This feature is available with Cloud Identity Premium edition. Compare editions
Before you try to connect your LDAP client to the Secure LDAP service, optionally you might want to do a quick connectivity test using simple tools like ldapsearch, ADSI, or ldp.exe. These tools can also be used for troubleshooting if you encounter errors while trying to connect your LDAP client to the service.
The tests described in the sections below enable you to understand if you have a configuration issue on your end, common error messages, and recommendations for how those issues can be fixed.
This article contains the following sections:
- Verify connectivity and run an LDAP query
Running an LDAP query enables you to confirm that you can connect to Secure LDAP and perform queries.
- If needed, run basic connectivity testing
If running an LDAP query fails, run basic connectivity testing to test for network access and authentication.
Note: If you need to contact Google Workspace Support or Cloud Identity Premium Support during this process, be sure to save the output of the commands. Make sure you remove any personally identifiable information from the output before sharing them with the support team.
Verify connectivity and run an LDAP query
Once you've set up the Secure LDAP service in the Google Admin console, you can use one of these three simple tools to verify connectivity with Secure LDAP: ldapsearch, ADSI, or ldp.exe. For details and instructions, see the sections below.
If needed, run basic connectivity testing
If you're unable to obtain a successful result in Verify connectivity and run an LDAP query, follow the instructions in this section for connectivity testing. If ldapsearch is not successful in returning the expected user and does not give a clear indication that the underlying TLS session is successful, use the OpenSSL client to verify that the network layers that OpenLDAP relies on are working as expected.
To conduct basic connectivity testing:
- Install the openssl client utility for your operating system.
Most GNU/Linux distributions use the package name "openssl". See details about other operating systems.
-
Make a manual connection to the Secure LDAP service using the openssl client:
openssl s_client -connect ldap.google.com:636
Confirm that the SSL negotiation has succeeded by the presence of the following line at the end of the openssl s_client output:
Verify return code: 0 (ok)
Possible errors
OpenSSL client/library does not support SNI (Server Name Indication)
During the connectivity test, the following output might be returned:
Verify return code: 18 (self signed certificate)
The Secure LDAP service requires a TLS client that supports and initiates a TLS session using SNI (Server Name Indication). If the TLS client does not support SNI, then the TLS server (ldap.google.com) returns a self-signed certificate that will not pass CA validation checks, to indicate that SNI is required.
This behavior can be confirmed by checking the OpenSSL client output for the following line near the start of the output:
depth=0 OU = "No SNI provided; please fix your client.", CN = invalid2.invalid
Causes for this error may include an OpenSSL version that does not support SNI, or an application that uses the OpenSSL library with SNI explicitly disabled.
Connection refused
If the following output is returned—where {timestamp} is a UNIX timestamp in microseconds—the TCP connection is being actively refused before the TLS negotiation can start:
{timestamp}:error:0200206F:system library:connect:Connection refused:crypto/bio/b_sock2.c:110:
{timestamp}:error:2008A067:BIO routines:BIO_connect:connect error:crypto/bio/b_sock2.c:111:connect:errno=111
This may be caused by the following:
- An application-level or system-level firewall on the local machine
- A firewall on the same physical network or upstream network
To investigate, use tcptraceroute to determine which host is refusing the connection—for example, tcptraceroute ldap.google.com 636.