Troubleshooting LDAP
LDAP authentication failures commonly come from network connectivity, connection security, or bind credentials. Check these in order to isolate a firewall, certificate, distinguished-name (DN), or ExaVault user configuration problem.
Verify Network Connectivity
Your ExaVault server must be able to reach the LDAP server address on the port used for connecting to LDAP.
Test LDAP Binding
From the ExaVault server, query the directory with the ldapsearch command-line tool. Construct the bind DN with the same Username Prefix and Username Suffix used in the LDAP configuration.
Common LDAP Error Codes
49
Invalid Credentials
The password is wrong or the bind DN is formatted incorrectly.
32
No Such Object
The user or configured Base DN does not exist in the directory.
81
Server Down
A firewall, incorrect port, unavailable LDAP service, or connection-security mismatch prevents the connection.
34
Invalid DN Syntax
The prefix or suffix contains a formatting error such as a missing comma or extra space.
53
Unwilling to Perform
The directory rejects the operation, often because its policy requires SSL or TLS.
Troubleshooting User Authentication
Before investigating a user's failed logins, confirm the LDAP server is correctly defined and can be reached from the ExaVault host machine on the required port.
User Cannot Sign In
The user must already exist in ExaVault to authenticate. If you are using Active Directory sync, wait for the sync process to complete.
If the user exists, verify that Authentication is set to Active Directory & LDAP in the user settings.
To confirm the credentials are valid, use the ldapwhoami command-line tool. It is the quickest way to troubleshoot login errors.
If the user exists locally and the password is correct, LDAP bind failures come from bind username formatting or connection security mismatches. Check the Username prefix and Username suffix from your LDAP configuration.
Users Do Not Appear in ExaVault After Sync
Verify that the configured AD security group exists and that its common name (CN) matches the configured group name.
Verify that the user is a direct or nested member of that group.
Users Get Disabled Unexpectedly
ExaVault disables any previously synced user that does not appear in a sync run.
Verify that the user remains a member of the configured AD security group.
Verify that the user account is enabled in Active Directory.
Last updated