I have been working all evening on this issue and have hit a roadblock. We have a firewall that recently was restored to a November backup, and after reconfiguration LDAP auth is toast. I researched potential sources for the problem including Nate's excellent answer here on Server Fault.
Here is the rundown of the problem: Server 2012 environment, one DC running all services, just a simple CIFS box, shared printers and ADDS. Firewall is TZ205W with VPN licensing.
With the following settings:
LDAP Name : Server.MYCOMPANY.local Port: 636 Give bind distinguished name: svc_account@MYCOMPANY.local Protocol: LDAP v3 Use TLS: Y Send LDAP Start TLS: Y
I get LDAP communication error. I've played around with port settings and TLS, and I can get as close as "User is not authorized on LDAP server" but never anything else. The ports and routes between the firewall and the server are clean.
This DC is the only server in the environment and nothing has changed on its end. We have seen some minor DNS errors but nothing that would totally break standard LDAP on 636 or 389. I have gone so far as to go against best practice and install AD LDS on the domain controller to see if I can force a connection but so far no dice either.
The most unusual part about this is that if I go to the Schema or Directory tabs, I get errors returned of either
unrecognized schema despite AD being selected or when trying to pull the group OUs an error returned
no user groups were found on the LDAP server. Check the LDAP directory configuration.
I am at a loss. We've tried every combination of IP, FQDN, UPN and the like to get this thing to work and it is refusing.
Has anyone see problems like this before?