I understand this error has been asked quite a few times on Server Fault and I have done some extensive googling, however, I can not, for the life of me, figure out exactly why I am unable to ldapsearch.

My ultimate goal is to use the adLDAP php script on a debian box that is joined to a windows domain through openLDAP. openLDAP works properly on the debian box and I have my domain users able to log in and such. However, any time I try to ldapsearch or run the adLDAP script I receive the same error which is

ldap_bind: Invalid credentials (49)

The ldapsearch I am using is the following:

ldapsearch -D "cn=test" -w Test123 -h DomainCont.example.local -b "dc=example,dc=local" -s sub "(objectclass=*)"

I'm tearing out my hair here. Running the debug parameter doesn't seem to be helping either as it shows

** ld 0x8e6410 Connections: host: DomainCont.example.local port: 389 (default) refcnt: 2 status: Connected last used: Thu Jan 10 12:45:48 2013

Any help would be greatly appreciated.


The server returns the error, so debugging on the client won't help very much. Unfortunately your example may be too obfuscated to troubleshoot; I am going to assume that you really do not have a suffix appended to "cn=test" per your example.

If you're binding to AD, cn=test needs to contain the full LDAP path. (in this case, cn=test,ou=container,dc=example,dc=local) For AD users, you can use an alternate syntax of 'DOMAIN\samaccountname' -- remember that the backslash needs to be escaped if you're not using single quotes. (edit: they're not actually binding against Active Directory)

It would be beneficial to review how the system is authenticating against LDAP and try to mirror that as closely as possible. I suggest modifying your post to include those details if this is not helpful.

  • Thanks for the quick response, I really do appreciate it. So yes, you are right it isn't test, I'm actually using cn=test, I just substituted the names in in the original comment. The command that I am running is ldapsearch -D "cn=test, ou=Domain Controllers, dc=example, dc=local" -w Test123 At least I know that the adLDAP.php script is actually connecting to the server and working. Seems like I just need to pass in the correct token and it should work. I've tried EXAMPLE\\test, however, the adLDAP page just returns a Server Error. It seems I cant pass special characters. – Seamaf Bchihalouk Jan 10 '13 at 22:31
  • Does the commandline ldapsearch still fail with the "EXAMPLE\\test" syntax? Keep in mind that the LDAP object must actually have a samaccountname attribute in order for that syntax to work. (i.e. a Windows username) – Andrew B Jan 10 '13 at 22:38
  • Yes, the ldapsearch does still fail. I dont quite understand how to give the LDAP object a sAMAccountname attribute. The cn I am using is an administrator on the AD server. Is there some configuration that needs to be done on the openLDAP side? – Seamaf Bchihalouk Jan 10 '13 at 22:52
  • Apparently I am unable to edit my previous comment, however, I managed to get my ldapsearch to work properly. I had to type the following to have it work ldapsearch -D "cn=Test, cn=Users, dc=example, dc=local" -w Test123. Now I need to use the same properties when using my adLDAP. Thanks for the help thus far. I'll keep you updated. – Seamaf Bchihalouk Jan 10 '13 at 23:18
  • Sorry about that, I misunderstood you earlier. The "DOMAIN\\user" stuff won't work because you're binding against a separate LDAP server, not the actual AD server itself. Sounds like you're on the home stretch though. – Andrew B Jan 10 '13 at 23:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.