I have an interesting situation where we have the exact same application running in a "Development" environment and another in a "Testing" environment behaving differently when authenticating with AD via LDAP. The behavior is we want LDAP to throw an Authentication Exception if a user tries to authenticate with a disabled account. In Development this works exactly as expected and we get a error as defined below (data code = 533):


When we run this code in the Testing environment however it lets the disabled user login fine. Clearly something is configured differently with LDAP/AD in each environment right? If so what setting controls this behavior?

  • Do you have multiple domain controllers in the testing environment and are they replicating? (repadmin /showrepl) – Ryan Ries Apr 30 '16 at 14:08
  • We are not replicating in the test environment. – nwallman May 2 '16 at 14:38
  • so, just to make sure - both applications are using the same LDAP source? - sounds like kerberos or local caching to me. - you don't say how the app is integrated is it ldap bind or dir sync? – Sum1sAdmin May 3 '16 at 9:44
  • I'm more or less authenticating as shown in this documentation: docs.oracle.com/javase/jndi/tutorial/ldap/security/ldap.html – nwallman May 3 '16 at 14:12
  • 2
    try disabling local user credential caching support.microsoft.com/en-us/kb/172931 – Oxymoron May 6 '16 at 6:58

Looks like this is a bug with Microsoft AD and Guest Account, fix is disabling the guest account.

Guest Accounts on AD Server

  • I don't really see this as a bug per se. It's likely a combination of the way JNDI handles LDAP binding and the default settings of AD allowing anonymous (aka Guest) binds. Disabling the guest account is just a hacky way to disallow anonymous binds. You can do it more elegantly with group policy. – Ryan Bolger May 11 '16 at 22:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.