{"id":1641,"date":"2017-05-30T10:11:53","date_gmt":"2017-05-30T09:11:53","guid":{"rendered":"https:\/\/www.threesl.com\/blog\/?p=1641"},"modified":"2017-05-31T17:09:07","modified_gmt":"2017-05-31T16:09:07","slug":"ldap-troubleshooting","status":"publish","type":"post","link":"https:\/\/www.threesl.com\/blog\/ldap-troubleshooting\/","title":{"rendered":"LDAP Troubleshooting Checklist"},"content":{"rendered":"

LDAP Connection Problems\/Unknown User Issues?<\/h2>\n

Work through the following checklist as setting up the ldap_config<\/em> file to match your LDAP settings<\/em> can be difficult:<\/p>\n

    \n
  1. Enable the trace log by setting the LDAP_TRACE attribute to TRUE<\/samp> in the ldap_config file. The ldap_trace.log<\/em> file is written to a file in the logs\/user directory this can be used to diagnose your problem.\n

    \"Screenshot
    Enabling tracing in the ldap_config file<\/figcaption><\/figure><\/li>\n
  2. If you are using Windows\u00ae Active Directory, run the Active Directory Users and Computers<\/em> browser from the Windows Domain Controller<\/em> and check what the DN (Distinguished Name)<\/em> is for the domain. From this browser you can also find out where the users are stored.<\/li>\n
  3. On other LDAP<\/em> servers, use the setup tool for the LDAP server to find out the correct DN<\/em> and user areas.<\/li>\n
  4. Check the correct Protocol<\/em> is being used.<\/li>\n
  5. Check that the correct level in the LDAP directory structure is being used as the BIND_DN<\/samp> and also that the correct BIND_PASSWD<\/samp> is being used.<\/li>\n
  6. If the LDAP<\/em> server is running securely, is the ldap_config<\/samp> file setup correctly?<\/li>\n
  7. To test that you are connecting to the LDAP<\/em> server correctly without checking the user authentication, set AUTO_LDAP_LOGIN<\/samp> from TRUE<\/samp> to FALSE<\/samp>. This would help to show where the problem is, i.e. either an issue with the connection to the LDAP<\/em> server or whether there is a problem searching the correct user location on the LDAP<\/em> server.<\/li>\n
  8. LDAP<\/em> verification will not succeed if the user’s LDAP<\/em> structure contains multiple UIDs, e.g. if you have UID=manager<\/samp> and UID=yourname<\/samp>.<\/li>\n
  9. If you are failing to login and you receive an LDAP<\/em> message confirming the password<\/em> or username<\/em> could be incorrect but the LDAP<\/em> response message is blank then it is likely you have a case match issue with the entered username<\/em> and the username<\/em> returned from LDAP<\/em>, and Cradle is rejecting the entered username<\/em>. To resolve this issue you can set the UID_IGNORE_CASE<\/samp> to true.<\/li>\n<\/ol>\n

    For further information on LDAP<\/em> see our previous blog entry<\/a> or for more on Cradle integration with LDAP<\/em> please refer to our online help<\/a>.<\/p>\n