Unable to login to DPA-Login failed: Error occurred while authenticating AD/LDAP user (SunCertPathBuilderExeption)

4/7/2021 6:04 PM

4/30/2025 5:33 PM

This error can occur if:

• DPA is configured for LDAP of AD over SSL.
• The certificate that was imported into DPA's trust store was not the root certificate for the domain or the certificate has expired. 

This article applies to both Active Directory and other LDAP implementations. AD and LDAP often use different terms to indicate the same thing, so for simplicity, this article will use AD terminology. So for example, LDAP users should know that a “domain controller” means an LDAP Server in their environment.

Database Performance Analyzer

There can be a few causes:
One of the causes could be because the certificate that DPA has in the trust store has expired and it just needs to be refreshed or reimported. 

The more common cause is that when the AD/LDAP wizard was used to configure the connection, SSL was used and DPA will attempt to import the root certificate for the domain by searching the most common paths for this certificate. If the root certificate is not found, it will often offer to import one from a single Domain controller or server. Authentication works for a time but, not consistently. It gives the error above if DPA connects to any other Domain controller where the certificate is not imported or not trusted. 

An error may be in the DPA home /tomcat/logs folder in the wizard.log file or auth.log file such as:
java.security.cert.CertificateException: No subject alternative DNS name matching  [sample domain.com] found. 

First, you need to have a way into DPA. If this issue is happening, the best path to login to DPA is to use the repository owner account. This can be found in the repo.properties file of your DPA install. This user is the connection to the DPA database and the default admin.
To reset the password for this user, if it isn't known, follow this KB article.

If DPA is on a SQL server repository and the user is using windows authentication, this account will also get this error. If this is the case, the best path is to temporarily disable AD/LDAP for DPA. 
[New KB on steps needed.]

To resolve the issue, we need to know what cert was imported. If it wasn't the root certificate, we need to either import that certificate or import the server certificate that is lower level then set DPA to only connect to trusted servers. 

One way to know what servers DPA can connect to from a Windows install is to run the command line command 

nltest /dclist: yourDomain 

When I run this local, I get a list of DCs that I can connect to for our test lab domain.



Next, you need to know what is in the trust store for the DPA install. What did we import? 
If you also from command line cd to the path shown and use the keytool.exe file you can output what is in the trust store in DPA. open a command line in the following path example is used as E:\Program Files\Solarwinds\DPA\iwc\jre\bin 
The following command will output what is in the trust store to a file in the tomcat logs directory. 

keytool -list -v -keystore "E:\Program Files\Solarwinds\DPA\iwc\tomcat\ignite_config\security\dpa-truststore.jks" > "E:\Program Files\Solarwinds\DPA\iwc\tomcat\logs\keystore.txt

You should see "Enter keystore password:"
The default one is "changeit" with out the quotes  this should put a file called keystore.txt on the logs folder.
If it is found that you only have one cert for one of the servers in the list from the first command and it is not the root certificate. 

In DPA versions after 2019.4 there is an option to import a certificate to the trust store in the web console. 
Options -> Trusted Certificate Management. There you will see "import certificates" if you can import the correct one it should fix this issue. That or you can enter a server name in the wizard one at at time and DPA if it should offer to import the server level certificate for any it is missing.  

If this is done you will want to have DPA's server.properties file only list the servers where it has the certificates that are imported as trusted. as outlined in this KB article

If DPA is not version 2019.4 importing can only be done in the AD LDAP wizard or using the keytool above a list of commands can be found here. 
https://docs.oracle.com/javase/8/docs/technotes/tools/unix/keytool.html