Augmentation with Ldap Issue about ldapcp

[Yvand]

Hello,
when you leave the LDAPCP admin page and return to it, can you confirm that the check box "This is an Active Directory server, use UserPrincipal.GetAuthorizationGroups" remains unchecked?
Did you try to refresh the non-interactive token in a new PowerShell process, that you start after you changed the setting?

[Bastien-RB]

Yes the box is unchecked after come back
the lifetime is 1 minute

[Bastien-RB]

I cleared the sharepoint cache on the Front end (C:\ProgramData\Microsoft\SharePoint\Config) And Its resolved the problem thanks for you help

[Yvand]

Sure, thanks ! :)

[sergey-tihon]

One important NOTE for everyone who troubleshoot augmentation.

Important note

Following LDAP server connection is incorrect (even if Test LDAP connection works)

you should use distinguished name of LDAP server

What's going on

0x80005000 means An invalid ADSI pathname was passed. (Verify that the object exists on the directory server and check for typographic errors of the path.)

If you take a look at the code

LDAPCP/LDAPCP/LDAPCPConfig.cs

Lines 950 to 969 in 985b207

	public static void GetDomainInformation(string distinguishedName, out string domainName, out string domainFQDN)
	{
	// Retrieve FQDN and domain name of current DirectoryEntry
	domainName = domainFQDN = String.Empty;
	if (distinguishedName.Contains("DC="))
	{
	int start = distinguishedName.IndexOf("DC=", StringComparison.InvariantCultureIgnoreCase);
	string[] dnSplitted = distinguishedName.Substring(start).Split(new string[] { "DC=" }, StringSplitOptions.RemoveEmptyEntries);
	bool setDomainName = true;
	foreach (string dc in dnSplitted)
	{
	domainFQDN += dc.Replace(',', '.');
	if (setDomainName)
	{
	domainName = dc.Trim(new char[] { ',' });
	setDomainName = false;
	}
	}
	}
	}

you will see that LDAPCP build domainFQDN using DCs, if they omitted domainFQDN will be equal to String.Empty and when you turn on This is an Active Directory server, use UserPrincipal.GetAuthorizationGroups on this LDAP Server you will see following error in logs

[LDAPCP] Unexpected error occurred while getting AD groups of user [email protected] in LDAP://my.domain.com using UserPrincipal.GetAuthorizationGroups(): System.Runtime.InteropServices.COMException: Unknown error (0x80005000), Callstack:   
 at System.DirectoryServices.DirectoryEntry.Bind(Boolean throwIfFail)    
 at System.DirectoryServices.DirectoryEntry.Bind()    
 at System.DirectoryServices.DirectoryEntry.get_AdsObject()    
 at System.DirectoryServices.PropertyValueCollection.PopulateList()    
 at System.DirectoryServices.PropertyValueCollection..ctor(DirectoryEntry entry, String propertyName)    
 at System.DirectoryServices.PropertyCollection.get_Item(String propertyName)    
 at System.DirectoryServices.AccountManagement.PrincipalContext.DoLDAPDirectoryInitNoContainer()    
 at System.DirectoryServices.AccountManagement.PrincipalContext.DoDomainInit()    
 at System.DirectoryServices.AccountManagement.PrincipalContext.Initialize()    
 at System.DirectoryServices.AccountManagement.PrincipalContext.get_QueryCtx()    
 at System.DirectoryServices.AccountManagement.Principal.FindByIdentityWithTypeHelper(PrincipalContext context, Type principalType, Nullable`1 identityType, String identityValue, DateTime refDate)    
 at System.DirectoryServices.AccountManagement.Principal.FindByIdentityWithType(PrincipalContext context, Type principalType, String identityValue)    
 at System.DirectoryServices.AccountManagement.UserPrincipal.FindByIdentity(PrincipalContext context, String identityValue)    
 at ldapcp.LDAPCP.GetGroupsFromActiveDirectory(LDAPConnection ldapConnection, OperationContext currentContext, ClaimTypeConfig groupCTConfig)

@Yvand do not you mind to mention it in docs? or even better, improve Test LDAP connection validation?