[far]

Somewhere I read that low RAM memory could also cause this issue, I only had 1GB of RAM assigned to the server, so I upgraded the RAM to 2GB(its a VMware machine).

Now I'm having the problem that I cannot reach the https BAS site. I can reach the BAS site via http via port 18180, but when I try to login I get the message: The username, password, or domain is not correct. Please correct the entry.

I checked the BAS log but cant find what the issue is, hopefully some BB guru on the forum knows what is causing the issue. I attached the BAS log from today to this post.

[penguin3107]

Start here:
KB22745-"The username, password, or domain is not correct. Please correct the entry" appears at login to BlackBerry Administration Service

[far]

Thank you for your reply penguin3107, this article is based on version 5.0. I am running version 5.0.3 MR1.

[BB-Tech support]

I have few questions for you

1. What java runtime environment you have installed on Bes server?
2. Is your BES server time is not greater than 5 min from Domain controller serve time

and
can yourestart BAS-AS and BAS-NCC services
Wait for BAS-AS to reach above 600000Kb in task manager
open BAS and try to log in

If you get same error dont try to login again
just attach a BAS-AS todaydate 00002 log to the post
and I will take a look

[BB-Tech support]

Here is your fix

This is your log entry with error

com.rim.bes.basplugin.activedirectory.CouldNotGetE xchangeGCInfoException: Message: 'LOGIN ERROR: _getExchangeGCInfo Failed to get Global Catalog server name for domain mydomain.com com.rim.bes.basplugin.activedirectory.CouldNotGetG CInfoException: Message: 'getGCHost could not get DC host com.rim.bes.basplugin.activedirectory.CouldNotGetD CInfoException



KB21711-"Username, password or domain is not correct" reported by BlackBerry Administration Service reports when attempting to log in with Microsoft Active Directory account
"Username, password or domain is not correct" reported by BlackBerry Administration Service reports when attempting to log in with Microsoft Active Directory account

A Username, password or domain is not correct error occurs while attempting to login with Microsoft® Active Directory® credentials from a new or newly associated Microsoft Active Directory domain. Microsoft Active Directory credentials from other Microsoft Active Directory domains work correctly.

The following error is recorded in the BlackBerry® Administration Service Application Server (BAS-AS) log file:

LOGIN ERROR: _validateAuthenticationAttributes failed to determine the GC host for the Active Directory user domaincom.rim.bes.basplugin.activedirectory.CouldN otGetGCInfoException: getGCHostCould not find Global Catalog Server in the domain 'company.domain.com'



Environment

BlackBerry® Enterprise Server 5.0



Cause

GCHost value for the Active Directory container of 'company.domain.com' is blank or has no referring server.



Resolution

Implement or direct the Microsoft Active Directory container to refer to an appropriate 'top' level GCHost/Global Catalog/LDAP server.

[far]

BB-Tech support you are awesome! The userlogon name and domain where not specified in the AD. I specified the username and domain, gave the BES server a reboot and after that I could login again to the BAS site. Thank you

[far]

Hello BB-Tech support I think i'm cursed, on another environment I have the same issues. I have checked the log files but I cant figure out what is wrong. I have attached the BAS log, hopefully you can take a look at this log as well.

Thanks in advance for the help

[BB-Tech support]

Originally Posted by far

Hello BB-Tech support I think i'm cursed, on another environment I have the same issues. I have checked the log files but I cant figure out what is wrong. I have attached the BAS log, hopefully you can take a look at this log as well.

Thanks in advance for the help

Hi Far
Im sorry took me few days to reply to your post

Error is th same


(10/31 11:55:30:812):{main} [com.rim.bes.bas.pluginmanager.PlugInManagerBean] [INFO] [BBAS-1000] {u=SystemUser, t=46} Registered plug-in id=111, name='ActiveDirectory', class=com.rim.bes.basplugin.activedirectory.Active DirectoryManagerBean, version='5.0.0'
(10/31 11:55:34:140):{main} [com.rim.bes.basplugin.activedirectory.ActiveDirect oryManagerBean] [WARN] [ADAU-2000] {u=SystemUser, t=48} _getActiveDirectoryGSSServiceParameters failed to get the Active Directory GSS service parameters.

*** Start of original stack trace ***

com.rim.bes.basplugin.activedirectory.CouldNotGetE xchangeGCInfoException: Message: 'LOGIN ERROR: _getExchangeGCInfo Failed to get Global Catalog server name for domain corp.hcn.nl com.rim.bes.basplugin.activedirectory.CouldNotGetG CInfoException: Message: 'getGCHost could not get DC host com.rim.bes.basplugin.activedirectory.CouldNotGetD CInfoException: Message: 'getDCHost could not get domain controller information from NCC, com.rim.bes.bas.activedirectory.authentication.Act iveDirectoryAuthenticatorException: Message: 'getDomainControllerInfo Could not complete due to Exception, org.jboss.remoting.CannotConnectException: Can not get connection to server. Problem establishing socket connection for InvokerLocator [sslsocket://127.0.0.1:23843/?dataType=invocation&marshaller=org.jboss.invocati on.unified.marshall.InvocationMarshaller&unmarshal ler=org.jboss.invocation.unified.marshall.Invocati onUnMarshaller]', nested exception: 'Can not get connection to server. Problem establishing socket connection for InvokerLocator [sslsocket://127.0.0.1:23843/?dataType=invocation&marshaller=org.jboss.invocati on.unified.marshall.InvocationMarshaller&unmarshal ler=org.jboss.invocation.unified.marshall.Invocati onUnMarshaller]'', nested exception: 'Message: 'getDomainControllerInfo Could not complete due to Exception, org.jboss.remoting.CannotConnectException: Can not get connection to server. Problem establishing socket connection for InvokerLocator [sslsocket://127.0.0.1:23843/?dataType=invocation&marshaller=org.jboss.invocati on.unified.marshall.InvocationMarshaller&unmarshal ler=org.jboss.invocation.unified.marshall.Invocati onUnMarshaller]', nested exception: 'Can not get connection to server. Problem establishing socket connection for InvokerLocator [sslsocket://127.0.0.1:23843/?dataType=invocation&marshaller=org.jboss.invocati on.unified.marshall.InvocationMarshaller&unmarshal ler=org.jboss.invocation.unified.marshall.Invocati onUnMarshaller]''', nested exception: 'Message: 'getDCHost could not get domain controller information from NCC, com.rim.bes.bas.activedirectory.authentication.Act iveDirectoryAuthenticatorException: Message: 'getDomainControllerInfo Could not complete due to Exception



Do the same with second server what you did with first.. Just reboot an shuld me ok.

[far]

The userlogon name and domain are specified in the AD on this server, On the first server the userlogon name and domain where not specified in the AD. It looks like its something different on this server.

[stepdg]

I don't know if this will help anyone else, but I found the issue to be related to IPv6.

In the BAS-AS log, I found this entry:
(11/30 13:50:58:553):{http-BLACKBERRY.XXX.COM%2F10.1.1.26-443-6} [com.rim.bes.basplugin.activedirectory.LDAPSearch] [INFO] [ADAU-1001] {u=SystemUser, t=3724} LOGIN ERROR: getActiveDirectoryRootDseInformation could not get rootDSE attributes for URL ldap://dc2.xxx.com:3268 error=javax.naming.CommunicationException: dc2.xxx.com:3268 [Root exception is java.net.UnknownHostException: dc2.xxx.com]

So I jumped onto the BES server and pinged DC2. It was able to DC2 but it was hitting the IPv6 address. Which is fine, except the BES server couldn't sort that out. The solution was to remove IPv6 from DC2, forcing the BES server to resolve the IP using IPv4.

Image of the PING before and after:
remote[dot]capefoxit[dot]com/bb_ipv6.png

As soon as I did that and rebooted, authentication worked again.

Hope this helps!

[albracco]

Originally Posted by BB-Tech support

Here is your fix


ause

GCHost value for the Active Directory container of 'company.domain.com' is blank or has no referring server.



Resolution

Implement or direct the Microsoft Active Directory container to refer to an appropriate 'top' level GCHost/Global Catalog/LDAP server.

Could you explain this further?

[albracco]

I finally found the answer: the solution was in this article:

support.opt3.com/KB/a47/installing-bes-express-on-sbs-may-not-create-correct.aspx

Although the article deals with SBS and a problem during install, the symptom (not being able to find the GC) was similar, so I gave it a try. the registry entries are not in the same place, so I just searched for the key mentioned and in two places where I found entries not pointing to the top level GC, I changed those entries, rebooted and Eureka, it worked!

Thanks for your time!