Maximo Open Forum

 View Only
  • 1.  LDAP over SSL

    Posted 3 days ago

    Gentlemen experts, good health to all!
    I need some advice!
    I had LDAP authentication configured via the standard port 389.
    I need to configure LDAP over SSL. I'm setting the SSLEnabled parameter to true. I'm changing the connection port to 636.
    I'm getting an error in the log. I'd like to know how to fix this?
    [INFO] [MAXIMO] [CID-CRON-3632] Correlation started, correlation data added: InstanceName:LDAPS-TEST TaskName:LDAPSYNC Activity:ACTION
    [10.03.26 20:04:27:617 MSK] 000000f7 SystemOut O Mar 10, 2026 20:04:27:613 [ERROR] [MAXIMO] [CID-CRON-3632] BMXAA6765E - The LdapSyncCronTask cron task could not be started. This message will be repeated if the initialization fails when the task runs again. See the associated message.
    psdi.security.ldap.LdapSyncException: BMXAA6774W - The rootDSE attribute for attribute name highestCommittedUSN was not found. 
    at psdi.security.ldap.ads.ActiveDirectorySynchronizer.getRootDSEAttributeValue(ActiveDirectorySynchronizer.java:731) ~[businessobjects.jar:?] 
    at psdi.security.ldap.ads.ActiveDirectorySynchronizer.determineSynchronizationNeed(ActiveDirectorySynchronizer.java:617) ~[businessobjects.jar:?] 
    at psdi.security.ldap.AbstractLdapSynchronizer.performSync(AbstractLdapSynchronizer.java:278) ~[businessobjects.jar:?] 
    at psdi.security.ldap.LdapSyncTask.performTask(LdapSyncTask.java:391) ~[businessobjects.jar:?] 
    at psdi.security.ldap.LdapSyncCronTask.cronAction(LdapSyncCronTask.java:262) [businessobjects.jar:?]


    #EverythingMaximo

    ------------------------------
    Sergey Melnikov
    RusNet
    ------------------------------


  • 2.  RE: LDAP over SSL

    Posted 3 days ago

    You want to ensure you follow the instructions here: Authentication error when running LDAPSYNC.

    In addition to the port that you connect to LDAP on, there is a catalog port that it uses to try and traverse the forest. If you have a VPN (in a cloud environment), you'll need to ensure the port access is opened as well. 

    I personally prefer using VMMSync rather than LDAPSync. This would connect to WebSphere to pull users and groups rather than requiring duplicate LDAP configuration (in WebSphere and Maximo) and avoid the use of the global catalog port and such. But if you were previously using LDAP sync it's certainly easier to get it to work over SSL than switching your process. 



    ------------------------------
    Steven Shull
    Naviam
    ------------------------------



  • 3.  RE: LDAP over SSL

    Posted 3 days ago

    Steven, thank you very much for your reply!
    Sorry, I should have described my configuration first.
    Maximo 7.6.1.3 is on the local network and runs on Windows Server 2025.
    I tried connecting via SSL through Websphere.
    To do this, I pulled the certificate from the port, specified the AD server IP address and port 636, enabled the SSL checkbox, entered the username and password of a user who can read AD, and received an error when attempting a test connection.
    SECJ7340E: An exception occurred while trying to connect to the LDAP server. Exception Name=javax.naming.CommunicationException Reason=192.168.80.14:636 ***** LdapSearch Input Parameters ***** hostName=192.168.100.11 portNumber=636 sslEnabled=true sslAlias=CellDefaultSSLSettings baseDN=DC=vr,DC=local bindDN=maxbind bindPwd=***** bindAuthMechanism=simple searchFilter=cn=* searchLimit=20 referral=ignore searchScope=sub



    ------------------------------
    Sergey Melnikov
    RusNet
    ------------------------------



  • 4.  RE: LDAP over SSL

    Posted 2 days ago

    IP addresses on insecure ports are OK, but when you use LDAPS, you'll have a hostname mismatch where your certificate will be for a DNS, not an IP address. Your certificate might be issued to ad1.myorg.com for example. If you can't utilize that DNS from the server, you'll need to create a host entry on the server mapped back to the IP address so that it passes. 



    ------------------------------
    Steven Shull
    Naviam
    ------------------------------



  • 5.  RE: LDAP over SSL

    Posted 2 days ago

    Steven, thank you so much for your reply. Your comment about DNS is very valuable and fair. I'll delegate this to the network administrator.
    Recently, I've made it so everyone uses only IP addresses without DNS names. There was a time when the network administrator couldn't fix DNS for two weeks, which was quite inconvenient.



    ------------------------------
    Sergey Melnikov
    RusNet
    ------------------------------



  • 6.  RE: LDAP over SSL

    Posted 2 days ago

    Besides requiring a FQDN, you might ask your server/network admin if you have a load balancer handling the security certificate. This is common in enterprise settings. I see two IP addresses, which could mean one of them is the load balancer. After you use FQDN (fully qualified domain name), you may get another error message to help you narrow the error down.



    ------------------------------
    sun kim
    ------------------------------



  • 7.  RE: LDAP over SSL

    Posted 2 days ago

    Sun Kim, good day!
    Thanks for your reply.
    No, there's no balancer. It's my fault. I entered the wrong IP address. This happens when you're multitasking.
    Here's the error with the correct IP addresses.
    These are the addresses of the server hosting the AD.

    SECJ7340E: An exception occurred while trying to connect to the LDAP server. Exception Name=javax.naming.CommunicationException Reason=192.168.80.14:636 ***** LdapSearch Input Parameters ***** hostName=192.168.80.14 portNumber=636 sslEnabled=true sslAlias=managed baseDN=DC=vr,DC=local bindDN=maxbind bindPwd=***** bindAuthMechanism=simple searchFilter=cn=* searchLimit=20 referral=ignore searchScope=sub



    ------------------------------
    Sergey Melnikov
    RusNet
    ------------------------------



  • 8.  RE: LDAP over SSL

    Posted 2 days ago

    If you're going to use Secure LDAP, you can't use IP address. It has to be a fully qualified domain name (FQDN) - for example, maximo.rusnet.com 



    ------------------------------
    sun kim
    ------------------------------



  • 9.  RE: LDAP over SSL

    Posted yesterday

    sun kim
    Good day!
    Thank you for your reply!
    The server is on the local network, so its name is SRV04.vr.local. I tried a test request and got this error.
    Apparently, the server administrator doesn't have SSL enabled.
    SECJ7340E: Exception occurred while trying to connect to the LDAP server. Exception Name=javax.naming.CommunicationException Reason=SRV04.vr.local:636 ***** LdapSearch Input Parameters ***** hostName=SRVH04.vr.local portNumber=636 sslEnabled=true sslAlias=CellDefaultSSLSettings baseDN=DC=vr,DC=local bindDN=maxbind bindPwd=***** bindAuthMechanism=simple searchFilter=cn=* searchLimit=20 referral=ignore searchScope=sub



    ------------------------------
    Sergey Melnikov
    RusNet
    ------------------------------