Active Directory: ldap_simple_bind_s error codes

bekz

Hi All,

Is there any way to find out the exact error message in case of bind
failure.

After googling a bit i found two sol

1. ==> says to
use ldap_get_option() to get the error string and then parse and
extract the error codes. To my understanding this is an extended error
message
2. ==>
says to analyze few attributes like accountExpires/userAccountControl

which one of these is better? apart from considering that 2nd method
has to do another search and find out the error.

Thanks in advance
becks

bekz

On Jul 11, 5:26 pm, Michael Ströder <> wrote:
> bekz wrote:
>
> > 1.http://forum.java.sun.com/thread.jspa?messageID=4227692==> saysto
> > use ldap_get_option() to get the error string and then parse and
> > extract the error codes. To my understanding this is an extended error
> > message
>
> You should do this in any case.
>
> > 2.http://blogs.msdn.com/jpelak/archive/2006/01/08/510563.aspx==>
> > says to analyze few attributes like accountExpires/userAccountControl
>
> This could be an additional source for information what went wrong. But
> these are proprietary attributes in AD. You may also not have the right
> to read the user entry before binding.
>
> Ciao, Michael.

Hi Ciao,
Thanks for the reply

I will be having the access to do the search which is achieved using
another user credentials.

Thanks
becks

Michael Ströder

bekz wrote:
>
> 1. ==> says to
> use ldap_get_option() to get the error string and then parse and
> extract the error codes. To my understanding this is an extended error
> message

You should do this in any case.

> 2. ==>
> says to analyze few attributes like accountExpires/userAccountControl

This could be an additional source for information what went wrong. But
these are proprietary attributes in AD. You may also not have the right
to read the user entry before binding.

Ciao, Michael.

Joe Kaplan

The extended server error codes are pretty helpful, as they tell you the
exact reason the bind failed. This only works for simple bind (not for
secure for whatever reason), but it is very useful. It is probably easier
than trying to determine if the user is locked, account expired, account
disabled, password expired or password set to change at next logon.

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"

--
"bekz" <> wrote in message
news:1184164078.102117.6410@n2g2000hse.googlegroup s.com...
On Jul 11, 5:26 pm, Michael Ströder <> wrote:
> bekz wrote:
>
> > 1.http://forum.java.sun.com/thread.jspa?messageID=4227692==> says to
> > use ldap_get_option() to get the error string and then parse and
> > extract the error codes. To my understanding this is an extended error
> > message
>
> You should do this in any case.
>
> > 2.http://blogs.msdn.com/jpelak/archive/2006/01/08/510563.aspx==>
> > says to analyze few attributes like accountExpires/userAccountControl
>
> This could be an additional source for information what went wrong. But
> these are proprietary attributes in AD. You may also not have the right
> to read the user entry before binding.
>
> Ciao, Michael.

Hi Ciao,
Thanks for the reply

I will be having the access to do the search which is achieved using
another user credentials.

Thanks
becks

bekz

On Jul 11, 5:26 pm, Michael Ströder <> wrote:
> bekz wrote:
>
> > 1.http://forum.java.sun.com/thread.jspa?messageID=4227692==> saysto
> > use ldap_get_option() to get the error string and then parse and
> > extract the error codes. To my understanding this is an extended error
> > message
>
> You should do this in any case.
>
> > 2.http://blogs.msdn.com/jpelak/archive/2006/01/08/510563.aspx==>
> > says to analyze few attributes like accountExpires/userAccountControl
>
> This could be an additional source for information what went wrong. But
> these are proprietary attributes in AD. You may also not have the right
> to read the user entry before binding.
>
> Ciao, Michael.

Hi Ciao,
Thanks for the reply

I will be having the access to do the search which is achieved using
another user credentials.

Thanks
becks

bekz

Thanks a lot Joe!

On Jul 11, 8:29 pm, "Joe Kaplan"
<> wrote:
> The extended server error codes are pretty helpful, as they tell you the
> exact reason the bind failed. This only works for simple bind (not for
> secure for whatever reason), but it is very useful. It is probably easier
> than trying to determine if the user is locked, account expired, account
> disabled, password expired or password set to change at next logon.
>
> Joe K.
>
> --
> Joe Kaplan-MS MVP Directory Services Programming
> Co-author of "The .NET Developer's Guide to Directory Services Programming"http://www.directoryprogramming.net
> --"bekz" <> wrote in message
>
> news:1184164078.102117.6410@n2g2000hse.googlegroup s.com...
> On Jul 11, 5:26 pm, Michael Ströder <> wrote:
>
>
>
> > bekz wrote:
>
> > > 1.http://forum.java.sun.com/thread.jspa?messageID=4227692==> says to
> > > use ldap_get_option() to get the error string and then parse and
> > > extract the error codes. To my understanding this is an extended error
> > > message
>
> > You should do this in any case.
>
> > > 2.http://blogs.msdn.com/jpelak/archive/2006/01/08/510563.aspx==>
> > > says to analyze few attributes like accountExpires/userAccountControl
>
> > This could be an additional source for information what went wrong. But
> > these are proprietary attributes in AD. You may also not have the right
> > to read the user entry before binding.
>
> > Ciao, Michael.
>
> Hi Ciao,
> Thanks for the reply
>
> I will be having the access to do the search which is achieved using
> another user credentials.
>
> Thanks
> becks

Joe Kaplan

The extended server error codes are pretty helpful, as they tell you the
exact reason the bind failed. This only works for simple bind (not for
secure for whatever reason), but it is very useful. It is probably easier
than trying to determine if the user is locked, account expired, account
disabled, password expired or password set to change at next logon.

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"

--
"bekz" <> wrote in message
news:1184164078.102117.6410@n2g2000hse.googlegroup s.com...
On Jul 11, 5:26 pm, Michael Ströder <> wrote:
> bekz wrote:
>
> > 1.http://forum.java.sun.com/thread.jspa?messageID=4227692==> says to
> > use ldap_get_option() to get the error string and then parse and
> > extract the error codes. To my understanding this is an extended error
> > message
>
> You should do this in any case.
>
> > 2.http://blogs.msdn.com/jpelak/archive/2006/01/08/510563.aspx==>
> > says to analyze few attributes like accountExpires/userAccountControl
>
> This could be an additional source for information what went wrong. But
> these are proprietary attributes in AD. You may also not have the right
> to read the user entry before binding.
>
> Ciao, Michael.

Hi Ciao,
Thanks for the reply

I will be having the access to do the search which is achieved using
another user credentials.

Thanks
becks

bekz

Thanks a lot Joe!

On Jul 11, 8:29 pm, "Joe Kaplan"
<> wrote:
> The extended server error codes are pretty helpful, as they tell you the
> exact reason the bind failed. This only works for simple bind (not for
> secure for whatever reason), but it is very useful. It is probably easier
> than trying to determine if the user is locked, account expired, account
> disabled, password expired or password set to change at next logon.
>
> Joe K.
>
> --
> Joe Kaplan-MS MVP Directory Services Programming
> Co-author of "The .NET Developer's Guide to Directory Services Programming"http://www.directoryprogramming.net
> --"bekz" <> wrote in message
>
> news:1184164078.102117.6410@n2g2000hse.googlegroup s.com...
> On Jul 11, 5:26 pm, Michael Ströder <> wrote:
>
>
>
> > bekz wrote:
>
> > > 1.http://forum.java.sun.com/thread.jspa?messageID=4227692==> says to
> > > use ldap_get_option() to get the error string and then parse and
> > > extract the error codes. To my understanding this is an extended error
> > > message
>
> > You should do this in any case.
>
> > > 2.http://blogs.msdn.com/jpelak/archive/2006/01/08/510563.aspx==>
> > > says to analyze few attributes like accountExpires/userAccountControl
>
> > This could be an additional source for information what went wrong. But
> > these are proprietary attributes in AD. You may also not have the right
> > to read the user entry before binding.
>
> > Ciao, Michael.
>
> Hi Ciao,
> Thanks for the reply
>
> I will be having the access to do the search which is achieved using
> another user credentials.
>
> Thanks
> becks