1

When we connect to import-export service to perform export / import even for one component, the process fails and the error that is logged in the event viewer is: The server cannot handle directory requests.

Component: LdapAuthenticationHttpModule Errorcode: 0 User: NT AUTHORITY\NETWORK SERVICE

StackTrace Information Details: at System.DirectoryServices.Protocols.ErrorChecking.CheckAndSetLdapError(Int32 error) at System.DirectoryServices.Protocols.LdapSessionOptions.FastConcurrentBind() at Tridion.Security.DirectoryService.GetLdapAutenticationConnection(Boolean forceStandardBind) at Tridion.Security.DirectoryService.AuthenticateUser(String userName, String password) at Tridion.Security.Web.LdapAuthenticationHttpModule.OnAuthenticateRequest(Object sender, EventArgs e)

We have 6 CM servers out of which we are seeing above error only for content porter and webdav in 3 CM servers and other 3 CM servers are working fine.

If we access the CME, it works fine with Ldap authentication.

We compared those working vs non-working servers however did not find any difference. Also ErrorCode is 0 for LdapAuthenticationModule which indicates success so I am not sure what could be the issue.

Has anybody faced similar issue? or If you have any pointers on things to look for then please share.

Any help is appreciated?

Update 1: We found one thing, the error for Ldap is happening for only few users including MTS user and not all users.

Improve this question
2
  • 1
    What are the security settings in IIS on ImportExportService virual folder?
    – Andrey Marchuk
    Jul 29, 2015 at 6:52
  • It is set for anonymous authentication as suggested by Tridion documentation.
    – Hiren Kaku
    Jul 29, 2015 at 6:56

2 Answers 2

Reset to default
1

maybe you have to grant rwx to IUSR on ImportExportService virual folder.

IUSR is the default user for anonymous login on IIS.

Hope this helps!

Improve this answer
1
  • Unfortunately, the system that are working fine also have the same permission as permission set on non-working system. So this doesn't seems to be the solution. Anyways, thanks for your input.
    – Hiren Kaku
    Jan 14, 2016 at 17:30
1

The stack trace suggests there is a problem with connecting to the LDAP server. In particular, the LDAP authentication module is trying to do a so-called "Fast Concurrent Bind" on the LDAP server which fails with "The server cannot handle LDAP requests". Fast Concurrent Bind is a feature implemented by Active Directory. The LDAP auth module uses that feature if advertised by the LDAP server (for performance reasons).

I don't know why you get the problem only on some of your CM server and only for specific operation, but I would suggest to check your LDAP Server logs.

Improve this answer
2
  • We have already worked with our networking team to trace the LDAP logs however we did not find anything useful.
    – Hiren Kaku
    Jan 14, 2016 at 22:30
  • Do you have special characters in the (search) account names? I vaguely remember there were Fast Concurrent Bind issues in that case. Anyways, I suggest to contact SDL Customer Support for this issue.
    – Rick Pannekoek
    Jan 15, 2016 at 8:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.