When troubleshooting issues it may be useful to test user credentials directly against the LDAP server.

There are two main ways of doing this; ldp.exe, which is included on Windows Server, and Ldapsearch utility, which can be installed on Linux. Ldapsearch replicates requests sent by the LoadMaster.

These are the credentials used in the following examples:

Domain: contoso.com
Domain-Controller: 10.110.0.150
Username: bgleeson
Password: 2fourall

LDP.EXE

First, use the ldp.exe program in Windows Server. This is most useful for testing the username/password in Bind Request.

1. In the command prompt, type ldp.exe.
2. In the Connect dialog box,  enter the LDAP server IP address and port.
3. Select Bind with Credentials as the Bind type.

To examine the connection in Wireshark, untick Encrypt traffic after bind.

Successful BIND:
0 = ldap_set_option(ld, LDAP_OPT_ENCRYPT, 1)
res = ldap_bind_s(ld, NULL, &NtAuthIdentity, NEGOTIATE (1158)); // v.3
{NtAuthIdentity: User='bgleeson'; Pwd=<unavailable>; domain = 'contoso.com'}
Authenticated as: 'CONTOSO\bgleeson'.

Unsuccessful BIND:

0 = ldap_set_option(ld, LDAP_OPT_ENCRYPT, 1)
res = ldap_bind_s(ld, NULL, &NtAuthIdentity, NEGOTIATE (1158)); // v.3
{NtAuthIdentity: User='bgleeson'; Pwd=<unavailable>; domain = 'contoso.com'}
Error <49>: ldap_bind_s() failed: Invalid Credentials.
Server error: 8009030C: LdapErr: DSID-0C0904D0, comment: AcceptSecurityContext error, data 52e, v1db0
Error 0x8009030C The logon attempt failed

LDAP Search

Install ldapsearch on Linux. In this example we are using Ubuntu.

Client Certificates.

Logon to Windows Server on customer Network
run LDP.EXE

Connection - BIND

1. define the server.

2. Bind with Credentials. The User should be that defined in the Client Cert SSO Config on Loadmaster - LDAP Administrator.

Password - Password configured on LM Domain- Domain defined

this should bind successfully.

3. Next we need to search for the User as defined in the Certificate under Subject name. e.g. userprincipalname=user.name@domain.com

BROWSE-Search

Base DN: dc=domain,dc=com
Filter: (userprincipalname=user.name@domain.com)
Scope: Base

Attributes: name;cn;