bytebase/bytebase · error
dial: %v
Error message
dial: %v
What it means
dial, in START_TLS mode, first opens a plain LDAP connection with ldap.DialURL; if the initial TCP connection fails, the error is wrapped as 'dial: %v'. This is a network-level failure before any TLS upgrade is attempted.
Source
Thrown at backend/plugin/idp/ldap/ldap.go:104
func (p *IdentityProvider) dial() (*ldap.Conn, error) {
tlsConfig := &tls.Config{
ServerName: p.config.Host,
InsecureSkipVerify: p.config.SkipTLSVerify,
}
switch p.config.SecurityProtocol {
case storepb.LDAPIdentityProviderConfig_LDAPS:
url := fmt.Sprintf("ldaps://%s:%d", p.config.Host, p.config.Port)
conn, err := ldap.DialURL(url, ldap.DialWithTLSConfig(tlsConfig))
if err != nil {
return nil, errors.Errorf("dial TLS: %v", err)
}
return conn, nil
case storepb.LDAPIdentityProviderConfig_START_TLS:
url := fmt.Sprintf("ldap://%s:%d", p.config.Host, p.config.Port)
conn, err := ldap.DialURL(url)
if err != nil {
return nil, errors.Errorf("dial: %v", err)
}
if err := conn.StartTLS(tlsConfig); err != nil {
_ = conn.Close()
return nil, errors.Errorf("start TLS: %v", err)
}
return conn, nil
default:
url := fmt.Sprintf("ldap://%s:%d", p.config.Host, p.config.Port)
conn, err := ldap.DialURL(url)
if err != nil {
return nil, errors.Errorf("dial: %v", err)
}
return conn, nil
}
}
// Connect establishes a connection using the bind DN and bind password.
func (p *IdentityProvider) Connect() (*ldap.Conn, error) {View on GitHub (pinned to 1870550677)
Solutions
- Check network reachability: ping/nc the configured host and port.
- Fix the Host/Port values in the identity provider config (default 389 for StartTLS).
- Verify DNS resolution for the configured hostname.
- Ensure the LDAP service (slapd/AD) is running and listening.
- Check firewalls/security groups between Bytebase and the directory server.
Example fix
// before config.Host = "ldap-internal" // not resolvable // after config.Host = "ldap-internal.corp.example.com" config.Port = 389
Defensive patterns
Strategy: retry
Validate before calling
func ldapReachable(host string, port int) error {
conn, err := net.DialTimeout("tcp", fmt.Sprintf("%s:%d", host, port), 5*time.Second)
if err != nil { return err }
return conn.Close()
}
// run before Connect to fail fast on network issues Try / catch
conn, err := p.dial()
if err != nil {
if strings.Contains(err.Error(), "dial:") {
return nil, fmt.Errorf("cannot reach LDAP at %s:%d: %w", p.config.Host, p.config.Port, err)
}
return nil, err
}
defer conn.Close() Prevention
- Resolve and ping the LDAP hostname before configuring it.
- Use a short dial timeout so failures surface quickly.
- Retry with backoff for transient network blips.
- Confirm firewall rules allow egress to port 389/636.
When it happens
Trigger: Calling Connect with SecurityProtocol START_TLS when the LDAP host is unreachable: DNS resolution failure, wrong host/port, service down, or firewall dropping the connection to port 389.
Common situations: Typo in the LDAP hostname; LDAP service stopped; container/network isolation blocking egress; port left at a default that the server does not listen on.
Understand the failure class
Background: ECONNREFUSED and "connection refused" / "could not connect to server" errors: what they mean and how to fix them — this error's family across 44 libraries.
Related errors
- dial TLS: %v
- connect: %v
- failed to ping hive server
- failed to connect to SMTP server %s
- empty response from AI
AI-assisted analysis of bytebase/bytebase@1870550677 (2026-09-06).
Data as JSON: /api/errors/48f14f1c04386544.
Report an issue: GitHub.