Unable to login into CommCell Console with Domain Users

Users are experiencing issues while trying to log in to the CommCell Console using Domain Users. Two different error messages are encountered, depending on whether Single Sign-On (SSO) is configured in the domain or not.

Symptoms

If SSO is not configured Error Message: "Failed to connect to the domain server. Please contact Commcell administrator to check domain service credentials."

Log Entries: EvMgrS.log on Commserve

• 7788 278c 07/28 17:38:59 ### EvSecurityMgr::UpdateUMUsersTable() - Failed to initialize connection with AD server.
• 7788 278c 07/28 17:38:59 ### EvSecurityMgr::userLogin() - processAdUser returned [-105], "Failed to connect to the domain server. Please contact Commcell administrator to check domain service credentials."
• 7788 278c 07/28 17:38:59 ### EvSecurityMgr::userLogin() - Socket [0x00000000000016EC]: LOGIN ERROR: Invalid login/password attempt with UserName [XXX\XXXXXXX] from [XXXXX], Attempt [1/3]
• 7788 278c 07/28 17:38:59 ### ::sendResponse() - FAILED [Failed to connect to the domain server. Please contact Commcell administrator to check domain service credentials.]
• 7788 278c 07/28 17:38:59 ### handleLoginOperations() - Encrypted Login Failed. Browser Session Id [27]

If SSO is configured Error Message: "Could not perform AD SSO. Please check the logs for more details."

Log Entries: EvMgrS.log on Commserve

• 7788 2790 07/28 17:35:18 ### EvSecurityMgr::userLogin() - Socket [0x0000000000001424]: AD SSO error [-120].
• 7788 2790 07/28 17:35:18 ### ::sendResponse() - FAILED [Could not perform AD SSO. Please check the logs for more details.]
• 7788 2790 07/28 17:35:18 ### handleLoginOperations() - Encrypted Login Failed. Browser Session Id [25]
• 7788 3c98 07/28 17:36:12 ### authenticateThread() - Challenge client[IP ADDRESS] on socket[0x0000000000001094]
• 7788 2798 07/28 17:36:15 ### CVSimpleDB::SQLINFO() - INFO: [Operation invalid at this time] [RecNum:1, Spid:89]
• 7788 2798 07/28 17:36:15 ### EvSecurityMgr::validateUser() - Attempt to validate credentials of User [XXXX], id[1] failed with error [0]
• 7788 2790 07/28 17:36:18 ### ::processAdUser() - The logon attempt failed

Causes

The issue arises when the Commserve fails to connect to the Domain Controller to retrieve domain credentials. This is often due to a failure to authenticate the service account, usually caused by a password change.

Resolution

Log in to the CommCell Console using a local CommCell user with Administrative privileges.

1. Navigate to Security > Domains > "your domain name" > Right-click > Properties.
2. On the General tab, verify the "User Account" credentials, ensuring the username is in DOMAIN\User format. Click Edit to enter the new password.
3. Click Validate to check connectivity and user account credentials.

Additional Checks:

• Verify the correctness of the domain name.
• Check if the Domain Controller requires Secure LDAP.
• Ensure that the service account has proper permissions to connect to the Domain Controller.
• Verify if the service account is enabled and unlocked.

What to do if you don't have the password for any local account with administrative permissions: In this case, you need to request a password reset for the default Commvault admin user by using the following cloud form: https://cloud.commvault.com/webconsole/forms/?tab=0&workflowName=Request%20Auth%20Code%20for%20Admin%20Password%20Reset&workflowId=2581

Best Practices:

• Always have access to at least one local CommCell admin user.
• Plan the service account password cycle and update the password in Commvault immediately after changing it from Active Directory.