juicedata/juicefs · error

LdapGetDefaultNamingContext failed: %w

Error message

LdapGetDefaultNamingContext failed: %w

What it means

During package initialization, initializeTrustPosixOffsets connects to the Active Directory LDAP server and asks it for the default naming context (the forest root DN). If the LdapGetDefaultNamingContext call fails, the error is wrapped with %w and returned, aborting the POSIX offset initialization that maps trusted domains to UID/GID ranges. This means Windows SID-to-UID translation cannot be seeded from AD.

Source

Thrown at pkg/win/sid.go:185

		if sid1.SubAuthority(uint32(i)) != sid2.SubAuthority(uint32(i)) {
			return false
		}
	}

	return true
}

// initializeTrustPosixOffsets queries LDAP and sets TrustPosixOffset for each trusted domain.
func initializeTrustPosixOffsets() error {
	handle, err := LdapConnect("") // empty string means default server
	if err != nil {
		return fmt.Errorf("LdapConnect failed: %w", err)
	}
	defer LdapClose(handle)

	defaultNC, err := LdapGetDefaultNamingContext(handle)
	if err != nil {
		return fmt.Errorf("LdapGetDefaultNamingContext failed: %w", err)
	}

	// For each trusted domain, get trustPosixOffset
	for i := range trustedDomains {
		domain := windows.UTF16PtrToString(trustedDomains[i].DnsDomainName)
		offsetStr, err := LdapGetTrustPosixOffset(handle, defaultNC, domain)
		if err == nil {
			if val, err := strconv.ParseUint(offsetStr, 10, 32); err == nil {
				trustedDomains[i].TrustPosixOffset = uint32(val)
			}
		}
	}

	// If trustPosixOffset looks wrong, fix it up using Cygwin magic value 0xfe500000
	for i := range trustedDomains {
		if trustedDomains[i].TrustPosixOffset < 0x100000 {
			trustedDomains[i].TrustPosixOffset = 0xfe500000
		}

View on GitHub (pinned to c9a67b23e8)

Solutions

1. Verify the machine is domain-joined and can reach its AD domain controller: nltest /dsgetdc:<domain> and test LDAP port connectivity.
2. Check that the account the process runs under is allowed to read RootDSE/defaultNamingContext.
3. If LDAP is over TLS, confirm the DC certificate is valid and the LDAPS port (636) is open.
4. Inspect the wrapped underlying error (%w) with errors.Unwrap to see the specific LDAP status code and address it.
5. If trust-POSIX-offset lookup is not needed in your environment, avoid initializing that path or supply id mappings locally.

// Go: before relying on SID<->UID mapping, verify LDAP reachability
conn, err := net.DialTimeout("tcp", "dc.example.com:389", 3*time.Second)
if err != nil {
    return fmt.Errorf("LDAP DC unreachable: %w", err)
}
conn.Close()

if err != nil {
    var lerr *ldap.Error
    if errors.As(err, &lerr) {
        log.Printf("LDAP result code %d: %v", lerr.ResultCode, lerr)
    }
    return fmt.Errorf("posix offsets unavailable: %w", err)
}

When it happens

Trigger: The package-level init() in pkg/win/sid.go runs initializeTrustPosixOffsets on every process start; it fails when LdapGetDefaultNamingContext(handle) returns a non-nil error (LDAP bind succeeded via LdapConnect but the base-DN query failed, e.g. server refused the search or returned an LDAP error).

Common situations: Running a JuiceFS Windows client against an AD domain controller that is unreachable or misconfigured; the machine is not domain-joined; LDAP over the chosen port (389/636) is blocked by firewall; the DC rejects anonymous or machine-account searches for the RootDSE defaultNamingContext.

Related errors

• LdapConnect failed: %w
• ldap_initW failed
• ldap_bind_sW failed: %d
• ldap_search_sW failed: %d
• no entries found

AI-assisted analysis of juicedata/juicefs@c9a67b23e8 (2026-09-06). Data as JSON: /api/errors/34dbe6c536524261. Report an issue: GitHub.