ldap warning "Unsuccessful search response" after upgrade to IDP 5

[Peter Schober]

David Stava <David.Stava at ist.ac.at> [2024-04-03 10:02 CEST]:
> in ldap.properties we have

Those look fine to me.

> > INVALID_DN_SYNTAX (coming from your LDAP server) still seems clear?
> 
> I'm not sure what do you mean?

I just meant that as an error message result code 34 is quite
specific. Also I was thinking that "user at domain" literally isn't a
valid LDAP Distinguished Name (cf. RFC 4514) but then this error code
comes from the M$ implementation and those allows for DNs of such
format.

Am I correct that you have been sanitising your posts containing
"user at domain" and that 'domain' really is ista.ac.at or ist.ac.at?
Or does that error msg literally contain the string "user at domain"?
(Sanitising the user-specific part is of course fine.)

> Error resolving entry for username at domain. Unsuccessful search response:
> org.ldaptive.SearchResponse at 1220993256::messageID=2, controls=[],
> resultCode=INVALID_DN_SYNTAX, matchedDN=, diagnosticMessage=0000208F:
> NameErr: DSID-03100233, problem 2006 (BAD_NAME), data 8350

To me the main thing here is LDAP Result Code 34
("INVALID_DN_SYNTAX"), but there's quite a bit of additional
information above added by the server (starting with
"diagnosticMessage") which you'd have to ask the vendor about.

>From the config you posted there's no apparent invalid DN syntax so I
guess that leaves what Scott said wrt ldap-authn-config.xml.
  Nothing else makes much sense when you've been using the same LDAP
server with earlier versions of the software but using the same
ldap.properties.

-peter