This user does not have the correct credentials to authenticate to the CIMOM client

  • 3536588
  • 04-Oct-2007
  • 26-Apr-2012

Environment

Novell NetWare 6.5
Novell Edirectory
Imanager 2.6

Situation

The above error would occur in imanager when selecting the storage options to manage the disk drives. Other options in imanager seemed to work ok. Imanager passes the username and password to the cimom client which makes an API call to ldap to search for the object in question. The problem was that ldap was returning a 0 instead of the correct object, such as cn=admin,o=novell. A dstrace +ldap showed this:
(:24022)(0x0001:0x60) Sending operation result 0:"":"" to connection 0xa13167e0

Because of this Imanager had nothing to authenticate and immediately closed down the connection. This was seen in the owcimomd.log file:
W1]Received connection on :5989 from:53798
[1]HTTPServer: Work has been added to the queue
[1]HTTPServer: About to start a new thread
[1]HTTPServer: New thread started
[3]HTTPServer: A thread got some work to do
[3]HTTPServer::authenticate: Returning WWW-Authenticate: Basic realm="Novell.com"
[1]Received connection on :5989 from:53799
[1]HTTPServer: Work has been added to the queue
[3]HTTPServer: A thread got some work to do
[3]HTTPServer::authenticate: processing Basic
[3]NetWareAuthenticator: Didn't get cache entry for user Admin. Doing LDAP authentication
[3]NetWareAuthenticator: Search returns no entries for user Admin
[3]NetWareAuthenticator: Failed to authenticate user Admin
[3]HTTPServer::authenticate: failed:
Logging for the owcimomd.nlm can be enabled by editing the sys:system\cimom\etc\openwbem\openwbem.conf file and settting: log.main.level = DEBUG Then unloading and reloading the owcimomd.nlm
The log file is in SYS:\SYSTEM\CIMOM\VAR\OWCIMOMD.LOG
Imanager would then return the above error.

Resolution

The problem was that the admin user's unique ID had been changed from admin to another user's name. This can be checked in consoleone -- user -- properties -- other -- uniqueID
The user ID shown should be the same as the edirectory object.