Microsoft Security | Microsoft Entra | Other
Additional Microsoft Entra services and features related to identity, access, and network security
Bind failed when using Azure AD DS LDAPs.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(166.4, 56.00000000000001%, 26%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ET%3C/text%3E%3C/svg%3E)
Terrence
1
Reputation point
Hello,
I have Azure AD DS enabled. LDAPs is enabled with publicly trust wildcard certificate. security group is updated to allow the LDAPs port.
I can also successfully connect to the LDAPs server via ldp.exe in my laptop, but when I tried a simple bind with an existing user (not Guest) in Azure AD, it failed binding with below error,
res = ldap_simple_bind_s(ld, 'xxxxxxxxxx', <unavailable>); // v.3
Error <49>: ldap_simple_bind_s() failed: Invalid Credentials
Server error: 80090308: LdapErr: DSID-0C090446, comment: AcceptSecurityContext error, data 52e, v2580
Error 0x80090308 The token supplied to the function is invalid
May I ask how I can fix it? thank you
Microsoft Security | Microsoft Entra | Other
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(278.4, 57.00000000000001%, 36%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESS%3C/text%3E%3C/svg%3E)
Shashi Shailaj 7,636 Reputation points Microsoft Employee Moderator2020-09-16T14:22:54.05+00:00 I am building a lab to look into this. Meanwhile can you tell me if you have an environment where you are syncing users from on-prem to Azure AD to Azure AD domain services ? and If you have disabled the NTLM hash sync in your environment by disabling weak ciphers and NTLM password hash sync. Please check the related article. I have seen this behavior earlier after disabling NTLM hash sync and weak ciphers in order to secure the Azure AD DS environment. Also if you are trying with a cloud user from azure AD , can you change its password once and check again ?
-
Terrence 1 Reputation point
2020-09-17T04:30:22.17+00:00 Hi Shashi,
Thank you for the advice.
Yup. We have an environment syncing users from on-prem to Azure AD via Azure AD connect installed in on-premium domain controller. When I run troubleshooting for password synchronization, I can see that the password hash synchronization has been enabled and working fine.
I also tried a Azure user (member, not guest account) without extra role, but still shows the same error.
-
Terrence 1 Reputation point
2020-09-18T00:52:37.157+00:00 Hi,
I got it working with Bind with credentials now via ldp.exe, but Simple bind still does not work with error 'The token supplied to the function is invalid
'. did I missing anything for simple bind?
Sign in to comment
Sign in to answer