Sankhadip Sengupta wrote:
Quoting Michael Ströder michael@stroeder.com:
Sankhadip Sengupta wrote:
Michael Ströder wrote:
Santosh Kumar wrote:
./ldapsearch -x -W -h 10.10.10.10 -b "CN=testuser,OU=Users,OU=KeyPairIN,OU=KeyPair,DC=keypair,DC=internal" -S sub Enter LDAP Password: ***
ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)
This means the server is not reachable at TCP level. Make sure your AD is reachable on the IP address given with -h.
I have encountered this issue before.This I fixed by allowing permissions(anonymous read) on the ADS.By default anonymous read on ADS is not allowed by windows.To do this you need to select a dc from the ADS and right click on it and add "ANONYMOUS LOGON" user to it.Then change the permission to "list all contents".This will work then.
- The error message "Can't contact LDAP server (-1)" clearly indicates
that the server wasn't reachable at TCP level. You definitely won't solve that by allowing anonymous access in AD. Santosh has to solve that issue at network level.
- Changing the AD configuration to allow anonymous access might give
you some issues with people auditing your system (e.g. in the banking business).
What I meant was that the server refuses to accept connections.Which means a TCP level RST bit set.
Now can't contact LDAP server message is very generic and it doesnt show deep info on what actually happened.
It clearly indicates that the LDAP connection could not be established at all. Another case where this error message is shown if something's going wrong with establishing a SSL connection (which seems not relevant here).
If you hit the famous AD-not-allowing-anon-access issue the message is definitely different.
I would imagine no body would have errors setting up an LDAP server ip address.
There could be a firewall in between or any other IP networking problem. The original poster has to check this.
Ciao, Michael.