<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">Is it possible that in attempting to authenticate against a directory, with <div>multiple servers specified in the url:</div><div><span style="font-family: Monaco; font-size: 11px; background-color: rgb(255, 250, 194);">ldapUrl="</span><a href="ldap://fbk-adua02.ua.ad.alaska.edu:3268" style="font-family: Monaco; font-size: 11px;">ldap://fbk-adua02.ua.ad.alaska.edu:3268</a><span style="font-family: Monaco; font-size: 11px; background-color: rgb(255, 250, 194);"> </span><a href="ldap://fbk-adua03.ua.ad.alaska.edu:3268" style="font-family: Monaco; font-size: 11px;">ldap://fbk-adua03.ua.ad.alaska.edu:3268</a><font face="Monaco"><span style="font-size: 11px;">”</span></font></div><div><div><div>that the first step - search of the directory with the user-provided identifier - returns a dn from one server,</div><div>while the second step - to bind with that dn and the user-provided password - hits the other server, and</div><div>that the second server fails to find that dn, leading to the “invalid dn” message?</div><div><br></div><div>Of course the two servers are supposed to be in sync, but is it possible that the “invalid dn” I’m seeing</div><div>during a few authentications reflects an out-of-sync condition plus hitting two different servers in the “two step bind?”</div><div><br></div><div>Grasping at straws I know...</div><div><br></div><div>David Bantz</div><div>U Alaska</div></div></div></body></html>