{"record":{"id":"34dbe6c536524261","repo":"juicedata/juicefs","slug":"ldapgetdefaultnamingcontext-failed-w","errorCode":null,"errorMessage":"LdapGetDefaultNamingContext failed: %w","messagePattern":"LdapGetDefaultNamingContext failed: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/win/sid.go","lineNumber":185,"sourceCode":"\t\tif sid1.SubAuthority(uint32(i)) != sid2.SubAuthority(uint32(i)) {\n\t\t\treturn false\n\t\t}\n\t}\n\n\treturn true\n}\n\n// initializeTrustPosixOffsets queries LDAP and sets TrustPosixOffset for each trusted domain.\nfunc initializeTrustPosixOffsets() error {\n\thandle, err := LdapConnect(\"\") // empty string means default server\n\tif err != nil {\n\t\treturn fmt.Errorf(\"LdapConnect failed: %w\", err)\n\t}\n\tdefer LdapClose(handle)\n\n\tdefaultNC, err := LdapGetDefaultNamingContext(handle)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"LdapGetDefaultNamingContext failed: %w\", err)\n\t}\n\n\t// For each trusted domain, get trustPosixOffset\n\tfor i := range trustedDomains {\n\t\tdomain := windows.UTF16PtrToString(trustedDomains[i].DnsDomainName)\n\t\toffsetStr, err := LdapGetTrustPosixOffset(handle, defaultNC, domain)\n\t\tif err == nil {\n\t\t\tif val, err := strconv.ParseUint(offsetStr, 10, 32); err == nil {\n\t\t\t\ttrustedDomains[i].TrustPosixOffset = uint32(val)\n\t\t\t}\n\t\t}\n\t}\n\n\t// If trustPosixOffset looks wrong, fix it up using Cygwin magic value 0xfe500000\n\tfor i := range trustedDomains {\n\t\tif trustedDomains[i].TrustPosixOffset < 0x100000 {\n\t\t\ttrustedDomains[i].TrustPosixOffset = 0xfe500000\n\t\t}","sourceCodeStart":167,"sourceCodeEnd":203,"githubUrl":"https://github.com/juicedata/juicefs/blob/c9a67b23e8e08ec23ec331aa6f1675e2319e921c/pkg/win/sid.go#L167-L203","documentation":"During package initialization, initializeTrustPosixOffsets connects to the Active Directory LDAP server and asks it for the default naming context (the forest root DN). If the LdapGetDefaultNamingContext call fails, the error is wrapped with %w and returned, aborting the POSIX offset initialization that maps trusted domains to UID/GID ranges. This means Windows SID-to-UID translation cannot be seeded from AD.","triggerScenarios":"The package-level init() in pkg/win/sid.go runs initializeTrustPosixOffsets on every process start; it fails when LdapGetDefaultNamingContext(handle) returns a non-nil error (LDAP bind succeeded via LdapConnect but the base-DN query failed, e.g. server refused the search or returned an LDAP error).","commonSituations":"Running a JuiceFS Windows client against an AD domain controller that is unreachable or misconfigured; the machine is not domain-joined; LDAP over the chosen port (389/636) is blocked by firewall; the DC rejects anonymous or machine-account searches for the RootDSE defaultNamingContext.","solutions":["Verify the machine is domain-joined and can reach its AD domain controller: nltest /dsgetdc:<domain> and test LDAP port connectivity.","Check that the account the process runs under is allowed to read RootDSE/defaultNamingContext.","If LDAP is over TLS, confirm the DC certificate is valid and the LDAPS port (636) is open.","Inspect the wrapped underlying error (%w) with errors.Unwrap to see the specific LDAP status code and address it.","If trust-POSIX-offset lookup is not needed in your environment, avoid initializing that path or supply id mappings locally."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Go: before relying on SID<->UID mapping, verify LDAP reachability\nconn, err := net.DialTimeout(\"tcp\", \"dc.example.com:389\", 3*time.Second)\nif err != nil {\n    return fmt.Errorf(\"LDAP DC unreachable: %w\", err)\n}\nconn.Close()","typeGuard":null,"tryCatchPattern":"if err != nil {\n    var lerr *ldap.Error\n    if errors.As(err, &lerr) {\n        log.Printf(\"LDAP result code %d: %v\", lerr.ResultCode, lerr)\n    }\n    return fmt.Errorf(\"posix offsets unavailable: %w\", err)\n}","preventionTips":["Ensure hosts are domain-joined before deploying Windows clients.","Monitor LDAP port connectivity to DCs in health checks.","Validate LDAPS certificates on DCs.","Handle init-time mapping failures gracefully instead of crashing the client."],"tags":["windows","ldap","active-directory","startup"],"backgroundTag":"ldap-query-failed","analyzedSha":"c9a67b23e8e08ec23ec331aa6f1675e2319e921c","analyzedAt":"2026-09-06T17:55:48.476Z","contentChangedAt":"2026-09-06T17:55:48.476Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}