Tag: websphere

Basic troubleshooting with ldapsearch

Ldapsearch is a simple comannd-line tool, helpful for checking LDAP connection parameters and building LDAP search filters.

On many Linux and Mac OS setups it’s installed by default. Fortunately a ldapsearch.exe running on Windows is included in the program directory of IBM Notes Client and Domino Server.

Syntax: ldapsearch -h HOST -p PORT -D BINDUSER -w PASSWORD -b BASEDN (LDAP_SEARCH_FILTER)
# For example: Use a LDAP account for bind to ldap service and search for a single user account with it's CN

ldapsearch -h "ldap.domain.com" -p "389" -D "CN=LDAP Bind,OU=User,DC=DOMAIN" -w "secret" -b "OU=User,DC=DOMAIN" "(cn=Connections ServiceUser)"

You might see some more output from this command. Pay attention to the following messages and probable failure reasons:

‘invalid credentials’

  • Wrong credentials for the LDAP bind user
  • TCP connection to LDAP service is working

’32 No such object’

  • The LDAP Base DN is most propably not available
  • LDAP bind works

‘numResponses: 1’

  • No result for your LDAP search Filter. You can try a search sring like (cn=*) to get an overview of all LDAP entries available.
  • LDAP bind works and Base DN is available

‘numResponses: 2’

  • Search for an single user was successful

WebSphere Federated Repository with Domino LDAP

If IBM Domino LDAP is used for WebSphere Application Server 8.x federated repository problems can occur if another repository (Active Direcory for example) needs to be added to the configuration.

A common work-around when using Domino LDAP in combination with WebSphere Application Server is to use “root” as base-entry. If “O=COMPANY” is used for example, which is actual more usual, Websphere is unable to resolve groups in Domino LDAP.

At the moment an additional LDAP source needs to be connected to WebSphere you might recognize that the configuration is screwed.

On my demo setup I have a Microsoft ActiveDirectory and Domino LDAP (configured in this sequence) connected as Websphere repositories.

was_fed_repo1

The configuration becomes corrupted if I want to add another LDAP server :

was_fed_repo2

To configure Websphere with a Domino LDAP and one or more additional LDAP repositories, first add the non-Domino repositories to your Application Servers.