topic ACS error : External DB user invalid or bad password in Network Access Control

ACS error : External DB user invalid or bad password

Kashish_Patel — Mon, 11 Mar 2019 02:56:52 GMT

I am seeing this error under ACS failed attempts:

External DB user invalid or bad password

I have verified that password is correct. What is the cause of this?

ACS error : External DB user invalid or bad password

Chris Illsley — Mon, 07 Jan 2013 15:37:19 GMT

The cause is the user name or password are incorrect.

Thanks

Chris

ACS error : External DB user invalid or bad password

Tarik Admani — Mon, 07 Jan 2013 18:41:20 GMT

What version of ACS are you seeing this error message? Which protocol are you using tacacs or radius?

Thanks,

Tarik Admani
*Please rate helpful posts*

ACS error : External DB user invalid or bad password

Kashish_Patel — Tue, 08 Jan 2013 03:02:43 GMT

Hello Tarik,

We are using ACS 4.2

tacacs protocol

ACS error : External DB user invalid or bad password

Tarik Admani — Tue, 08 Jan 2013 04:09:18 GMT

Can you try checking your shared secret. Also try checking the debugs on the ACS, when you go to service control you can set the logging to full. If you are running ACS for windows you can remote desktop into the ACS and do a search for the TCS.log file and the Auth.log and see what errors you are seeing. If you are running ACS Solution engine you may want to pull the support bundle.

Also I assume you are authenticating against AD or LDAP correct?

Tarik Admani
*Please rate helpful posts*

ACS error : External DB user invalid or bad password

Kashish_Patel — Wed, 09 Jan 2013 18:32:38 GMT

Hi Tarik,

Not sure if it is related, but since the time I am seeing this problem, there are logs regarding replication failure between primary and secondary ACS servers as well. Replication used to work fine always (we have 2+ years old setup) and errors started to appear just two days back. No shared key mismatch as opposed to what logs say:

On primary ACS server:

Inbound database replication from ACS 'primary' denied - shared secret mismatch

ACS 'secondary' has denied replication request

On secondary ACS server:

Inbound database replication from ACS 'primary' denied - shared secret mismatch

Any ideas?

ACS error : External DB user invalid or bad password

Tarik Admani — Wed, 09 Jan 2013 19:41:36 GMT

I have seen this issue before and have a strong feeling you are hitting the following bug:

http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCso36620

See if that fixes your issue and then test your authentications.

Thanks,

Tarik Admani
*Please rate helpful posts*

ACS error : External DB user invalid or bad password

Kashish_Patel — Thu, 10 Jan 2013 04:54:57 GMT

Hi Tarik,

Per the bug you mentioned:

Toggle nic" command changes AAA server ip address to "127.0.0.1" in GUI.

Symptom:

The ACS SE appliance IP address shows up as 127.0.0.1 on the ACS GUI.

Conditions:

This occurs after issuing the "toggle nic" command, or by unplugging the ACS SE appliance from the network.

Workaround:

The original IP address on the appliance can be restored with the "set ip" command

We have not changed anything, nor executed any command...anyways where do I need to check IP in GUI?

Thanks.

ACS error : External DB user invalid or bad password

Tarik Admani — Thu, 10 Jan 2013 05:47:14 GMT

Check the network devices section under the ACS or radius server entries. Its been a while since I navigated that version of ACS.

Thanks,

Tarik Admani
*Please rate helpful posts*

ACS error : External DB user invalid or bad password

Kashish_Patel — Thu, 10 Jan 2013 08:23:21 GMT

Tarik,

I checked IP address on GUI of primary and secondary servers. It shows correct IP for both, no loopback. Any other ideas?

Thanks,

Kashish

ACS error : External DB user invalid or bad password

Kashish_Patel — Thu, 10 Jan 2013 08:44:01 GMT

Hi Tarik,

I set the logging level to full and changed password of that user and tried authenticating to a network device using that account. Then I checked TCS.log and Auth.log file. I don't see any log related to that user ID in TCS.log . I did see some logs for that user ID in Auth.log and it shows all correct logs, there is no error for that user ID.

Any more thoughts on this?

Thanks,