[Verify Connection] Verify connection failed with errors

[sudhagarc]

I'm running into the following error when I do "Check connection" for my corporate LDAP authentication. Proper CA certs are installed. For e.g., ldapsearch on the same host with similar parameters works fine. I'm not sure whether I'm overlooking something. Stack trace is attached too. I would appreciate any support in resolving the issue. Please feel free to let me know if additional information is required.

2018-06-27 16:43:45,090 ERROR [qtp662822946-27] LdapPlugin:128 - [Verify Connection] Verify connection failed with errors.
javax.naming.CommunicationException: ldap.thefacebook.com:636
        at com.sun.jndi.ldap.Connection.<init>(Connection.java:216)
        at com.sun.jndi.ldap.LdapClient.<init>(LdapClient.java:137)
        at com.sun.jndi.ldap.LdapClient.getInstance(LdapClient.java:1615)
        at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2749)
        at com.sun.jndi.ldap.LdapCtx.<init>(LdapCtx.java:319)
        at com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:192)
        at com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(LdapCtxFactory.java:210)
        at com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(LdapCtxFactory.java:153)
        at com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(LdapCtxFactory.java:83)
        at javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:684)
        at javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:313)
        at javax.naming.InitialContext.init(InitialContext.java:244)
        at javax.naming.InitialContext.<init>(InitialContext.java:216)
        at javax.naming.directory.InitialDirContext.<init>(InitialDirContext.java:101)
        at cd.go.framework.ldap.Ldap.getDirContext(Ldap.java:103)
        at cd.go.framework.ldap.Ldap.authenticate(Ldap.java:158)
        at cd.go.framework.ldap.Ldap.validate(Ldap.java:162)
        at cd.go.authentication.ldap.executor.VerifyConnectionRequestExecutor.verifyConnection(VerifyConnectionRequestExecutor.java:75)
        at cd.go.authentication.ldap.executor.VerifyConnectionRequestExecutor.execute(VerifyConnectionRequestExecutor.java:62)
        at cd.go.authentication.ldap.LdapPlugin.handle(LdapPlugin.java:67)
        at com.thoughtworks.go.plugin.infra.DefaultPluginManager.lambda$submitTo$0(DefaultPluginManager.java:143)
        at com.thoughtworks.go.plugin.infra.FelixGoPluginOSGiFramework.executeActionOnTheService(FelixGoPluginOSGiFramework.java:219)
        at com.thoughtworks.go.plugin.infra.FelixGoPluginOSGiFramework.doOn(FelixGoPluginOSGiFramework.java:202)
        at com.thoughtworks.go.plugin.infra.DefaultPluginManager.submitTo(DefaultPluginManager.java:140)
        at com.thoughtworks.go.plugin.access.PluginRequestHelper.submitRequest(PluginRequestHelper.java:48)
        at com.thoughtworks.go.plugin.access.authorization.AuthorizationExtension.verifyConnection(AuthorizationExtension.java:105)
        at com.thoughtworks.go.server.service.SecurityAuthConfigService.verifyConnection(SecurityAuthConfigService.java:85)
<..snip..>

[bdpiprava]

@sudhagarc -- Please can you provide you LDAP AuthConfig(Make sure to mask sensitive information in it). Just wanted to check if there is any syntactical error which is causing the issue.

Can you also verify that on your GoCD server ldap.thefacebook.com is resolved to the right host IP address?

[sudhagarc]

@bdpiparva Thanks for prompt response. Please find the details below. Btw, I have set log level to DEBUG for ldap plugin, but didn't get additional information in logs to provide here.

    <authConfig id="auth-id-fb-ldap" pluginId="cd.go.authentication.ldap">
      <property>
        <key>Url</key>
        <value>ldaps://ldap.thefacebook.com:636</value>
      </property>
      <property>
        <key>SearchBases</key>
        <value>OU=FacebookAdmins,DC=TheFacebook,DC=com</value>
      </property>
      <property>
        <key>ManagerDN</key>
        <value>CN=#MASKED#,OU=#MASKED#,DC=TheFacebook,DC=com</value>
      </property>
      <property>
        <key>Password</key>
        <encryptedValue> #MASKED# </encryptedValue>
      </property>
      <property>
        <key>UserSearchFilter</key>
        <value>(sAMAccountName={0})</value>
      </property>
      <property>
        <key>UserLoginFilter</key>
        <value>(sAMAccountName={0})</value>
      </property>
      <property>
        <key>DisplayNameAttribute</key>
        <value>displayname</value>
      </property>
      <property>
        <key>EmailAttribute</key>
        <value>mail</value>
      </property>
    </authConfig>

Confirmed that hostname resolves to right host IP address. FWIW, ldapsearch tool using the same hostname and similar parameters on GoCD server works fine.

[sudhagarc]

@bdpiparva Just checking whether there is any update on the above issue. I appreciate it.