Users Cannot Authenticate via Active Directory

 

Issue

Installation completed successfully and Predict! is running, but users who authenticate via Active Directory (LDAP) cannot log in.

• Users who authenticate via the Predict! database are unaffected.

 

Solution

Step 1 — Test connectivity to the Active Directory server

1. On the Predict! application server, open Command Prompt.
2. Run the following command: 
   1. telnet [AD_Server_Address]:[port] 
      • where [AD_Server_Address] =the Active Directory server and [port]= 389 for LDAP and 636 for LDAPS
3. If the connection is refused or times out, the Active Directory server is not reachable from the application server on that port.
   1. Contact the network team to open the required port.
4. If the connection succeeds, proceed to Step 2.

 

Step 2 — Verify the LDAP configuration in standalone.xml

• Open: \prc6\wf26\standalone\configuration\standalone.xml in a text editor.
• Locate the <dir-context> element and confirm the following are correct:

    url — the LDAP server address and port

    principal — the bind account in the correct format

    clear-text — the bind account password

• Locate the <ldap-realm> element named raw-ldap-realm
• Confirm the search-base-dn matches the correct Active Directory organisational unit path.
• Save the file and restart the Predict! service.

 

Step 3 — Confirm user accounts exist in Predict!

Any user authenticating via Active Directory must also be present as a user in the Predict! database. The Predict! username must match the Active Directory sAMAccountName exactly.

• Log in to Predict! as ADMIN.
• Navigate to user management and confirm the affected user account exists, and the username matches their Active Directory account name.

 

Note: The AD login module must always be placed last in the authentication chain in standalone.xml. If it is placed before the database module, failed AD authentication attempts may lock the user's Active Directory account.

 

Troubleshooting

• If using LDAPS (port 636), confirm the LDAP server's SSL certificate has been imported into PRA's trust store using InstallCert.
  • See the Authentication Configuration article for details.
• If the LDAP server returns redirects
  • add referral-mode="follow" to the <dir-context> element in standalone.xml.
• If multiple domains are in use
  • each requires its own <ldap-realm>, <caching-realm>, and <dir-context> configuration.
  • Refer to the Authentication Configuration article for multi-domain setup.