You are viewing limited content. For full access, please sign in.

Question

Question

Get more information from Laserfiche Directory Server connection error

asked on June 20, 2022

Is there a way to get more information about this error connecting to DS server during the installation of a LF product? I have scanned the network ports 5048 and 5049 and I am sure my credentials are valid. So not sure what to check next. It is not clear if it is a network or credential issue either.

 

0 0

Replies

replied on June 21, 2022

We get this error due to our proxy - we have to go into Internet Options and turn our proxy off in order to get a connection and license from our LFDS.  

You might try that if your customer is using a proxy.

 

1 0
replied on June 21, 2022

Just checked to verify no proxy is configured for the LAN and I am using the LFDS server's direct IP address, not trying to connect to a proxy in any way.

0 0
replied on June 21, 2022

Hi Chad,

In addition to what Craig said, are the two machines (LFDS and the machine installing the app) on the same network or are they in a DMZ configuration or something similar? As a sanity check, does

tnc lfdsmachine.domain.com -Port 5048

execute successfully in PowerShell on the app machine?

0 0
replied on June 21, 2022

The App is on a perimeter network from the LFDS server.

Powershell Success

Nmap Success

This is why I wanted more info, the error does not appear to be a network outage

0 0
replied on June 21, 2022

Hi Chad, in this case it is expected for this connection to fail. The Laserfiche app installer can only utilize Windows authentication to connect to LFDS and if the app machine is on an untrusted domain, it will not be able to authenticate (as it is trying to do so locally). We recommend downloading app licenses directly from LFDS and importing the license file into the app installer for these DMZ / perimeter network setups.

0 0
replied on June 21, 2022

Oh by perimiter network I did not mean off the domain, the machine is joined to the domain. Maybe I should use the word alternate subnet? They call it a DMZ. There is too much terminology these days.

Very specifically, the server exists on another subnet, there is a router between the 2 networks, but both servers have full network access to each other and the domain controller. The only difference is the app server network does not have access to the entire internal network because of the router between the 2.

0 0
replied on June 21, 2022

Hmm in that case, if the machine is on the domain yet cannot authenticate against it, it's likely a configuration issue. Domain authentication only cares about domain topology. Some guesses:

  1. Maybe that machine isn't actually on the domain?
  2. Maybe the domain controller being reached doesn't contain the entry you're trying to authenticate with (is it a RODC or something that doesn't have all the objects in it?)
0 0
replied on June 21, 2022

I have a domain account and I can login to both servers with the same account and password, if I change my account password on any machine, it applies to both machines. So I can't see anything wrong with the domain from my perspective.

This is why I am looking for more information regarding the error, what exactly is preventing me from accessing directory server. I can not bring a case to IT unless I have the specifics of what is wrong.

I am not familiar with RODC.

Also when you connect to DS, you can manually supply your domain credentials, but this throws the same error.

0 0
replied on June 22, 2022

Can you try the following tests?

  1. When prompted to enter the LFDS address, use the IP of the machine instead. Did this help?
  2. Launch the installer manually as the user you will be using to authenticate into LFDS
    1. Find the SetupLf.exe file in the installer files for the product you are installing
    2. Shift+right click the file and select "Run as different user"
    3. Input the credentials you are trying to use to authenticate into LFDS
    4. When prompted to select a "Log on as" value in the installer, select "Current user"
0 0
replied on June 22, 2022

Tried both of these without any luck. However entering KRC-ETS-BPM01 is exactly the same as entering 10.42.0.8 since Names get converted by IP addresses by the name server.

Also when I select run as a different user, but enter the same credentials I logged into windows as, I am essentially telling it to run as me, which is the same as double clicking.

I did login and try both though, so no go.

In my original post I assumed that the network is not the problem and the credentials is also not the problem. I still belive that is true because I have verified this. There is something else wrong and the error message does not supply the specifics.

0 0
replied on June 23, 2022

I'd suggest using the workaround (registering the app and downloading a license for it from LFDS, then importing that into the installer) or opening a support case for this.

0 0
replied on June 23, 2022

Ok, I guess if we can't see what is going on under the hood there is nothing we can do to fix it. Thanks for your help though

0 0
replied on June 23, 2022

It shows this error if you use the license file directly. Going to have to open a support case to get more information on the original connection error. If Forms requires communicaiton with DS, then DS communication issues must be resolved. But outside of making sure we have the right IP and the port is open, there is nothing more I can do.

1 0
replied on August 31, 2022

The result of the support case was finding that even though a port scan of 5048 worked every time, very specific packets were being dropped by the networking equipment as the 2 products were trying to communicate. The fault was on the network and IT had it fixed once I provided the wireshark traces from both ends showing missing packets on the receiving side.

This is the first time I have seen a situation where only specific packets were not making it to their destination. Something was critically broken on the network side.

2 0
You are not allowed to follow up in this post.

Sign in to reply to this post.