Useridd 日志显示“UIA Credentail 错误：凭据已启用，但没有摘要”

7856

Created On 03/12/23 21:51 PM - Last Modified 10/21/24 19:24 PM

Symptom

在防火墙上使用 User-ID 凭据代理启用域凭据过滤器后，您可能会注意到 useridd.log（较少 mp-log useridd.log）下出现持续错误 ，如“Credentail 错误：凭据已启用但没有摘要”

>tail follow yes mp-log useridd.log
0500 Warning:  pan_user_group_handle_cred_stats(pan_user_group.c:10881): UIA Credentail error: credential enabled but no digest.
0500 Warning:  pan_user_group_handle_cred_stats(pan_user_group.c:10881): UIA Credentail error: credential enabled but no digest.

防火墙上的 User-ID Agent 状态显示 “凭据强制执行状态：已启用且待处理”

>show user user-id-agent state Credentail
Agent: Credentail(vsys: vsys1) Host: 172.16.3.253(172.16.3.253):5007
        Status                                            : conn:idle
        Version                                           : 0x5
        SSL config                                        : Default certificates
        num of connection tried                           : 4
        num of connection succeeded                       : 4
        num of connection failed                          : 0
        num of status msgs rcvd                           : 216
        num of request of status msgs sent                : 216
      .....(Output Omitted).....
          Failed to send messages                         : 0
          Failed to enqueue messages                      : 0
          Queued sending msgs with priority 0             : 0
          Queued sending msgs with priority 1             : 0
          Queued rcvring msgs with priority 0             : 0
          Queued rcvring msgs with priority 1             : 0
         Credential Enforcement Status : Enabled and Pending        
          Last BF digest received(seconds ago)            : 929
          Last BF request sent(seconds ago)               : 1124
          Last BF updated(seconds ago)                    : 1124
          Current BF digest : 211700230e5bce5a1aac4bed92c254c6

在 UaCredDebug 日志（C：\Program Files\Palo Alto Networks\User-Id Credential Agent）下，它显示“ 无法绑定到 LDAP 服务器” 和 “未指定 DN。不刷新“ 不断

[Error  542]: ldap_connect(_uidsvc@AAVNI.NET) return(49) : ÐàÝ
[Error 1073]: pan_ldap_bind()  failed
[Debug 1096]: Disconnect ldap from '127.0.0.1'
[Error 1880]: ldap connect failed: HàÝ
[Error 1689]: Failed to bind to LDAP server
[ Warn  613]: No DN specified. Not refreshing.
[Error  696]: Failed to update user list
[Debug  798]: Parsing message...
[Debug  873]: Received request for BF.
[ Info  667]: Sent BF to UaService. 0829f71740aab1ab98b33eae21dee122
[ Warn  613]: No DN specified. Not refreshing.
[Error  696]: Failed to update user list
[ Warn  613]: No DN specified. Not refreshing.
[Error  696]: Failed to update user list
[ Warn  613]: No DN specified. Not refreshing.
[Error  696]: Failed to update user list