topic [LDAP: error code 49 - Invalid Credentials] in Windchill

[LDAP: error code 49 - Invalid Credentials]

abaali — Fri, 04 May 2018 13:24:13 GMT

Hello everyone,I'm having trouble starting Windchill. Upon launch, the Server Manager opens and launches the Method Server who opens momentarily and closes.The Method Server log is the following:2017-02-09 07:51:50,556 INFO [main] wt.system.out - ------------------------------------------------------2017-02-09

Re: [LDAP: error code 49 - Invalid Credentials]

SergeyEfimov — Thu, 09 Feb 2017 07:33:55 GMT

Did you make rehost?

Do you have the windchill server with an active directory adapter?

Re: [LDAP: error code 49 - Invalid Credentials]

abaali — Thu, 09 Feb 2017 09:09:10 GMT

I didn't rehost but I think something happened with the same effect. How can I connect (or make sure that it already is) my Windchill Server to an active directory adapter?

Thank you so much..

Ammar

Re: [LDAP: error code 49 - Invalid Credentials]

abaali — Thu, 09 Feb 2017 09:10:44 GMT

I enable more logs and got this:

2017-02-09 10:05:51,138 WARN [main] com.ptc.windchill.keystore.KeyStoreProxy - Creating new keystore

2017-02-09 10:05:51,138 DEBUG [main] com.ptc.windchill.keystore.KeyStoreProxy - Getting a key that does not exist: (encrypted.ie.ldap.managerPw)

2017-02-09 10:05:51,294 INFO [main] wt.system.err - javax.naming.AuthenticationException: [LDAP: error code 49 - Invalid Credentials]

Do you know how Windchill fetches the encryption?

Re: [LDAP: error code 49 - Invalid Credentials]

bkontham — Thu, 09 Feb 2017 10:24:26 GMT

Hi Ammar,

Looks like Windchill is unable to fetch the passwords for Database, LDAP etc. from Keystore files. Did you correct the dbpassword yesterday? Update the Ldap password from site.xconf using xconfmanager and see if you get any other password issue. If so, then you have to recreate the keystore.

Refer the below article to recreate it.

https://support.ptc.com/appserver/cs/view/solution.jsp?n=CS110492

Thanks,

Bhagirath

Re: [LDAP: error code 49 - Invalid Credentials]

SergeyEfimov — Thu, 09 Feb 2017 10:28:55 GMT

May be you need to change password for mapcredentials.admin.adapters

Title	How to change the password of the property mapcredentials.admin.adapters in Windchill PDMLink
Description	How to change the password of the property mapcredentials.admin.adapters
Applies To	Windchill PDMLink 10.0 to 11.0
Cause
Resolution	Refer to your HelpCenter "Credentials Mapping for Adapters", Managing the Credential Task. Use the xconfmanager tool from a Windchill shell xconfmanager --add "mapcredentials.admin.adapters=<JNDI-adapter>^<user cn>^<password>" –p This way the password will be stored encrypted in the Windchill configuration files Alternatively the password can be typed in the site.xconf file directly and then propagated xconfmanager -p This way the password will be stored in clear text in the Windchill configuration files

Re: [LDAP: error code 49 - Invalid Credentials]

abaali — Fri, 10 Feb 2017 10:22:49 GMT

Thanks a lot Bhagirath! I recreated the keystore and got past the error LDAP: error code 49, but I encountered LDAP: error code 53

javax.naming.OperationNotSupportedException: [LDAP: error code 53 - Rejecting the requested operation because the connection has not been authenticated];

I can connect to Windchill DS but something is wrong when Windchill tries to connect to the LDAP upon launch. Any clue?

Thanks again!

Ammar

Re: [LDAP: error code 49 - Invalid Credentials]

abaali — Fri, 10 Feb 2017 10:24:25 GMT

Thank you Sergey, it seems like the definition of my password encryption got erased, not sure why.

I now get error javax.naming.OperationNotSupportedException: [LDAP: error code 53 - Rejecting the requested operation because the connection has not been authenticated];

Did you ever see this?

Re: [LDAP: error code 49 - Invalid Credentials]

SergeyEfimov — Fri, 10 Feb 2017 11:17:00 GMT

The error message "LDAP: error code 53 - Rejecting the requested operation because the connection has not been authenticated" is display in the logs in Windchill PDMLink

https://support.ptc.com/appserver/cs/view/solution.jsp?n=CS77583

Re: [LDAP: error code 49 - Invalid Credentials]

abaali — Mon, 27 Feb 2017 18:52:44 GMT

I appreciate all the responses.

For those with a similar error in the future: I had to roll-back my machine to my latest working state. No solution here fixed my problem..

Good luck,

Ammar

Re: [LDAP: error code 49 - Invalid Credentials]

FrancoisDelys — Fri, 31 Mar 2017 13:19:01 GMT

in addition with jndi you must respect this exact process :

your original map credential file is located at windchill\codebase\WEB-INF\mapCredentials.txt and looks like this if using an enterprise ldap :

mapcredentials.admin.adapters=net.<yourdomain>.Ldap^cn\=<DsAccount>r^encrypted.net.<yourdomain>.Ldap.cn\=<DsAccount>r;net.<yourdomain>.<yourserver>.ldap-pending^cn\=<DsAccount>^encrypted.net.<yourdomain>.<yourserver>.ldap-pending.cn\=<DsAccount>;net.<yourdomain>.EnterpriseLdap^<youraccount>^encrypted.net.<yourdomain>.EnterpriseLdap.<youraccount>
mapcredentials.nonprivileged.adapters=

The new map credential will erase the old one, using the shell, ldap info per ldap info, ie : ldap, pending then after ldap and ending with enterprise ldap.

caution : input the "-" with your keyboard rather than copy paste in the shell. the "<>" must be replaced with "your data".

open a windchill shell and type :

xconfmanager -t codebase/WEB/mapCredentials.txt -s "mapcredentials.admin.adapters=net.<yourdomain>.EnterpriseLdap^CN=<youraccount>,OU=<depending on your enterprise ldap orgs>,OU=< same specific> -,DC=<yourdomaindc>,DC=net^<yourpassword>"

hit enter, the shell will display :

Default product root=[...]Windchill\bin\.. java -jar "[...]Windchill\bin\..\codebase\WEB-INF\lib\install.jar" -r "[...]Windchill\bin\.." -t codebase/WEB/mapCredentials.txt -s "mapcredentials.admin.adapters=net.yourdomain.EnterpriseLdap^CN=<youraccount>,OU=<depending on your enterprise ldap orgs>,OU=< same specific> -,DC=<yourdomain dc>,DC=net^<yourpassword>"

then type

xconfmanager -t codebase/WEB-INF/mapCredentials.txt --add "mapcredentials.admin.adapters=net.<yourdomain>.Ldap^cn=<DsAccount>^<DsPassword>"

hit enter, the shell will display :

Default product root=[...]Windchill\bin\.. java -jar "[...]Windchill\bin\..\codebase\WEB-INF\lib\install.jar" -r "[...]Windchill\bin\.." -t codebase/WEB-INF/mapCredentials.txt --add "mapcredentials.admin.adapters=net.yourdomain.Ldap^cn=<DsAccount>^<DsPassword>"

then type

xconfmanager -t codebase/WEB-INF/mapCredentials.txt --add "mapcredentials.admin.adapters=net.<yourdomain>.<yourserver>.ldap-pending^cn=<DsAccount>^<DsPassword>"

hit enter, the shell will display :

then type

xconfmanager -p

then restart apache an windchill.