Troubleshooting: LDAPProvider Using LDAPS Breaks After Upgrading to 9.0.2 or Later

Version Affected: 9.0.2+
 
 

Overview

After upgrading or migrating a SecureAuth appliance, realms whose Data Store is configured to connect to LDAP using LDAPS (LDAP over SSL) time out during authentication. Debug logs show LDAPMembership calls completing successfully, but the process stops before pulling user attributes — LDAPProvider.GetProperties and LDAPProvider.SetProperties do not appear in the login attempt's log entries.

Cause

In older appliance versions, selecting a Connection Type of Secured or SSL hard-coded LDAPS to use port 636. Newer appliance versions no longer do this, and instead default to port 389 unless a port number is explicitly defined in the Profile Provider section — using Same as Above for the Profile Provider settings is not sufficient and can cause this failure.

Resolution

Explicitly define the port in the Profile Provider's connection string. For example, change:

LDAP://fqdn.com/O=Store

to:

LDAP://fqdn.com:636/O=Store

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.