Uthentication Error Please Check That Your Username and Password Are Correct and Try Again

Problem

The post-obit error message is brandish when QRadar attempts to log in with a known valid Active Directory account: "The username and password yous supplied are not valid. Please try once more."

Symptom

This fault bulletin can occur when Active Directory authentication worked in the past and suddenly stopped working. The mistake bulletin can also display when Active Directory hallmark is initially configured for QRadar.

If you lot did not make changes to your Active Directory recently, yous might exist experiencing a time synchronization issue.

Cause

The time difference betwixt the system time of the QRadar panel and the organization time of the Agile Directory server is a greater than v minutes (300 seconds).

Diagnosing The Problem

Primary troubleshooting method

Procedure

1. Using SSH, log in to the QRadar Console as the root user.
2. Type the post-obit command: cat /opt/qradar/conf/login.conf
   Review the output to determine that the server that is configured for Active Directory authentication.

   Case:
   LDAPServerURL=ldaps://<server>:port

   The <server> is the Agile Directory Domain Controller that QRadar is authenticating to and port is the Active Directory LDAP port (389 by default).

3. Copy the IP address displayed in the server value.
4. Type the following command: ntpdate -q <server>
   Replace the value <server> with the IP accost or server address from step 2.
5. Review the output to determine whether the offset time is more than 300 seconds off. If the offset time is more than 300 seconds, then the time interval betwixt the Panel and the Active Directory server is the root cause of the authentication result.

   Output example:
   server 9.24.207.12, stratum 3, outset -10774.586000, delay 0.04221 xix Nov 13:59:16 ntpdate[22011]: stride fourth dimension server 9.24.207.12 get-go
-10774.586000 sec

6. Then, to synchronize the QRadar console to the LDAP server, issue the post-obit command: ntpdate <server>
7. Check the commencement again to ensure it is within 300 seconds: ntpdate -q <server>

   Important: The adjacent step will restart the web interface, which logs off all users, stops whatever event exports in progress, and stops any reports existence generated. If yous complete the next step, you might need to manually restart some reports or wait for a maintenance window to complete this procedure.

8. To restart tomcat from the command line of QRadar, blazon: systemctl restart tomcat

Alternate troubleshooting method

Process

1. To edit the login.conf file, type: half dozen /opt/qradar/conf/login.conf
2. Locate the value debug=false in the file.
3. To enable debug, type debug=truthful .
4. Save changes to the login.conf file.
5. Log in to the QRadar user interface with your Active Directory account.
6. Review the log entries in /var/log/qradar.log for the failed log-on bulletin.

   Example:
   javax.security.auth.login.FailedLoginException: LDAPReader()::connect: Login mistake: com.ibm.security.krb5.KrbException, status code: 37
message: Clock skew too neat

   Important: The next stride volition restart the web interface, which logs off all users, stops whatsoever event exports in progress, and stops any reports being generated. If you complete the next step, y'all might need to manually restart some reports or look for a maintenance window to complete this procedure.

7. To restart tomcat from the control line of QRadar, blazon systemctl restart tomcat

Resolving The Problem

Administrators that apply QRadar Versions vii.3 can update the QRadar system fourth dimension to match the Active Directory organisation time past adjusting the time in the QRadar User Interface (UI). If time synchronization is the cause of your authentication issues, and so the administrator can configure the fourth dimension server synchronize QRadar with the Domain Controller.

Option 1: Adjusting the time manually

1. Log in to the QRadar UI.
2. Click Admin page.
3. Click License and System Management .
4. Highlight the Panel and double-click.
5. Click the System Time tab.
6. Scroll downward to Set Time Manually.
7. Change the fourth dimension to match the time on the Domain server.
8. Click Save.

Option ii: Add NTP Servers

1. Go to the Organization Time tab, every bit outlined in Option 1.
2. Click Specify NTP Servers .
3. Click the plus to add NTP servers.

   

4. When complete click Save.

Option 3: Synchronize LDAP Time

1. Log in to the QRadar UI,
2. Click Admin page.
3. Click Authentication.
4. From the Hallmark Module list, select LDAP .
5. Click Manage Synchronization .
6. Click Run Synchronization Now .

   

Results
The time synchronization occurs and all managed hosts synchronize to the Console. This process might take some time to complete.

Related Information

[{"Business concern Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Component":"Admin Console","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.three","Edition":"Enterprise","Line of Business organisation":{"code":"LOB24","label":"Security Software"}}]

claywitely.blogspot.com

Source: https://www.ibm.com/support/pages/qradar-cannot-log-qradar-valid-active-directory-account

Share this post