NAS bucket access failing for hardened AD

Last updated
Save as PDF
Share
1. Share
2. Tweet
3. Share

Views:: 5

Visibility:: Public

Votes:: 0

Category:: ontap-9

Specialty:: nas

Last Updated:

Applies to

ONTAP 9
ONTAP S3
Active Directory
LDAP

Issue

After creation, NAS bucket can't be accessed when using credentials of hardened AD
Network security policy of AD are configure to not store LAN Manager hash value on next password change:

Hardened AD.png

SECD error returns error by retrieving credentials:

[Node1: secd: secd.nfsAuth.noCifsCred:error]: vserver (svm1) NFS authorization cannot retrieve CIFS credentials. Error: Get user credentials procedure failed

[ 4] S3 user 's3user' mapped to UNIX user 'pcuser'

[ 24] S3 user 's3user' mapped to Windows user 'DOMAIN\UserAD'

[ 24] Using cached 'DOMAIN\UserAD' SID mapping.

[ 27] Successfully connected to ip 10.0.0.1, port 88 using TCP

[    33] Could not get credentials via S4U2Self based on full Windows user name 'ExampleUserAD@domain.com'. Continuing to LDAP.

[ 36] Successfully connected to ip 10.0.0.1, port 389 using TCP

[ 42] Using a cached connection to ad.domainad.com

[ 44] Could not get credentials via LDAP for Windows user 'test' based on SID

[ 44] FAILURE: Could not get credentials for Windows user 'test' or SID

LDAP attribute results as missing in TokenGroups:

[kern_secd:info:10999] | [000.068.859]  info :  Using a cached connection to ad.domainad.com { in getBestConnection() at src/connection_manager/secd_connection_manager.cpp:985 }

00000016.0ce347ff 0911b10d Tue Jul 07 2026 14:10:37 +01:00 [kern_secd:info:10999] | [000.071.283]  debug:  Searching LDAP for the "PrimaryGroupId" attribute(s) within base "<SID=0105000000000005150000001bcae4f0a62e1b010ae0cc4954a90000>" (scope: 0) using filter: (objectClass=*)  { in searchLdap() at src/utils/secd_ldap_utils.cpp:324 }

[kern_secd:info:10999] | [000.074.638]  debug:  Searching LDAP for the "tokenGroups" attribute(s) within base "<SID=0105000000000005150000001bcae4f0a62e1b010ae0cc4954a90000>" (scope: 0) using filter: (objectClass=*)  { in searchLdap() at src/utils/secd_ldap_utils.cpp:324 }

[000.075.861]  ERR  :  RESULT_ERROR_SECD_LDAP_ATTRIBUTE_MISSING:7054 in getLdapValueLen() at src/utils/secd_ldap_utils.cpp:464

[kern_secd:info:10999] | [000.075.869] ERR : LDAP returned 0 results for attribute tokenGroups

S3 user is mapped and existing in AD as expected