Error: ldap_search(): Search: Operations error when using MS Active Directory

[paschulke]

Occurs after AD users logs in with fully configured Active Directory. AD connect succeds

Full Error

PHP error
Warning: ldap_search(): Search: Operations error
in /var/www/karadav/lib/KaraDAV/LDAP.php:41

37	{
38		self::connect();
39
40		$filter = sprintf($filter, ldap_escape($login, "", \LDAP_ESCAPE_FILTER));
41		$results = ldap_search(self::$ldap, LDAP_BASE, $filter, [LDAP_DISPLAY_NAME]);
42		$info = ldap_get_entries(self::$ldap, $results);
43
44		return empty($info[0][LDAP_DISPLAY_NAME][0]) ? false : true;
45	}

in /var/www/karadav/lib/KaraDAV/LDAP.php:41

AD server responds with LDAP Bind Error

  refcnt: 2  status: Connected
  last used: Tue Jan 13 13:48:46 2026


** ld 0x55cd175b6560 Outstanding Requests:
 * msgid 1,  origid 1, status InProgress
   outstanding referrals 0, parent count 0
  ld 0x55cd175b6560 request count 1 (abandoned 0)
** ld 0x55cd175b6560 Response Queue:
   Empty
  ld 0x55cd175b6560 response count 0
ldap_chkResponseList ld 0x55cd175b6560 msgid 1 all 1
ldap_chkResponseList returns ld 0x55cd175b6560 NULL
ldap_int_select
read1msg: ld 0x55cd175b6560 msgid 1 all 1
ldap_find_request_by_msgid: msgid 1, lr 0x55cd175bc3c0 lr->lr_refcnt = 1
read1msg: ld 0x55cd175b6560 msgid 1 message type search-result
read1msg: ld 0x55cd175b6560 0 new referrals
read1msg:  mark request completed, ld 0x55cd175b6560 msgid 1
request done: ld 0x55cd175b6560 msgid 1
res_errno: 1, res_error: <000004DC: LdapErr: DSID-0C090C0C, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v3839>, res_matched: <>
ldap_return_request: lrx 0x55cd175bc3c0, lr 0x55cd175bc3c0
ldap_return_request: lrx->lr_msgid 1, lrx->lr_refcnt is now 0, lr is still present
ldap_free_request (origid 1, msgid 1)
ldap_free_request_int: lr 0x55cd175bc3c0 msgid 1 removed
ldap_do_free_request: asked to free lr 0x55cd175bc3c0 msgid 1 refcnt 0
ldap_parse_result
ldap_msgfree
ldap_err2string
ldap_free_connection 1 1
ldap_send_unbind
TLS trace: SSL3 alert write:warning:close notify
ldap_free_connection: actually freed

PHP 8.4.16 (cli)
Bundled with libapache2-mod-php on Debian 13

[bohwaz]

Hi, this feature has been contributed by a community member, I don't use or know anything about LDAP, so I can't help you.

Would you be interested in using OpenID Connect instead? I was thinking of dropping LDAP support in favor of OIDC.

[paschulke]

OIDC would also work, we're currently employing Keycloak as an OIDC provider.
Feel free to close this issue then.

[poVoq]

Oidc support would be indeed nice, but AD is quite nonstandard LDAP, so please don't remove LDAP support because it doesn't seem to work with Active Directory.