Troubleshooting: LDAP Profile Lookups Fail with "A Protocol Error Occurred" (OpenLDAP)

Version Affected: All
 
 

Overview

When a realm's Data tab is configured to use an OpenLDAP-type data store, membership or profile lookups can fail with A protocol error occurred, logged from calls such as SetProfileAccessHistories, MapProfileProperties, or GetProfileProperties. See Troubleshooting: Password Reset Is Not Supported with an OpenLDAP Datastore for another OpenLDAP-specific limitation.

Cause

SecureAuth IdP's LDAP calls are not compliant with OpenLDAP's implementation of the LDAP protocol unless the connection explicitly specifies LDAP protocol version 3.

Resolution:

Add protocolVersion="3" to the LDAP server entry in both the membership and profile provider sections of the realm's web.config:

1. Decrypt the realm's web.config, if it is currently encrypted, and open it in a text editor.
2. Locate the <!-- membership --> section's LDAP server entry, and add protocolVersion="3" as an attribute on it.
3. Locate the <!-- profile --> section's LDAP server entry, and add protocolVersion="3" there as well.
4. Save the file.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.