AAD DS LDAPS cannot connect

Jorge Alvarez 1 Reputation point
2021-03-11T04:46:33.9+00:00

Hello,

I'm trying to get AAD DS LDAPS working for me, I'm not really interested in the vnet side of the services, but the public IP LDAPS.

I followed the guide:

https://learn.microsoft.com/en-us/azure/active-directory-domain-services/tutorial-configure-ldaps

but LDAP.exe states it cannot connect:

ld = ldap_sslinit("ldaps.gain-i.com", 636, 1); Error <0x51> = ldap_set_option(hLdap, LDAP_OPT_PROTOCOL_VERSION, LDAP_VERSION3); Error <0x51> = ldap_connect(hLdap, NULL); Server error: <empty> Error <0x51>: Fail to connect to ldaps.gain-i.com.

The certificate is self signed as stated in the guide and the ip and host name has been added to the host file. The cert as stated in the guide is a wildcard for the domain.

Rules are fine on the NSG and Test-NetConnection comes back true to port 636.

Microsoft Entra

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. James Hamil 21,851 Reputation points Microsoft Employee
    2021-03-16T18:02:43.597+00:00

    Hi @Jorge Alvarez ,

    Jason from our team recommends you try from the VNET to confirm it isn't networking.

    The name needs to match the AADDS DNS name for the subject name match. Just to clarify this a bit, we would like you to work through the different aspects of getting the connection:

    1) configuring the domain controller,
    2) configuring the client,
    3) networking, and
    4) establishing the TLS session.

    For configuration, the DC will use the ADDS domain name (not the AAD domain name) for looking in its cert store for the certificate. For the most part, we orchestrate putting the certificate in the right place and let Windows Server do its thing. So there can’t be any spelling mistakes of the DC won’t select the certificate. The client attempts to establish the TLS connection using the name provided by the customer. So the traffic needs to get all the way through. The DC sends the public key of the server auth cert. The cert needs to have the right usage in the certificate, the name signed in the subject name must be compatible for the client to trust that the server is the DNS name which you’re connecting to (ie wildcard is good enough and no spelling mistakes), and the client must trust the issuer. Problems in that chain will be logged in the SCHANNEL logs of the client (System?). Once those pieces are in place they form a session key. I’m assuming you aren't trying a client auth over SSL. That would complicate the issue.

    We hope this helps. If so, please mark the answer as "Verified" so other users may reference it.

    Thank you,
    James

    0 comments
  2. Justinha 1 Reputation point Microsoft Employee
    2021-04-26T19:22:48.733+00:00

    We added this in a new Troubleshooting section at the end of the topic. Thanks again for the feedback!

    Justin [Microsoft]

    0 comments