29 - info: No proxy server configured.
16:36:29 - info: * Testing connectivity to Auth0...
16:36:29 - info:   > Test endpoint: https://example.eu.auth0.com/
test
16:36:29 - info: √ Connection to test endpoint succeeded.
16:36:29 - info: * Testing hub connectivity (WS).
16:36:29 - info: √ Connection to hub succeeded.
16:36:29 - info: * Testing clock skew...
16:36:30 - info: √ Everything OK. No clock skew detected.
16:36:30 - info: * Testing certificates...
16:36:30 - info:   > Local thumbprint: 17b601ccf1b262a3e7a11455ab313fe312c2d850
16:36:30 - info:   > Server thumbprint: fbe58997763540eaeb98eb7129acecda42f00f1f

16:36:30 - error: x Local and server certificates don't match.
1
16:36:30 - info:   > The command completed successfully
16:36:30 - info: * Testing SSL connectivity to LDAP.
16:36:30 - info: * Testing LDAP connectivity.
16:36:30 - info:   > LDAP BASE: DC=contoso,DC=com
16:36:30 - error: x Connection to LDAP failed.
16:36:30 - error:   > Error: error:06065064:digital envelope routines:EVP_Decryp
tFinal_ex:bad decrypt
16:36:30 - info: Done!

Press any key to continue . . .

Applies To

  • AD LDAP Connector
  • node troubleshoot.js script
  • Certificates

Cause

There is a mismatch between the local and the server certificates.

Solution

If the certificates from the previous installation are still available, replacing the certificates from the current installation with those from the old one will solve the issue.

Otherwise it’s necessary to regenerate them per the steps below:

  1. Back up config.json located in the AD/LDAP connector directory.
  2. Make a note of the provisioning ticket URL (PROVISIONING_TICKET ) from the config.json file.
  3. Reset config.json by clearing the following configuration keys:
  • PROVISIONING_TICKET
  • LDAP_BIND_CREDENTIALS
  • SERVER_URL
  • LAST_SENT_THUMBPRINT
  • TENANT_SIGNING_KEY
  1. Remove the certificates and thumbprint from the connection:
  2. Retrieve the connection object using the management API.
  3. Remove the certs and thumbprint attributes and patch the connection using the object as the payload:
  4. Delete the certificates folder in the AD/LDAP connector directory.
  5. Open the AD/LDAP Admin Console.
  6. Enter provisioning ticket URL noted in step 2.
  7. Enter the admin password and click Save.
  8. Start the AD/LDAP connector.

Related References