> For the complete documentation index, see [llms.txt](https://docs.exavault.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.exavault.com/authentication-and-identity/active-directory-and-ldap/troubleshooting-ldap.md).

# Troubleshooting LDAP

LDAP authentication failures commonly come from network connectivity, connection security, or bind credentials. Check these in order to isolate a firewall, certificate, distinguished-name (DN), or ExaVault user configuration problem.

## Verify Network Connectivity

Your ExaVault server must be able to reach the [LDAP server address](/authentication-and-identity/active-directory-and-ldap.md#ldap-configuration-screen) on the port used for connecting to LDAP.

## Test LDAP Binding

From the ExaVault server, query the directory with the `ldapsearch` command-line tool. Construct the bind DN with the same [*Username Prefix* and *Username Suffix*](/authentication-and-identity/active-directory-and-ldap.md#username-prefix-and-username-suffix) used in the [LDAP configuration](/authentication-and-identity/active-directory-and-ldap.md#ldap-configuration-screen).

## Common LDAP Error Codes

| Code | Name                   | Common Causes                                                                                                  |
| ---- | ---------------------- | -------------------------------------------------------------------------------------------------------------- |
| `49` | `Invalid Credentials`  | The password is wrong or the bind DN is formatted incorrectly.                                                 |
| `32` | `No Such Object`       | The user or configured Base DN does not exist in the directory.                                                |
| `81` | `Server Down`          | A firewall, incorrect port, unavailable LDAP service, or connection-security mismatch prevents the connection. |
| `34` | `Invalid DN Syntax`    | The prefix or suffix contains a formatting error such as a missing comma or extra space.                       |
| `53` | `Unwilling to Perform` | The directory rejects the operation, often because its policy requires SSL or TLS.                             |

## Troubleshooting User Authentication

Before investigating a user's failed logins, confirm the LDAP server is correctly defined and [can be reached](#verify-network-connectivity) from the ExaVault host machine on the required port.

### User Cannot Sign In

The user must already exist in ExaVault to authenticate. If you are using Active Directory sync, wait for the sync process to complete.

If the user exists, verify that *Authentication* is set to *Active Directory & LDAP* in the user settings.

To confirm the credentials are valid, use the `ldapwhoami` command-line tool. It is the quickest way to troubleshoot login errors.

If the user exists locally and the password is correct, LDAP bind failures come from bind username formatting or connection security mismatches. Check the [*Username prefix and Username suffix*](/authentication-and-identity/active-directory-and-ldap.md#username-prefix-and-username-suffix) from your [LDAP configuration](/authentication-and-identity/active-directory-and-ldap.md#ldap-configuration-screen).

### Users Do Not Appear in ExaVault After Sync

Verify that the configured AD [security group](/authentication-and-identity/active-directory-and-ldap.md#configuring-active-directory-sync) exists and that its common name (CN) matches the configured group name.

Verify that the user is a direct or nested member of that group.

### Users Get Disabled Unexpectedly

ExaVault disables any previously synced user that does not appear in a sync run.

Verify that the user remains a member of the configured AD security group.

Verify that the user account is enabled in Active Directory.