{"record":{"id":"5195f8386fb4f10d","repo":"juicedata/juicefs","slug":"ldap-bind-sw-failed-d","errorCode":null,"errorMessage":"ldap_bind_sW failed: %d","messagePattern":"ldap_bind_sW failed: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/win/ldap.go","lineNumber":74,"sourceCode":"func LdapConnect(host string) (uintptr, error) {\n\thostPtr, err := windows.UTF16PtrFromString(host)\n\tif err != nil {\n\t\treturn 0, err\n\t}\n\thandle, _, _ := procLdapInitW.Call(\n\t\tuintptr(unsafe.Pointer(hostPtr)),\n\t\tuintptr(LDAP_PORT),\n\t)\n\tif handle == 0 {\n\t\treturn 0, fmt.Errorf(\"ldap_initW failed\")\n\t}\n\tprocLdapSetOptionW.Call(handle, uintptr(LDAP_OPT_SIGN), uintptr(LDAP_OPT_ON))\n\tprocLdapSetOptionW.Call(handle, uintptr(LDAP_OPT_ENCRYPT), uintptr(LDAP_OPT_ON))\n\n\tr1, _, _ := procLdapBindSW.Call(handle, 0, 0, uintptr(LDAP_AUTH_NEGOTIATE))\n\tif int32(r1) != LDAP_SUCCESS {\n\t\tprocLdapUnbind.Call(handle)\n\t\treturn 0, fmt.Errorf(\"ldap_bind_sW failed: %d\", r1)\n\t}\n\treturn handle, nil\n}\n\nfunc LdapClose(handle uintptr) {\n\tprocLdapUnbind.Call(handle)\n}\n\nfunc LdapGetValue(\n\thandle uintptr,\n\tbase string,\n\tscope uint32,\n\tfilter string,\n\tattribute string,\n) (string, error) {\n\tvar basePtr *uint16\n\tif base != \"\" {\n\t\tp, err := windows.UTF16PtrFromString(base)","sourceCodeStart":56,"sourceCodeEnd":92,"githubUrl":"https://github.com/juicedata/juicefs/blob/c9a67b23e8e08ec23ec331aa6f1675e2319e921c/pkg/win/ldap.go#L56-L92","documentation":"After ldap_initW succeeds, LdapConnect enables signing/encryption options and performs an anonymous Negotiate bind via ldap_bind_sW. If the bind result is not LDAP_SUCCESS, the handle is unbound and \"ldap_bind_sW failed: %d\" is returned with the LDAP status code. The numeric code identifies the exact bind failure (e.g. 49 invalid credentials, 81 server down).","triggerScenarios":"ldap_bind_sW returns a non-zero LDAP result: DC rejects the Negotiate authentication, machine account issues, TLS/signing requirements unmet, or the DC became unreachable between init and bind.","commonSituations":"Running on a non-domain-joined machine where Negotiate falls back to anonymous and the DC refuses; expired machine account password; DC requiring LDAP signing the client can't provide; clock skew breaking Kerberos.","solutions":["Look up the returned LDAP code (e.g. 49=invalid credentials, 81=server down) and address it specifically.","Confirm the machine is domain-joined and its secure channel is healthy (Test-ComputerSecureChannel).","Ensure the LDAP signing/encryption requirements of the DC match the client options set in LdapConnect.","Check system time skew against the domain controller."],"exampleFix":"// diagnostic: capture the code\nif int32(r1) != LDAP_SUCCESS {\n    return 0, fmt.Errorf(\"ldap_bind_sW failed: %d\", r1) // 49 -> fix creds; 81 -> network\n}","handlingStrategy":"retry","validationCode":"// pre-check machine secure channel (PowerShell): Test-ComputerSecureChannel\n// pre-check time skew: w32tm /stripchart /computer:dc.domain.local","typeGuard":null,"tryCatchPattern":"var handle uintptr\nvar err error\nfor i := 0; i < 3; i++ {\n    handle, err = LdapConnect(\"\")\n    if err == nil { break }\n    time.Sleep(time.Duration(i+1) * time.Second)\n}","preventionTips":["Keep machine account passwords and Kerberos time sync healthy.","Match client LDAP signing/encryption settings to DC policy.","Retry transient codes (81 server down, 85 timeout) with backoff.","Run on domain-joined machines when Negotiate auth is required."],"tags":["windows","ldap","active-directory","authentication"],"backgroundTag":"authentication-required","analyzedSha":"c9a67b23e8e08ec23ec331aa6f1675e2319e921c","analyzedAt":"2026-09-06T17:55:48.476Z","contentChangedAt":"2026-09-06T17:55:48.476Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}