nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

No LDAP connection (host unreachable) after DC was shutdown

Annette Ruster

Hi all

We had a Domain Controller.

Jira LDAP connection worked just fine (no SSL).

Then we added a second Domain Controller (isGC=true) and turned off the first domain controller.

The users can still login with their computers in the domain, but not in Jira.

Does Jira somewhere store the URL to the LDAP server or does it build every time a user tries to login?

From the log:

http-nio-8080-exec-12 ERROR anonymous 825x3920x1 1cj5ees 192.168.0.xx /rest/gadget/1.0/login [c.a.c.manager.application.ApplicationServiceGeneric] Directory 'Active Directory server' is not functional du ring authentication of 'user1'. Skipped.

Caused by: org.springframework.ldap.CommunicationException: DOMAIN.local:389; nested exception is javax.naming.CommunicationException: DOMAIN.local:389 [Root exception is java.net.NoRouteToHostException: No route to host

Caused by: java.net.NoRouteToHostException: No route to host (Host unreachable)

Accepted answers

Andrew Laden

So what did/do you have in the "hostname" field of the user directory configuration? You had to have something there. Does whatever you have in there still respond to LDAP requests.

As Tony mentioned, you HAVE to have a local admin account that is not coming from the Directory. If for no other reason then the fact that you are not allowed you edit the directory settings for the directory you are logged in from. (which is a nice safety feature)

All comments

Tony Rossiter

Your LDAP connection was likely configured with the exact URL for the DC. I would check the connection, fix the url and retest.

We have multiple DCs replicated to each other and get around this problem by using an alias in the LDAP connection. This way they can easily take down one and not lose access.

I would also recommend setting up an account on the local directory with admin creds just in case something like this happens. You don’t want to lose the ability to access the system as an admin.

Tony Rossiter

If you can’t get back in at all, bring that first DC back up and then go fix the URL

Annette Ruster

That's the point: both servers have equal Naming Context and the hostname and base DN fields don't mention names of the servers.

Tony Rossiter

Sorry, missed that detail on first read. Here's a troubleshooting guide that might help:

https://confluence.atlassian.com/jirakb/java-net-noroutetohostexception-in-ldap-connection-703398693.html

Adrian Stephen_q490r0

Hi @Annette Ruster

Have you imported the SSL certs into Jira's JAVA truststore? You may follow the steps here:

https://confluence.atlassian.com/adminjiraserver/configuring-an-ssl-connection-to-active-directory-938847053.html

A Jira restart is required after importing the certs.

Regards,
Adrian Stephen

Andrew Laden

So what did/do you have in the "hostname" field of the user directory configuration? You had to have something there. Does whatever you have in there still respond to LDAP requests.

Annette Ruster

Hi @Adrian Stephen

As I mentioned: we don't use SSL
Nevertheless, I tried to restart Jira. This didn't help

Annette Ruster

hi @Andrew Laden
We have just "domainname" in the hostname field

I use an LDAP browser on my computer and it can see both servers.

Yes, we do have a local Jira administrator account. How else could we create the User Directory?

So I suppose, I was right: Jira builds internally an LDAP connection string and stores it somewhere permanent in the database. And the only way, in this case, is to remove the User Directory and create it again.

Please correct me, if I'm wrong.

Andrew Laden

Try putting in the hostname of Domain Controller instead of the Domainname. Just to see.

Also try an LDAP browser from the Jira Server, not just your desktop to see if there is something going on at the network level.

On the "User Directory" Admin page, there is a link (near the bottom) "Directory Configuration Summary" That shows you the full information kept in the database.

check what it says for "ldap.url" that what is in the database.

Annette Ruster

well, ldap.url has only the domain name with the port number.

I tried it with hostname, unsuccessful.

But the IP address of the Domain Controller works.

Whereby the ldapsearch on the Jira server behaves in the same way.

But that doesn't explain why it doesn't work with the Domain Name

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

server

jira-software

jira-software-server