1

When we connect to import-export service to perform export / import even for one component, the process fails and the error that is logged in the event viewer is: The server cannot handle directory requests.

Component: LdapAuthenticationHttpModule Errorcode: 0 User: NT AUTHORITY\NETWORK SERVICE

StackTrace Information Details: at System.DirectoryServices.Protocols.ErrorChecking.CheckAndSetLdapError(Int32 error) at System.DirectoryServices.Protocols.LdapSessionOptions.FastConcurrentBind() at Tridion.Security.DirectoryService.GetLdapAutenticationConnection(Boolean forceStandardBind) at Tridion.Security.DirectoryService.AuthenticateUser(String userName, String password) at Tridion.Security.Web.LdapAuthenticationHttpModule.OnAuthenticateRequest(Object sender, EventArgs e)

We have 6 CM servers out of which we are seeing above error only for content porter and webdav in 3 CM servers and other 3 CM servers are working fine.

If we access the CME, it works fine with Ldap authentication.

We compared those working vs non-working servers however did not find any difference. Also ErrorCode is 0 for LdapAuthenticationModule which indicates success so I am not sure what could be the issue.

Has anybody faced similar issue? or If you have any pointers on things to look for then please share.

Any help is appreciated?

Update 1: We found one thing, the error for Ldap is happening for only few users including MTS user and not all users.

  • 1
    What are the security settings in IIS on ImportExportService virual folder? – Andrey Marchuk Jul 29 '15 at 6:52
  • It is set for anonymous authentication as suggested by Tridion documentation. – Hiren Kaku Jul 29 '15 at 6:56
1

maybe you have to grant rwx to IUSR on ImportExportService virual folder.

IUSR is the default user for anonymous login on IIS.

Hope this helps!

  • Unfortunately, the system that are working fine also have the same permission as permission set on non-working system. So this doesn't seems to be the solution. Anyways, thanks for your input. – Hiren Kaku Jan 14 '16 at 17:30
1

The stack trace suggests there is a problem with connecting to the LDAP server. In particular, the LDAP authentication module is trying to do a so-called "Fast Concurrent Bind" on the LDAP server which fails with "The server cannot handle LDAP requests". Fast Concurrent Bind is a feature implemented by Active Directory. The LDAP auth module uses that feature if advertised by the LDAP server (for performance reasons).

I don't know why you get the problem only on some of your CM server and only for specific operation, but I would suggest to check your LDAP Server logs.

  • We have already worked with our networking team to trace the LDAP logs however we did not find anything useful. – Hiren Kaku Jan 14 '16 at 22:30
  • Do you have special characters in the (search) account names? I vaguely remember there were Fast Concurrent Bind issues in that case. Anyways, I suggest to contact SDL Customer Support for this issue. – Rick Pannekoek Jan 15 '16 at 8:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.