{"record":{"id":"99277bd613f875cc","repo":"juicedata/juicefs","slug":"ldapconnect-failed-w","errorCode":null,"errorMessage":"LdapConnect failed: %w","messagePattern":"LdapConnect failed: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/win/sid.go","lineNumber":179,"sourceCode":"\tcnt2 := sid2.SubAuthorityCount()\n\tif cnt1+1 != cnt2 {\n\t\treturn false\n\t}\n\n\tfor i := uint8(0); i < cnt1; i++ {\n\t\tif sid1.SubAuthority(uint32(i)) != sid2.SubAuthority(uint32(i)) {\n\t\t\treturn false\n\t\t}\n\t}\n\n\treturn true\n}\n\n// initializeTrustPosixOffsets queries LDAP and sets TrustPosixOffset for each trusted domain.\nfunc initializeTrustPosixOffsets() error {\n\thandle, err := LdapConnect(\"\") // empty string means default server\n\tif err != nil {\n\t\treturn fmt.Errorf(\"LdapConnect failed: %w\", err)\n\t}\n\tdefer LdapClose(handle)\n\n\tdefaultNC, err := LdapGetDefaultNamingContext(handle)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"LdapGetDefaultNamingContext failed: %w\", err)\n\t}\n\n\t// For each trusted domain, get trustPosixOffset\n\tfor i := range trustedDomains {\n\t\tdomain := windows.UTF16PtrToString(trustedDomains[i].DnsDomainName)\n\t\toffsetStr, err := LdapGetTrustPosixOffset(handle, defaultNC, domain)\n\t\tif err == nil {\n\t\t\tif val, err := strconv.ParseUint(offsetStr, 10, 32); err == nil {\n\t\t\t\ttrustedDomains[i].TrustPosixOffset = uint32(val)\n\t\t\t}\n\t\t}\n\t}","sourceCodeStart":161,"sourceCodeEnd":197,"githubUrl":"https://github.com/juicedata/juicefs/blob/c9a67b23e8e08ec23ec331aa6f1675e2319e921c/pkg/win/sid.go#L161-L197","documentation":"initializeTrustPosixOffsets (run at package init) opens an LDAP session with LdapConnect(\"\") to enumerate trusted domains and their POSIX offsets. If the connection cannot be established, it wraps the failure as \"LdapConnect failed: %w\". Because this runs during init on Windows, a failure here can abort startup of the SID/POSIX mapping machinery.","triggerScenarios":"Package init calls initializeTrustPosixOffsets on a machine where LdapConnect fails — no reachable DC, non-domain-joined host, DNS failure, or blocked LDAP port.","commonSituations":"Deploying on workgroup machines or VMs without line-of-sight to a domain controller; laptops off the corporate network/VPN; firewalls blocking port 389; running before network is up during early boot.","solutions":["Make init tolerant: log the wrapped error and defer/omit TrustPosixOffset mapping instead of failing startup.","Ensure the host is domain-joined and a DC is reachable (nltest /dsgetdc:, nslookup SRV _ldap._tcp).","Run the process after network initialization; avoid eager LDAP at package init.","Open firewall paths to the DC for LDAP (389/636) or connect over VPN.","Provide an explicit DC hostname to LdapConnect instead of relying on the default server."],"exampleFix":"// before\nfunc init() {\n    if err := initializeTrustPosixOffsets(); err != nil {\n        panic(err) // or log.Fatal\n    }\n}\n// after\nfunc init() {\n    if err := initializeTrustPosixOffsets(); err != nil {\n        log.Printf(\"trust posix offsets unavailable: %v\", err) // degrade gracefully\n    }\n}","handlingStrategy":"try-catch","validationCode":"// before enabling the feature, check:\n// nltest /dsgetdc:domain.local  AND  Test-ComputerSecureChannel","typeGuard":null,"tryCatchPattern":"if err := initializeTrustPosixOffsets(); err != nil {\n    log.Printf(\"trust posix offsets disabled: %v\", err) // don't fail init\n}","preventionTips":["Avoid fatal LDAP errors in package init; degrade gracefully instead.","Guard AD-dependent initialization behind a reachability probe.","Document domain-join and DC-connectivity prerequisites for Windows deployments.","Support an explicit DC address config to bypass default discovery."],"tags":["windows","ldap","active-directory","startup","network"],"backgroundTag":"connection-refused","analyzedSha":"c9a67b23e8e08ec23ec331aa6f1675e2319e921c","analyzedAt":"2026-09-06T17:55:48.476Z","contentChangedAt":"2026-09-06T17:55:48.476Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}