{"record":{"id":"48f14f1c04386544","repo":"bytebase/bytebase","slug":"dial-v","errorCode":null,"errorMessage":"dial: %v","messagePattern":"dial: %v","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"backend/plugin/idp/ldap/ldap.go","lineNumber":104,"sourceCode":"\nfunc (p *IdentityProvider) dial() (*ldap.Conn, error) {\n\ttlsConfig := &tls.Config{\n\t\tServerName:         p.config.Host,\n\t\tInsecureSkipVerify: p.config.SkipTLSVerify,\n\t}\n\tswitch p.config.SecurityProtocol {\n\tcase storepb.LDAPIdentityProviderConfig_LDAPS:\n\t\turl := fmt.Sprintf(\"ldaps://%s:%d\", p.config.Host, p.config.Port)\n\t\tconn, err := ldap.DialURL(url, ldap.DialWithTLSConfig(tlsConfig))\n\t\tif err != nil {\n\t\t\treturn nil, errors.Errorf(\"dial TLS: %v\", err)\n\t\t}\n\t\treturn conn, nil\n\tcase storepb.LDAPIdentityProviderConfig_START_TLS:\n\t\turl := fmt.Sprintf(\"ldap://%s:%d\", p.config.Host, p.config.Port)\n\t\tconn, err := ldap.DialURL(url)\n\t\tif err != nil {\n\t\t\treturn nil, errors.Errorf(\"dial: %v\", err)\n\t\t}\n\t\tif err := conn.StartTLS(tlsConfig); err != nil {\n\t\t\t_ = conn.Close()\n\t\t\treturn nil, errors.Errorf(\"start TLS: %v\", err)\n\t\t}\n\t\treturn conn, nil\n\tdefault:\n\t\turl := fmt.Sprintf(\"ldap://%s:%d\", p.config.Host, p.config.Port)\n\t\tconn, err := ldap.DialURL(url)\n\t\tif err != nil {\n\t\t\treturn nil, errors.Errorf(\"dial: %v\", err)\n\t\t}\n\t\treturn conn, nil\n\t}\n}\n\n// Connect establishes a connection using the bind DN and bind password.\nfunc (p *IdentityProvider) Connect() (*ldap.Conn, error) {","sourceCodeStart":86,"sourceCodeEnd":122,"githubUrl":"https://github.com/bytebase/bytebase/blob/1870550677fe08f0d2a78c07acd27541464eb945/backend/plugin/idp/ldap/ldap.go#L86-L122","documentation":"dial, in START_TLS mode, first opens a plain LDAP connection with ldap.DialURL; if the initial TCP connection fails, the error is wrapped as 'dial: %v'. This is a network-level failure before any TLS upgrade is attempted.","triggerScenarios":"Calling Connect with SecurityProtocol START_TLS when the LDAP host is unreachable: DNS resolution failure, wrong host/port, service down, or firewall dropping the connection to port 389.","commonSituations":"Typo in the LDAP hostname; LDAP service stopped; container/network isolation blocking egress; port left at a default that the server does not listen on.","solutions":["Check network reachability: ping/nc the configured host and port.","Fix the Host/Port values in the identity provider config (default 389 for StartTLS).","Verify DNS resolution for the configured hostname.","Ensure the LDAP service (slapd/AD) is running and listening.","Check firewalls/security groups between Bytebase and the directory server."],"exampleFix":"// before\nconfig.Host = \"ldap-internal\" // not resolvable\n// after\nconfig.Host = \"ldap-internal.corp.example.com\"\nconfig.Port = 389","handlingStrategy":"retry","validationCode":"func ldapReachable(host string, port int) error {\n\tconn, err := net.DialTimeout(\"tcp\", fmt.Sprintf(\"%s:%d\", host, port), 5*time.Second)\n\tif err != nil { return err }\n\treturn conn.Close()\n}\n// run before Connect to fail fast on network issues","typeGuard":null,"tryCatchPattern":"conn, err := p.dial()\nif err != nil {\n\tif strings.Contains(err.Error(), \"dial:\") {\n\t\treturn nil, fmt.Errorf(\"cannot reach LDAP at %s:%d: %w\", p.config.Host, p.config.Port, err)\n\t}\n\treturn nil, err\n}\ndefer conn.Close()","preventionTips":["Resolve and ping the LDAP hostname before configuring it.","Use a short dial timeout so failures surface quickly.","Retry with backoff for transient network blips.","Confirm firewall rules allow egress to port 389/636."],"tags":["ldap","network","connection"],"backgroundTag":"connection-refused","analyzedSha":"1870550677fe08f0d2a78c07acd27541464eb945","analyzedAt":"2026-09-06T21:16:13.665Z","contentChangedAt":"2026-09-06T21:16:13.665Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}