LDAP authentication fails when using domain name

[melpheos]

Hi everyone,

after one of our AD failed yesterday we tried to change the LDAP authentication of zabbix by putting the domain name instead of the AD itself so that in case of failure, the authentication switches to another of our AD.

However it doesnt seems to work despite zabbix being able to ping the domain name (it resolves to the first available AD)

The error is
ldap_bind(): Unable to bind to server: Can't contact LDAP server [include/classes/class.cldap.php:115]

When using the ip or the servername it works fine but not with the domain name.
Is this supported ?
Anyone has a patch for this ?

Thanks in advance for any help

[melpheos]

No ideas ? Anyone ?

[Zaniwoop]

Unless you have DCPROMOed the dead domain controller out of the domain, it's IP address will still be listed as an active server.

When your LDAP query tries to resolve the domain name, it could return the dead server's IP address, in which case it wont work.

[melpheos]

Unless you have DCPROMOed the dead domain controller out of the domain, it's IP address will still be listed as an active server.

When your LDAP query tries to resolve the domain name, it could return the dead server's IP address, in which case it wont work.

Sorry should have mentionned that the failed AD just had to be restarted.
In any case, if the AD is failed the DNS should return the IP of a running AD and not a failed one (otherwise there is no point running several AD for failover purpose)

So currently we have this error with every AD up and running

[Zaniwoop]

You would have to use the fully qualified domain name.

[melpheos]

You would have to use the fully qualified domain name.

Tried that already of course.
Short domain name of FQDN gives the same error.

I'd like to have a feed back from devs to check if it's supported or not.
Haven't seen anyone talking about this issue

[acropia]

I also have LDAP Authentication with Active Directory configured. For the same situation I created an A record myself with servers I want to use for third party authentication (like Zabbix).

That DNS name I used under Authentication / LDAP / LDAP Host:

ldap://ldap.domain.tld

[melpheos]

I also have LDAP Authentication with Active Directory configured. For the same situation I created an A record myself with servers I want to use for third party authentication (like Zabbix).

That DNS name I used under Authentication / LDAP / LDAP Host:

ldap://ldap.domain.tld

I will check that idea but if it works for you it should work for me