{"record":{"id":"9bada94f8c498c87","repo":"juicedata/juicefs","slug":"ldap-initw-failed","errorCode":null,"errorMessage":"ldap_initW failed","messagePattern":"ldap_initW failed","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/win/ldap.go","lineNumber":66,"sourceCode":"\tLDAP_OPT_SIGN       = 0x95\n\tLDAP_OPT_ENCRYPT    = 0x96\n\tLDAP_OPT_ON         = 1\n\tLDAP_SCOPE_BASE     = 0x00\n\tLDAP_SCOPE_ONELEVEL = 0x01\n\tLDAP_AUTH_NEGOTIATE = 0x0486 // LDAP_AUTH_OTHERKIND (0x86) | 0x0400\n)\n\nfunc LdapConnect(host string) (uintptr, error) {\n\thostPtr, err := windows.UTF16PtrFromString(host)\n\tif err != nil {\n\t\treturn 0, err\n\t}\n\thandle, _, _ := procLdapInitW.Call(\n\t\tuintptr(unsafe.Pointer(hostPtr)),\n\t\tuintptr(LDAP_PORT),\n\t)\n\tif handle == 0 {\n\t\treturn 0, fmt.Errorf(\"ldap_initW failed\")\n\t}\n\tprocLdapSetOptionW.Call(handle, uintptr(LDAP_OPT_SIGN), uintptr(LDAP_OPT_ON))\n\tprocLdapSetOptionW.Call(handle, uintptr(LDAP_OPT_ENCRYPT), uintptr(LDAP_OPT_ON))\n\n\tr1, _, _ := procLdapBindSW.Call(handle, 0, 0, uintptr(LDAP_AUTH_NEGOTIATE))\n\tif int32(r1) != LDAP_SUCCESS {\n\t\tprocLdapUnbind.Call(handle)\n\t\treturn 0, fmt.Errorf(\"ldap_bind_sW failed: %d\", r1)\n\t}\n\treturn handle, nil\n}\n\nfunc LdapClose(handle uintptr) {\n\tprocLdapUnbind.Call(handle)\n}\n\nfunc LdapGetValue(\n\thandle uintptr,","sourceCodeStart":48,"sourceCodeEnd":84,"githubUrl":"https://github.com/juicedata/juicefs/blob/c9a67b23e8e08ec23ec331aa6f1675e2319e921c/pkg/win/ldap.go#L48-L84","documentation":"LdapConnect in pkg/win/ldap.go loads wldap32 dynamically and calls ldap_initW to create an LDAP session handle for the given host on the LDAP port. If the returned handle is 0, session initialization failed and the function returns \"ldap_initW failed\". On Windows this typically means the host could not be resolved or wldap32 could not set up the session.","triggerScenarios":"Calling LdapConnect(host) where host is empty/unresolvable, the domain controller is unreachable, or ldap_initW returns a NULL LDAP* handle. Called from initializeTrustPosixOffsets with \"\" (default server).","commonSituations":"Running JuiceFS Windows integration on a machine not domain-joined or without reachable DC; DNS problems resolving the AD host; typo'd or empty hostname; LDAP port blocked by firewall.","solutions":["Verify the machine can resolve and reach a domain controller (nslookup the AD host, test TCP 389/636).","Pass an explicit, correct LDAP hostname instead of \"\".","Ensure the host is domain-joined and wldap32.dll is available.","Check firewall rules allow LDAP to the DC."],"exampleFix":"// before\nhandle, err := LdapConnect(\"\")\n// after\ndc, err := net.LookupSRV(\"\", \"_ldap._tcp\", domain)\nif err != nil {\n    return fmt.Errorf(\"no DC reachable: %w\", err)\n}\nhandle, err := LdapConnect(dc)","handlingStrategy":"validation","validationCode":"func canReachDC(host string) error {\n    conn, err := net.DialTimeout(\"tcp\", net.JoinHostPort(host, \"389\"), 3*time.Second)\n    if err != nil { return err }\n    conn.Close()\n    return nil\n}\nif err := canReachDC(dcHost); err != nil { /* skip LDAP path */ }","typeGuard":"func ldapHandleValid(h uintptr) bool { return h != 0 }","tryCatchPattern":"handle, err := LdapConnect(\"\")\nif err != nil {\n    log.Printf(\"LDAP unavailable, skipping posix offsets: %v\", err)\n    return\n}","preventionTips":["Verify domain join and DC reachability before enabling AD-dependent features.","Resolve the DC via SRV records (_ldap._tcp) instead of an empty host.","Ensure LDAP ports are open in host/firewall rules.","Avoid hard LDAP dependencies during early boot before networking is up."],"tags":["windows","ldap","active-directory","network"],"backgroundTag":"connection-refused","analyzedSha":"c9a67b23e8e08ec23ec331aa6f1675e2319e921c","analyzedAt":"2026-09-06T17:55:48.476Z","contentChangedAt":"2026-09-06T17:55:48.476Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}