{"record":{"id":"624b980fa10b8745","repo":"wekan/wekan","slug":"error-name-error-message","errorCode":null,"errorMessage":"${error.name || error.message}","messagePattern":"\\$\\{error\\.name \\|\\| error\\.message\\}","errorType":"error_code","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"packages/wekan-ldap/server/testConnection.js","lineNumber":40,"sourceCode":"      ldap = new LDAP();\n      await ldap.connect();\n    } catch (error) {\n      console.log(error);\n      // #6467/#6469: release anything opened before rethrowing, so a failed\n      // \"Test Connection\" does not leak a socket to the directory server.\n      if (ldap) {\n        await ldap.disconnect();\n      }\n      throw new Meteor.Error(error.message);\n    }\n\n    // #6467/#6469: always disconnect the test connection (success or failure),\n    // otherwise repeated admin \"Test Connection\" clicks leak connections too.\n    return await runWithLdapDisconnect(ldap, async () => {\n      try {\n        await ldap.bindIfNecessary();\n      } catch (error) {\n        throw new Meteor.Error(error.name || error.message);\n      }\n\n      return {\n        message: 'Connection_success',\n        params: [],\n      };\n    });\n  },\n});\n","sourceCodeStart":22,"sourceCodeEnd":50,"githubUrl":"https://github.com/wekan/wekan/blob/eb1433158b1804bcf3edaa5cb18f08ae2e04d6c2/packages/wekan-ldap/server/testConnection.js#L22-L50","documentation":"After connecting successfully, the bind step (bindIfNecessary) runs inside runWithLdapDisconnect; if the bind rejects, the error is rethrown as new Meteor.Error(error.name || error.message). This surfaces directory-level bind errors — typically LDAPInvalidCredentials (error.name 49/invalidCredentials) or client-timeout names — to the admin as the Test Connection failure reason.","triggerScenarios":"Meteor.call('ldap_test_connection') where the service bind fails: wrong LDAP_BIND_DN / LDAP_BIND_PASS, anonymous bind disallowed by the directory, expired/locked bind account, or the bind client timing out.","commonSituations":"Rotated service-account password not updated in WeKan; bind DN malformed (missing full DN, using UPN where DN required); password containing special characters mishandled; directory policy forbidding anonymous binds when no bind credentials configured.","solutions":["Verify the bind credentials out-of-band: ldapsearch -H <url> -D <LDAP_BIND_DN> -w <LDAP_BIND_PASS> -b '' -s base.","Use the full distinguished name for the bind user (e.g. cn=svc-wekan,ou=svc,dc=example,dc=com).","Check the bind account is not expired/locked and its password matches the WeKan LDAP_BIND_PASS setting exactly.","If no bind user is intended, confirm the directory permits anonymous search binds.","Fix the setting and re-run Test Connection; the disconnect guard ensures no socket leaks between attempts."],"exampleFix":"// before\nLDAP_BIND_DN = 'svc-wekan'                 // not a DN -> invalidCredentials\nLDAP_BIND_PASS = 'old-password'\n// after\nLDAP_BIND_DN = 'cn=svc-wekan,ou=services,dc=example,dc=com'\nLDAP_BIND_PASS = 'current-password'","handlingStrategy":"try-catch","validationCode":"// verify bind credentials out-of-band before clicking Test Connection\n// ldapsearch -H ldaps://host:636 -D \"$BIND_DN\" -w \"$BIND_PASS\" -b '' -s base\n// non-zero exit means the credentials/DN are wrong regardless of WeKan settings","typeGuard":"const isBindError = (e) =>\n  /invalid credentials|invalidCredential|ldap.*49|LDAPInvalidCredentials/i.test(e?.name || e?.reason || '');","tryCatchPattern":"try {\n  const r = await Meteor.callAsync('ldap_test_connection');\n} catch (e) {\n  // e.error carries error.name, e.reason the message from bindIfNecessary\n  if (isBindError(e)) {\n    showError('Bind rejected by the directory: check LDAP_BIND_DN and LDAP_BIND_PASS.');\n  }\n}","preventionTips":["Store the bind user as a full DN, not a short account name or UPN","Update WeKan's LDAP_BIND_PASS whenever the service-account password rotates","Test bind credentials with ldapsearch before configuring WeKan","Confirm the directory allows the intended bind (anonymous or authenticated)","Verify the bind account is not expired or locked out by password policy"],"tags":["ldap","bind","credentials","meteor"],"backgroundTag":"ldap-bind-failed","analyzedSha":"eb1433158b1804bcf3edaa5cb18f08ae2e04d6c2","analyzedAt":"2026-09-01T21:05:02.951Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T01:17:15.007Z"}