KB18161 - Unable to administer the BlackBerry Administration Service after using the BlackBerry Server Configuration tabs

Environment

• BlackBerry® Enterprise Server software version 5.0
• SDR299265

---

Overview

After editing the LDAP Password field on the Administration Service - LDAP tab in the BlackBerry Server Configuration tool, Administrators can no longer log into the BlackBerry Administration Service console using Windows (Microsoft® Active Directory®) Authentication.

---

Cause

For security reasons, the LDAP password is hashed before being stored in the BlackBerry Configuration Database. This ensures that it cannot be accessed and used directly from the Microsoft® SQL Server®. To use the password, the BlackBerry Administration Service must retrieve the password from the Hash value that was created when the password was inserted into the BlackBerry Configuration Database. When the password is edited on the BlackBerry Server Configuration screen, it is put in the database in plain text, instead of the Hashed value. Because the BlackBerry Administration Service automatically attempts to retrieve the password from Hash, it does not understand the plain text password. This prevents the BlackBerry Administration Service from authenticating against Microsoft Active Directory, and therefore from authenticating other users for login.
If you are experiencing this issue, the following log line appears in the BAS-AS log file:

[WARN] [BBAS-2015] {u=1, uc=-1, o=0, t=150975} _getExternalAuthenticatorId could not find external authenticator identifier - com.rim.bes.bas.usermanager.CouldNotFindExternalAuthenticatorIdException: Message: 'LOGIN ERROR: findExternalAuthenticatorIdLocal failed to login as LDAP user com.rim.bes.bas.pluginmanager.InvalidAuthenticationException: Message: 'LOGIN ERROR: loginAsLdapUser exception during authentication com.rim.bes.bas.util.BASCouldNotCompleteRequestRollbackException: getAuthenticationCredentialsLocal stored password could not be decrypted', nested exception: 'getAuthenticationCredentialsLocal stored password could not be decrypted'', nested exception: 'Message: 'LOGIN ERROR: loginAsLdapUser exception during authentication com.rim.bes.bas.util.BASCouldNotCompleteRequestRollbackException: getAuthenticationCredentialsLocal stored password could not be decrypted', nested exception: 'getAuthenticationCredentialsLocal stored password could not be decrypted''

---

Resolution

This issue has been resolved in BlackBerry Enterprise Server 5.0 Maintenance Release 1.

To apply Maintenance Release 1 complete the following steps:

1. Log in as the BlackBerry service account.
2. Click on Start > Run > Services.msc.
3. Stopall BlackBerry Services.
4. Double-click bes500mr1.msp to install Maintenance Release 1.
5. Start all BlackBerry Services.
   
   Important: Restarting certain BlackBerry Enterprise Server services will delay email message delivery to BlackBerry smartphones. For more information, see KB04789
   
   For more information about Maintenance Release 1 see the Release Notes.

To ensure the password gets put into the database as the correct hashed value, complete the following steps:

1. Click on Start > Programs > BlackBerry Enterprise Server > BlackBerry Server Configuration.
2. Click on the Administration Service - LDAP tab.
3. Enter the LDAP password for the corresponding LDAP user account.
4. Click Verify.
5. Click Apply and OK.
6. Restartthe BlackBerry Administration Service - Native Code Container service.
   
   Note: Restarting the "BlackBerry Administration Service - Native Code Container" service will also restart the "BlackBerry Administration Service - Application Server service."

---

Workaround

To work around the issue, perform one of the following options:

Option 1

1. On the server where the BlackBerry Administration Service is installed, navigate to the following directory from a command prompt:
   
   :\Program Files\Research In Motion\BlackBerry Enterprise Server\BAS\bin
2. Run the following command:
   
   basUtility "C:\Program Files\Java\jre1.5.0_15" "C:\Program Files\Research In Motion\BlackBerry Enterprise Server\BAS" encode "" > C:\Output.txt
3. Open the text file created in Step 2.
4. Copy the hashed version of the password to your Microsoft SQL Server.
5. Run the following SQL Query against the BlackBerry Configuration Database:
   
   update BASAuthenticationCredentials set password = '' where AuthenticationType LIKE '1'
6. Restart the BlackBerry Administration Service services.
7. Log in to the BlackBerry Administration Service using Microsoft Active Directory.

Option 2

Install the BlackBerry Administration Service again.

__________________

FYI, this symptom should result in the following error message in the BBAS-AS log file:

java.lang.NumberFormatException: Illegal embedded minus sign

I didn't see this mentioned in the KB or on Google, so I figured it best to start the indexing here

__________________
BCSA (4.1, 5.0) | BCSD (4.1, 5.0)

The views expressed by me on Port3101.org are my own and do not necessarily reflect the views of my employer.

Just to note, this was resolved in MR1.

__________________
BCSA (4.1, 5.0) | BCSD (4.1, 5.0)

The views expressed by me on Port3101.org are my own and do not necessarily reflect the views of my employer.

updated

__________________
http://blog.port3101.org/hdawg/

The views expressed by me on Port3101 and its affiliated sites are my own and do not necessarily reflect the views of my employer.