LdapErr: DSID-0C090C77, comment: In order to perform this operation a successful bind must be completed on the connection

[p-e-t-e-r10]

Dear Support Team,

I am experiencing connectivity issues with the SSSD service on our system, particularly related to the LDAP server for the domain fri.uniza.sk. When monitoring the logs at /var/log/sssd/sssd_fri.uniza.sk.log, I observe repeated errors indicating that LDAP operations cannot proceed due to binding issues. Here are the key error messages:

[sdap_get_generic_op_finished]: Unexpected result from ldap: Operations error(1), 000004DC: LdapErr: DSID-0C090C77, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v4563
[generic_ext_search_handler]: sdap_get_generic_ext_recv request failed: [5]: Input/output error
[fo_resolve_service_send]: No available servers for service 'LDAP'
[be_ptask_done]: Task [SUDO Full Refresh]: failed with [11]: Resource temporarily unavailable
[sdap_id_op_connect_done]: Failed to connect, going offline (5 [Input/output error])

The errors suggest that SSSD is attempting to bind to the LDAP server but fails, possibly due to incorrect bind credentials or connectivity problems. This issue results in the LDAP service going offline, which is affecting our system's authentication and directory access functionality.

Steps I have attempted so far:

Verified network connectivity to the LDAP server.
Ensured that the LDAP credentials and bind DN in SSSD configuration are correct.
Restarted the SSSD service to reinitiate the connection, but the errors persist.
Could you please advise on additional troubleshooting steps or configuration changes that might help resolve this issue?

Thank you for your assistance.

Best regards,
Peter Mako
student
[email protected]
[email protected]

[Fryguy]

Hi @p-e-t-e-r10. A few questions. What version are you using? Is this appliances or containerized? How did you setup the LDAP connection; was it via appliance console or appliance_console_cli or manual?

[p-e-t-e-r10]

I am using version of 16.1.0. This is appliances running on CentOS Stream release 8. When I setup LDAP connection i use configuration from this web page https://www.manageiq.org/docs/reference/latest/auth/ldap.html. I use this command in CLI: authselect select sssd --force. And after that I edited config file /etc/sssd/sssd.conf. I want just add users in my domain from ldap server to manage IQ. Perhaps the problem is that I don’t have administrator rights during the bind operation in LDAP. In bind is my school account from LDAP.

ldapsearch -x -H ldaps://ldap-example:10636 -LLL \

   -b "ou=people,dc=example,dc=com" -s sub     \
   "(objectclass=organizationalPerson)"

This command works properly when I modify parameters related to my configuration.