LDAP referrals not working in ipv6

Question

We are trying to make ldap referrals in ipv6 environment. Everything works well in ipv4 environment. But when we try to chase referral using ldp we get this error

Getting 0 entries:

-----------

***Searching...
ldap_search_s(ld, "dc=DC_NAME", 0, "objectclass=CLASS_NAME", attrList, 0, &msg)
Error: Search: Referral. <10>
Server error: 0000202B: RefErr: DSID-0310074A, data 0, 1 access points
ref 1: '[::1]:22389'

Error 0x202B A referral was returned from the server.
Result <10>: 0000202B: RefErr: DSID-0310074A, data 0, 1 access points
ref 1: '[::1]:22389'

Does referral work in ipv6 env? Is there something which can be done to make it work?

Setup: Our application is installed in Windows server 2016.

Answer 1

Hi @AD ,

I'm making the assumption that you are using Microsoft AD LDS (ADAM) for your LDAP environment.

I've tested using LDP with IPv6 binding and connecting to a local LDAP instance without any issues.

and a ldap_search_s command is successful in returning records:

The same is true if I connect remotely as well

and the search works

I'm assuming you change the BaseDN and Objectclass details in your question but to help remove any typos, use the dropdown option on the search dialog to select the base DN of your LDAP instance, as shown below.

From the testing I've done, yes AD LDS is able to support IPv6 connection and searches without issuing a referral for objects that exist in the context. Normally a referral is issue if the object is not within the context, but the LDAP server knows where it exists and provides the referral to the call client for information. You could try enabling referral as Session Option to the LDS server and see if this resolve the issue.

Within LDP from the Options menu, select Connection Options, and set the option as shown below, this will cause the server to chase the internal referral and return the results if they are within the same context:

You could also try setting the LDAP_OPT_REFERRALS = 64, which will cause the server to chase external referrals.

If that doesn't work maybe if you can share the RootDSE of the LDAP instance, any CrossRef objects that have been created, and the search details you are searching for.

Gary.

Answer 2

Hi there,

In order to support LDAP over an IPv6 network, transport calls have been modified to support both IPv4 and IPv6 based on the server configuration. It's worth checking your DNS and/or the hosts file(s) in use.

LDAP API which allows connection through IPv6

https://social.msdn.microsoft.com/Forums/office/en-US/cabead87-6453-4abb-afc9-89dfeef3ea5f/ldap-api-which-allows-connection-through-ipv6?forum=vcgeneral

LDAP auth doesn't support IPv6 addresses https:// github.com/metabase/metabase/issues/12879

--If the reply is helpful, please Upvote and Accept it as an answer--