Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What permissions are needed to perform an LDAP bind to an active directory server? I have a central domain (call it MAIN) that has two-way trusts to domains in other forests (call then REMOTE and FARAWAY)

Using MAIN\myaccount as the username and my password I can bind to REMOTE fine, but not to FARAWAY; I get an invalid credentials response

80090308: LdapErr: DSID-0C09030B, comment: AcceptSecurityContext error, data 525, v893

In all other ways the trusts seem to work fine.

What permissions do I need to check to figure out why the bind is failing? My understanding is that anyone in AUTHENTICATED USERS should be able to bind to LDAP, but that only seems to hold true for some domaians and not others.

share|improve this question

Error 49, subtype 525 is bad user DN. I.e. The bind DN is not a valid object in the directory.

share|improve this answer
It shouldn't be a valid object in the FARAWAY directory, it's an object in the MAIN directory... I'm trying to figur eout why REMOTE is OK with this but FARAWAY isn't. – DrStalker Oct 20 '09 at 23:27
So then the question is, how does AD handle authing to one domain, with a user in another domain. In vanilla LDAP, that probably would not work well. So how do trusts between domains convert to AD cross domain boundaries. Sorry, I do not know the answer to that one. – geoffc Oct 21 '09 at 1:30

Error 525 is actually a DN not being found, you can take a look at this thread on the Oracle forums :

share|improve this answer

Your error isn't that you don't have permission to bind, but that you are binding to a non-existent DN. Please be aware that LDAP DNs do not look like Active Directory usernames, but that they use a different format.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.