juicedata/juicefs · error
ldap_initW failed
Error message
ldap_initW failed
What it means
LdapConnect in pkg/win/ldap.go loads wldap32 dynamically and calls ldap_initW to create an LDAP session handle for the given host on the LDAP port. If the returned handle is 0, session initialization failed and the function returns "ldap_initW failed". On Windows this typically means the host could not be resolved or wldap32 could not set up the session.
Source
Thrown at pkg/win/ldap.go:66
LDAP_OPT_SIGN = 0x95
LDAP_OPT_ENCRYPT = 0x96
LDAP_OPT_ON = 1
LDAP_SCOPE_BASE = 0x00
LDAP_SCOPE_ONELEVEL = 0x01
LDAP_AUTH_NEGOTIATE = 0x0486 // LDAP_AUTH_OTHERKIND (0x86) | 0x0400
)
func LdapConnect(host string) (uintptr, error) {
hostPtr, err := windows.UTF16PtrFromString(host)
if err != nil {
return 0, err
}
handle, _, _ := procLdapInitW.Call(
uintptr(unsafe.Pointer(hostPtr)),
uintptr(LDAP_PORT),
)
if handle == 0 {
return 0, fmt.Errorf("ldap_initW failed")
}
procLdapSetOptionW.Call(handle, uintptr(LDAP_OPT_SIGN), uintptr(LDAP_OPT_ON))
procLdapSetOptionW.Call(handle, uintptr(LDAP_OPT_ENCRYPT), uintptr(LDAP_OPT_ON))
r1, _, _ := procLdapBindSW.Call(handle, 0, 0, uintptr(LDAP_AUTH_NEGOTIATE))
if int32(r1) != LDAP_SUCCESS {
procLdapUnbind.Call(handle)
return 0, fmt.Errorf("ldap_bind_sW failed: %d", r1)
}
return handle, nil
}
func LdapClose(handle uintptr) {
procLdapUnbind.Call(handle)
}
func LdapGetValue(
handle uintptr,View on GitHub (pinned to c9a67b23e8)
Solutions
- Verify the machine can resolve and reach a domain controller (nslookup the AD host, test TCP 389/636).
- Pass an explicit, correct LDAP hostname instead of "".
- Ensure the host is domain-joined and wldap32.dll is available.
- Check firewall rules allow LDAP to the DC.
Example fix
// before
handle, err := LdapConnect("")
// after
dc, err := net.LookupSRV("", "_ldap._tcp", domain)
if err != nil {
return fmt.Errorf("no DC reachable: %w", err)
}
handle, err := LdapConnect(dc) Defensive patterns
Strategy: validation
Validate before calling
func canReachDC(host string) error {
conn, err := net.DialTimeout("tcp", net.JoinHostPort(host, "389"), 3*time.Second)
if err != nil { return err }
conn.Close()
return nil
}
if err := canReachDC(dcHost); err != nil { /* skip LDAP path */ } Type guard
func ldapHandleValid(h uintptr) bool { return h != 0 } Try / catch
handle, err := LdapConnect("")
if err != nil {
log.Printf("LDAP unavailable, skipping posix offsets: %v", err)
return
} Prevention
- Verify domain join and DC reachability before enabling AD-dependent features.
- Resolve the DC via SRV records (_ldap._tcp) instead of an empty host.
- Ensure LDAP ports are open in host/firewall rules.
- Avoid hard LDAP dependencies during early boot before networking is up.
When it happens
Trigger: Calling LdapConnect(host) where host is empty/unresolvable, the domain controller is unreachable, or ldap_initW returns a NULL LDAP* handle. Called from initializeTrustPosixOffsets with "" (default server).
Common situations: Running JuiceFS Windows integration on a machine not domain-joined or without reachable DC; DNS problems resolving the AD host; typo'd or empty hostname; LDAP port blocked by firewall.
Understand the failure class
Background: ECONNREFUSED and "connection refused" / "could not connect to server" errors: what they mean and how to fix them — this error's family across 44 libraries.
Related errors
- LdapConnect failed: %w
- ldap_bind_sW failed: %d
- ldap_search_sW failed: %d
- no entries found
- no attribute values
AI-assisted analysis of juicedata/juicefs@c9a67b23e8 (2026-09-06).
Data as JSON: /api/errors/9bada94f8c498c87.
Report an issue: GitHub.