Identity Provider 'X' not registered successfully: The LDAP server is unavailable. (LFDS0)(LMO0)

asked on May 23, 2023 • Show version history

I am working on enabling TLS communication for our various AD Identity Providers in LFDS. I have been able to enable it for 3 of our 10 domains without problems. When I enable it for the others and click save, I receive the following error message:

In Event Viewer Laserfiche\Directory Service\Web Admin\Admin it shows the following error:

Log Name: Laserfiche-Directory Service-WebAdmin/Admin
Source: Laserfiche-Directory Service-WebAdmin
Date: 5/23/2023 7:56:17 AM
Event ID: 1
Task Category: None
Level: Critical
Keywords:
User: XXXX\XXXX
Computer: XXXX.XXXX.XXXX.com
Description:
Identity Provider 'XXXX.XXXX' not registered successfully.

LMAdminWeb.Infrastructure.Exceptions.LMAdminWebException: Identity Provider 'XXXX.XXXX' not registered successfully. ---> Laserfiche.LicenseManager.LMO.LMOException: The LDAP server is unavailable.
at Laserfiche.LicenseManager.LMO.IdentityProvider.Update()
at LMAdminWeb.Services.LMObjectsDatabaseManager.UpdateIdentityProviderProperties(IdentityProviderInfo info)
--- End of inner exception stack trace ---
at LMAdminWeb.Services.LMObjectsConnectionProvider.InvokeDatabaseService(String serverName, String dbName, Action`1 databaseAction)
at LMAdminWeb.Services.LMObjectsConnectionProvider.InvokeDatabaseService[T](String serverName, String dbName, Func`2 databaseAction)
at lambda_method(Closure , Object , Object[] )
at System.Web.Http.Controllers.ReflectedHttpActionDescriptor.ActionExecutor.<>c__DisplayClass13.<GetExecutor>b__c(Object instance, Object[] methodParameters)
at System.Threading.Tasks.TaskHelpers.RunSynchronously[TResult](Func`1 func, CancellationToken cancellationToken)
Exception Data:
LMOCode: 0
Severity: InternalError
Type: Unknown
Server: XXXX.XXXX.XXXX.com
Database: LFDS

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Laserfiche-Directory Service-WebAdmin" Guid="{a4f8a9d5-b8ea-4466-96ef-f97fd64f5db8}" />
<EventID>1</EventID>
<Version>0</Version>
<Level>1</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x2000000000000000</Keywords>
<TimeCreated SystemTime="2023-05-23T14:56:17.0740163Z" />
<EventRecordID>506</EventRecordID>
<Correlation />
<Execution ProcessID="4800" ThreadID="492" />
<Channel>Laserfiche-Directory Service-WebAdmin/Admin</Channel>
<Computer>XXXX.XXXX.XXXX.com</Computer>
<Security UserID="S-1-5-21-64564757-1305693117-1901743163-37621" />
</System>
<EventData>
<Data Name="Message">Identity Provider 'XXXX.XXXX' not registered successfully.

I have user accounts configured with this identity provider and they are able to login, so I'm not sure what it means by 'the Identity Provider is not registered successfully'. Is this an indication that this identity provider is not configured to use TLS or is there something else going on?

Directory Server version 11.0.2204.1467

1 0

replied on May 23, 2023 • Show version history

Receiving the error "The LDAP server is unavailable." with TLS enabled (LDAPS on TCP port 636 or 3269 [Global Catalog]) while it succeeds without TLS (LDAP on TCP port 389 or 3268 [Global Catalog]) most likely suggests a network connectivity issue on 636. I believe LFDS will only use the Global Catalog port if explicitly specified in the AD Identity Provider Host field in "address:port" format.

I believe it comparatively unlikely that an AD domain for a large organization in 2023 would not have LDAPS enabled on the AD side.

I recommend running the following PowerShell commands from the server hosting LFDS, where "$domainHost" is the domain Host specified in the LFDS Identity Provider registration.

$domainHost = 'example.com'
Test-NetConnection $domainHost -port 389 #LDAP
Test-NetConnection $domainHost -port 636 #LDAPS
Test-NetConnection $domainHost -port 3268 #LDAP Global Catalog
Test-NetConnection $domainHost -port 3269 #LDAPS Global Catalog

You're looking for "TcpTestSucceeded: True" for all four ports.

If you get a result of "False" for any of them, either there isn't network connectivity (likely) or the AD DC you connect to for that domain doesn't have LDAPS enabled (unlikely). In either case, it gives you enough information to start chasing down other teams for answers.

0 0

replied on May 23, 2023

I ran these tests for each of the domains and all ports tested successfully.

0 0

replied on May 23, 2023 • Show version history

Time to run an LDAP trace. LDAP error "service unavailable" is basically a catch-all.

Instructions:

https://learn.microsoft.com/en-us/previous-versions/windows/desktop/ldap/ldap-and-etw

First try using trace flag "0x10000000" for general errors and see what that gets you. It occurred to me that the LFDS server may not trust all the different AD CS root certificates that likely issued the certs used for LDAPS across all the domains. That would show up in the LDAP trace.

If you don't get any obvious errors with that trace flag, a colleague tells me that "0x1a280161" "should get you pretty much anything you could possibly need" (extremely verbose).

1 0

Question

Question

Identity Provider 'X' not registered successfully: The LDAP server is unavailable. (LFDS0)(LMO0)

Replies

Sign in to reply to this post.