Troubleshooting LDAP-Erros in vCO

VMware vCenter Orchestrator uses LDAP in different flavors:

  • For its own User Authentication (configured in the webbased configuration utility)
  • inside Workflows, e.g. when getting information about the user who started the workflow via Server.getCurrentLdapUser()
  • in Plugins (e.g. the vCO-Plugin fo Microsoft Active Directory)

Since the Workflow engine runs on a Java-Plattform, even the LDAP-calls are done using Java-Libraries. So if something goes wrong, you will get an JNDI-exception. To troubleshoot such errors, you can do following process:

  1. Get the error code:
    In the “Validation results”-area in the configuration tool, in the Events of your workflow or in the logfiles of vCO
  2. Translate error code to the JNDI-Exception to get a better description:
  3. (Gooogle to find other cases 🙂 )
  4. Fix it!

The common issues are:

  • wrong username / password
  • wrong Distinguished Name
  • [email protected] vs. Domain\user specification
  • Active Directory password restrcition policy when using the AD plugin

If you cannot find the reason for the error, you can do troubleshooting the hard way: Use another Java-based LDAP-Utility (like Apache LDAP Studio), and try to do the things you expect your workflow to do manually. You should get the same errors…

Good luck! 😉

BTW: If you want to access some LDAP-information which are not exposed via the LdapUser/LdapGroup in JavaScript, you can do as workaround: Use an external commandline-tool like adfind, and call it via Command.execute() in a scripting element.
Download adfind:
Examples for calling external scripts (here powercli, but works with adfind in the same way):