Useridd ログに「UIA Credentail error: credential enabled but no digest」と表示される

7862

Created On 03/12/23 21:51 PM - Last Modified 10/21/24 19:24 PM

Symptom

ファイアウォールで User-ID 資格情報エージェントを使用してドメイン資格情報フィルターを有効にした後、useridd.log (mp-log useridd.log 未満) に "Credentail エラー: 資格情報は有効になっていますが、ダイジェストはありません" というエラーが表示されることがあります。
```
>tail follow yes mp-log useridd.log
0500 Warning:  pan_user_group_handle_cred_stats(pan_user_group.c:10881): UIA Credentail error: credential enabled but no digest.
0500 Warning:  pan_user_group_handle_cred_stats(pan_user_group.c:10881): UIA Credentail error: credential enabled but no digest.
```

ファイアウォールの User-ID Agent の状態に「Credential Enforcement Status : Enabled and Pending」と表示される

>show user user-id-agent state Credentail
Agent: Credentail(vsys: vsys1) Host: 172.16.3.253(172.16.3.253):5007
        Status                                            : conn:idle
        Version                                           : 0x5
        SSL config                                        : Default certificates
        num of connection tried                           : 4
        num of connection succeeded                       : 4
        num of connection failed                          : 0
        num of status msgs rcvd                           : 216
        num of request of status msgs sent                : 216
      .....(Output Omitted).....
          Failed to send messages                         : 0
          Failed to enqueue messages                      : 0
          Queued sending msgs with priority 0             : 0
          Queued sending msgs with priority 1             : 0
          Queued rcvring msgs with priority 0             : 0
          Queued rcvring msgs with priority 1             : 0
         Credential Enforcement Status : Enabled and Pending        
          Last BF digest received(seconds ago)            : 929
          Last BF request sent(seconds ago)               : 1124
          Last BF updated(seconds ago)                    : 1124
          Current BF digest : 211700230e5bce5a1aac4bed92c254c6

UaCredDebug ログ (C:\Program Files\Palo Alto Networks\User-Id Credential Agent) に "Failed to bind to LDAP server" と "No DN specified" と表示されます。常にスッキリしない」

[Error  542]: ldap_connect(_uidsvc@AAVNI.NET) return(49) : ÐàÝ
[Error 1073]: pan_ldap_bind()  failed
[Debug 1096]: Disconnect ldap from '127.0.0.1'
[Error 1880]: ldap connect failed: HàÝ
[Error 1689]: Failed to bind to LDAP server
[ Warn  613]: No DN specified. Not refreshing.
[Error  696]: Failed to update user list
[Debug  798]: Parsing message...
[Debug  873]: Received request for BF.
[ Info  667]: Sent BF to UaService. 0829f71740aab1ab98b33eae21dee122
[ Warn  613]: No DN specified. Not refreshing.
[Error  696]: Failed to update user list
[ Warn  613]: No DN specified. Not refreshing.
[Error  696]: Failed to update user list
[ Warn  613]: No DN specified. Not refreshing.
[Error  696]: Failed to update user list