LDAP initialization failed

charles...@metglas.com

unread,

Nov 24, 2005, 8:46:48 PM11/24/05

to

Our LDAP server stopped working a couple of weeks ago for no apparent
reason. This stopped iManager and iFolders from working as well. I ran
pkdiag and it found two out of date certificates. I used pkdiag to fix
this and restarted the server but the problem persisted. I am getting
error messages on the Apache screen of our server console stating
that "LDAP initialization failed" and "Can't contact LDAP server(81)". I
have re-exported the SSL CertificateDNS object to
sys:\public\RootCert.der and restarted the server but still nothing. I
have tried LDAP authentication using a LDAP browser with anonymous and
authenticated authorization on ports 389 and 636 but it failed. I would
appreciate any suggestions.

Anders Gustafsson

unread,

Nov 25, 2005, 2:50:22 PM11/25/05

to

,

> authenticated authorization on ports 389 and 636 but it failed. I would
> appreciate any suggestions.
>

Run pkidiag in fixing mode, then run tckeygen

- Anders Gustafsson, Engineer, CNE6, ASE
NSC Volunteer Sysop
Pedago, The Aaland Islands (N60 E20)

Novell does not monitor these forums officially.
Enhancement requests for all Novell products may be made at
http://support.novell.com/enhancement

Using VA 5.51 build 315 on Windows 2000 build 2195

Edward van der Maas

unread,

Nov 27, 2005, 5:19:09 AM11/27/05

to

charles...@metglas.com wrote:

Besides Anders suggestion also check if LDAP is actually listening on
port 389 and 636. You can see it in TCPCON | Protocol information.
Maybe you have a more underlaying problem.

--
Cheers,
Edward

Anders Gustafsson

unread,

Nov 27, 2005, 1:22:26 PM11/27/05

to

Edward van der Maas,

> Besides Anders suggestion also check if LDAP is actually listening on
> port 389 and 636. You can see it in TCPCON | Protocol information.
> Maybe you have a more underlaying problem.
>

Yes. In that case. Turn on LDAP logging and unload/load NLDAP and read
the log.

charles...@metglas.com

unread,

Nov 28, 2005, 11:56:38 AM11/28/05

to

It looks like our LDAP server is not initializing properly. Whenever I
unload and load the apache server and tomcat the logger screen indicates
it is waiting on LDAP to initialize. I cannot see any references to LDAP
in TCPCON and I get nothing when I connect to
https:\\our_ip_address:636. I tried running tckeygen but nothing
happens. The file sys:/adminsrv/conf/.keystore still has a last mod date
of when we installed the server. Any ideas?

Anders Gustafsson

unread,

Nov 28, 2005, 12:11:41 PM11/28/05

to

,
> It looks like our LDAP server is not initializing properly. Whenever I
> unload and load the apache server and tomcat the logger screen indicates
> it is waiting on LDAP to initialize.
>

OK. Is NLDAP.NLM loaded at all? If not, then try what I suggested above.

charles...@metglas.com

unread,

Nov 28, 2005, 12:39:51 PM11/28/05

to

It looks like NLDAP loads fine. I have executed LOAD NLDAP and UNLOAD
NLDAP from the server console several times with no error messages. The
problem starts when I execute AP2WEBUP. When I do this I get the error
message that it cannot connect to the LDAP server. I ran the pkidiag
utility last week and it found two certs that were invalid and fixed
both. It looks like maybe the SSL on LDAP may be the issue. The
knowledgebase said that when I type LOAD NLDAP this should automatically
load NTLS and SASL. It does not. As I mentioned earlier, when I try to
run the tckeygen utility nothing comes up. I'm not sure whether that may
be due to the LDAP/SSL piece or not.
Thanks,
Charles

Anders Gustafsson

unread,

Nov 28, 2005, 12:56:25 PM11/28/05

to

,

> It looks like maybe the SSL on LDAP may be the issue. The
> knowledgebase said that when I type LOAD NLDAP this should automatically
> load NTLS and SASL.
>

OK. IS LDAP listening on both ports 389 and 636? Check in TCPCON? If it is,
then try an LDAP trace as you try 636

charles...@metglas.com

unread,

Nov 28, 2005, 1:41:13 PM11/28/05

to

I cannot find any references to LDAP on port 389 or 636 in TCPCON. The
Apache logger screen repeatedly displays the following group of messages.

LDAP initialization failed.
Configured LDAP was found ready to use.
NIF CertHandler: Root certificate file for master ldap not found,
requesting a new one from server.
NIF CertHandler: # Root Certs=1.
NIF CertHandler: Retrieved certificate of size=1332.
*MASTER[CWYFS102.metglas.com][-1] ldap_simple_bind: Cant contact LDAP
server(81)
ldap *MASTER[CWYFS102.metglas.com] down
LDAP initialization failed. Check LDAP and restart apache.

Does this help any?

Anders Gustafsson

unread,

Nov 28, 2005, 2:15:14 PM11/28/05

to

,
> Does this help any?
>
No. You need to find if NLDAP is loaded. Do this:

M NLDAP*

Does it show loaded?

Next. In ConsoleOne, LDAP Server/Group object (can't remember which
one) Screen Options tab. Turn on EVERYTING but the bottom-most. Then:

LOAD DSTRACE
-ALL
+LDAP
DSTRACE SCREEN on
DSTRACE FILE ON

Try unload NLDAP, then LOAD NLDAP

DSTRACE FILE off

Post dstrace.log here

Anders Gustafsson

unread,

Nov 28, 2005, 2:41:50 PM11/28/05

to

,
> Could not update server configuration, err = no such attribute (-603)
>
OK. Your LDAP objects are corrupt. In your initial post, you said: "Our LDAP server stopped working a couple of weeks ago for no apparent
reason." Are you sure nothing changed? DS upgrade?

Does this apply?

http://support.novell.com/techcenter/search/search.do?cmd=displayKC&docType=kc&externalId=10088679html&sliceId=&dialogID=2208101

charles...@metglas.com

unread,

Nov 28, 2005, 2:36:07 PM11/28/05

to

Yes, NLDAP shows as loaded. I was looking over a knowledgebase article
on troubleshooting iMonitor this morning and it directed me to do the
same thing for DSTRACE. The iMonitor and iFolders are not working,
probably since tomcat is not loading. Root cause seems to come back to
LDAP. Anyway, here is the DSTRACE log file:
Could not read LDAP Server name in ValidateLDAPObjects on iteration 2,