3

We have configured LDAPS for authentication in our Tridion instance. We were able to login to tridion using service account(something like MTSUser) before enabling LDAPS but after LDAPS is enable( SSL and 636 port) we are getting error saying "The server cannot handle directory requests."

I couldn't find any tridion content manager logs regarding this. I have verified all the configuration(web\web.con , Webroot\web.config) settings related to LDAP settings.

Any pointers will be helpful.

Thanks

Improve this question
4
  • I believe it has something to do with certificates. Do you have proper certificate in place? Can you also double check that in machine name in your certificate is exactly the same as LDAP server in Tridion MMC? It should be fully qualified name
    – Andrey Marchuk
    Nov 5, 2013 at 8:05
  • Does the user running the SDL Tridion Application Pool in IIS match that of the impersonation user, and does this user have permission to browse the LDAP directory?
    – RjE
    Nov 5, 2013 at 9:44
  • Yes. Both matches. Is there a way to get the Tridion Trace logs ?
    – user1357019
    Nov 5, 2013 at 19:42
  • The application pool user is not used when connecting to the directory server.
    – Dominic Cronin
    Nov 11, 2013 at 12:31

2 Answers 2

Reset to default
2

You should first test your configuration independently of Tridion. To do this, you need a simple LDAP client. (I recommend Microsoft LDP for this, as it uses the same Windows APIs that Tridion does to talk to the server. Most other simple LDAP clients are Java-based, and will therefore use the wrong certificate store.) Run the client on the Tridion server where you are experiencing difficulties.

Test that you can connect to the server on the specified URL and port. Check the logs on your LDAP server to verify that you can see the incoming connection. (What LDAP server are you using?)

Once you have verified that you can connect, attempt a bind using the DN and password of the "Search account" (as configured in the Tridion snap-in). If this succeeds, go on and verify that you can also bind as the user you are wishing to authenticate.

Throughout this process, continue to monitor the logs on the LDAP server to verify that you can see the expected events.

Having established that all your DNs and passwords are valid, double check that the Tridion configuration fully reflects the tested values. Restart all relevant processes. Test via Tridion.

If this process doesn't get you to an answer, you are ready to contact customer support at Tridion and the LDAP vendor to investigate issues with one or the other.

Improve this answer
1

Does the Content Manager machine trust the SSL certificate presented by the LDAPS server? If not then you will not be able to bind to the directory.

This link may help you to identify certificate issues with LDAPS.

Improve this answer
1
  • I am able to connect using LDAP utility over 636 port. i could query and get the search results. This issue is happening only for service accounts. The worst part is that the authentication is happening in one of CME instance and it doesn't work other instances. i compared almost all the configuration and config files :(
    – user1357019
    Nov 12, 2013 at 0:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.