{"record":{"id":"4c25b47d79b772ac","repo":"risingwavelabs/risingwave","slug":"failed-to-connect-to-ldap-server","errorCode":null,"errorMessage":"Failed to connect to LDAP server","messagePattern":"Failed to connect to LDAP server","errorType":"exception","errorClass":"PsqlError","httpStatus":null,"severity":"error","filePath":"src/utils/pgwire/src/ldap_auth.rs","lineNumber":458,"sourceCode":"\n            let client_config = tls_config.init_client_config()?;\n            settings = settings.set_config(Arc::new(client_config));\n\n            if matches!(tls_config.req_cert, ReqCertPolicy::Demand) {\n                settings = settings.set_no_tls_verify(false);\n            } else {\n                warn!(\n                    \"LDAP client certificate verification is disabled due to LDAPTLS_REQCERT policy\"\n                );\n                settings = settings.set_no_tls_verify(true);\n            }\n        }\n\n        let (conn, ldap) = LdapConnAsync::with_settings(settings, &config.server)\n            .await\n            .map_err(|err| {\n                PsqlError::StartupError(\n                    anyhow!(err)\n                        .context(\"Failed to connect to LDAP server\")\n                        .into(),\n                )\n            })?;\n        ldap3::drive!(conn);\n\n        Ok(ldap)\n    }\n\n    /// Search for user in LDAP directory and then bind\n    async fn search_and_bind(&self, username: &str, password: &str) -> PsqlResult<bool> {\n        // Establish connection to LDAP server\n        let mut ldap = self.establish_connection().await?;\n\n        // Validate base_dn configuration\n        let base_dn = self\n            .config\n            .base_dn","sourceCodeStart":440,"sourceCodeEnd":476,"githubUrl":"https://github.com/risingwavelabs/risingwave/blob/6469eb736d691e8e9b8a419a57edd6429ca77417/src/utils/pgwire/src/ldap_auth.rs#L440-L476","documentation":"establish_connection calls LdapConnAsync::with_settings to open a TCP/TLS connection to the LDAP server. Any connection-level failure — DNS resolution, TCP refused, TLS handshake rejection, timeout — is wrapped as this StartupError before any bind attempt. The library cannot proceed without an LDAP session.","triggerScenarios":"LdapConnAsync::with_settings(settings, &config.server) awaits to Err: unreachable host, closed port, TLS cert rejected (ldaps), connection timeout","commonSituations":"LDAP server down or wrong host/port in ldap_url; firewall or security group blocks 389/636; ldaps:// used but server certificate is self-signed/untrusted; DNS not resolvable from inside the container/k8s pod; LDAP service in a different VPC.","solutions":["Test reachability: nc -zv <host> <port> or openssl s_client -connect host:636","Fix host/port in the ldap_url config (default port 389 for ldap://, 636 for ldaps://)","If using ldaps with a self-signed cert, add the CA to the trust store or configure the danger-accept-invalid-certs setting appropriately for your security posture","Check network/firewall/DNS from the machine running RisingWave (container networking often differs from the host)"],"exampleFix":"// before (unreachable from pod)\nldap_url = 'ldaps://10.0.0.5:636'\n// after (internal DNS name reachable from k8s)\nldap_url = 'ldaps://ldap.internal.svc.cluster.local:636'","handlingStrategy":"retry","validationCode":"// pre-check before creating the LDAP connection\n# nc -zv ldap.corp.local 636 || echo 'LDAP port unreachable'\n# openssl s_client -connect ldap.corp.local:636 -brief </dev/null","typeGuard":null,"tryCatchPattern":"catch PsqlError::StartupError with context 'Failed to connect to LDAP server', inspect the source io/rustls error; retry with exponential backoff only for transient categories (timeout, connection reset), fail fast on refusal/TLS-trust errors","preventionTips":["Add the LDAP host/port to deployment smoke tests and readiness checks","Prefer ldaps:// with the server CA installed in the trust store","Use stable internal DNS names, not raw IPs, in containerized deployments","Monitor LDAP server availability; alert before it blocks logins"],"tags":["ldap","network","tls","connection","startup"],"backgroundTag":"connection-refused","analyzedSha":"6469eb736d691e8e9b8a419a57edd6429ca77417","analyzedAt":"2026-09-11T21:06:21.487Z","contentChangedAt":"2026-09-11T21:06:21.487Z","schemaVersion":2},"datasetVersion":"2026-09-14T21:17:11.552Z"}