This page introduces frequently asked questions about Active Directory integration.
If you have any questions, please be sure to read through it.
If this does not resolve your issue, please feel free to contact us.
Frequently Asked Questions
Q1. A user using AD integration tried to log in to TrustLogin, but received the message
"No response from the external authentication system," and could not log in to TrustLogin.
A1. If all of the following conditions apply, please restart the AD Connector.
- Heartbeats are being received
- There are no errors in the logs
In addition, it has been confirmed that, depending on your AD environment, this issue can occur when user authentication processing and user sync processing run at the same time.
In that case, increasing the configured sync interval reduces the likelihood that user authentication processing and user sync processing will run at the same time, which may improve the issue.
Q2. Users on the AD side are not being synced to TrustLogin.
A2. Please check each of the following items.
-
On the AD Server Side
Double-click a member and check whether the following attributes (required fields) are set.
・first name
・last name
・email
Note: It has been confirmed that if only a full-width space is synced for "last name" or "first name," the entire sync process will fail.
In that case, please correct the user data that contains only a full-width space.
-
On the TrustLogin Side
Open "User Sync Settings" and check whether the following items are configured correctly.
① Is the distinguished name (DN) of the AD user with read permissions (used to run LDAP queries)
correctly entered in "userDN"? (See Figure 1)
② Is the password of the AD user with read permissions correctly entered in "userPassword"?
③ Is the ON/OFF toggle for "Source AD Domain User Group" set correctly?
・When ON: All users on the AD side are included in the sync.
・When OFF: Only users in the specified security group are included in the sync.
④ Is the distinguished name (DN) of the AD security group to sync correctly entered in "Source AD Security Group"?
(See Figure 2)
(Figure 1)
(Figure 2)
In "AD Attributes to Sync," configure the mapping between the AD user attributes and the TrustLogin information.
Enter the following values for each item and save the settings.
First Name givenName Last Name sn Email Address mail
Q3. I checked the items in Q2, but user sync still does not work.
A3. Please check the logs, and if there are any errors, refer to the error information below and take the necessary action. The logs are saved in a directory named "logs" under the directory where the Connector is installed.
AD Connector Error Log File Location:
skuidadconnector_yyyymmdd.out.log / skuidadconnector_yyyymmdd.err.log, directly under the logs folder
Since this is a program log, if you are unable to analyze it yourself,
please contact us. In that case, we will ask you to provide the log.
| Error Information Recorded in the Log | Cause | Solution |
| ERROR c.g.i.adconnector.beans.AmqpReceiver - Caught exception when processing SearchOperationRequestMessage message {} org.springframework.ldap.PartialResultException: nested exception is javax.naming.PartialResultException [Root exception is javax.naming.CommunicationException: host.test.com:389 [Root exception is java.net.ConnectException: Connection timed out: connect]] ..................... Caused by: javax.naming.PartialResultException: null at com.sun.jndi.ldap.AbstractLdapNamingEnumeration.hasMoreImpl(Unknown Source) at com.sun.jndi.ldap.AbstractLdapNamingEnumeration.hasMoreReferrals(Unknown Source) |
The AD Connector cannot connect to the specified AD domain controller |
This is usually caused by a DNS configuration issue or a firewall issue, and support from your IT department will be required.
・Please check whether access to the communication port is allowed. ・Please try removing any firewall or other elements that may be blocking communication. ・Please check the domain controllers registered on your DNS server, and confirm that no invalid controller information remains. |
|
Caused by: javax.naming.CommunicationException: host.test.com:389 ....
|
The AD Connector cannot connect to the specified AD domain controller |
Please check whether the PC on which the AD Connector is configured can access the AD domain controller. This is usually caused by a DNS configuration issue or a firewall issue, and support from your IT department will be required.
・Please check whether access to the communication port is allowed. ・Please try removing any firewall or other elements that may be blocking communication. ・Please check the domain controllers registered on your DNS server, and confirm that no invalid controller information remains. |
|
Caused by: javax.naming.CommunicationException: simple bind failed: host.test.com:389 at com.sun.jndi.ldap.LdapClient.authenticate(Unknown Source) at com.sun.jndi.ldap.LdapCtx.connect(Unknown Source) ... 25 common frames omitted Caused by:java.net.SocketException: Connection reset at java.net.SocketInputStream.read(Unknown Source) at java.net.SocketInputStream.read(Unknown Source) at sun.security.ssl.InputRecord.readFully(Unknown Source) |
Unable to establish an HTTPS connection |
Please check your HTTPS-related settings and configure the correct information for the protocol and port on the TrustLogin AD admin screen. |
|
Consumer@108918ab: tags=[{amq.ctag-UrtoGbbFdFfu0c96a-MDVw=connector.inbound}], channel=Cached Rabbit Channel: AMQChannel(amqp://user_vRu3hYJ5KEcXB2lblJyv_being-group@18.179.80.15:5671/vhost_auuUOeavP1gSAN6Z9VyT_being-group,1), conn: Proxy@7dc90857 Shared Rabbit Connection: SimpleConnection@4e92d9b7 [delegate=amqp://user_vRu3hYJ5KEcXB2lblJyv_being-group@18.179.80.15:5671/vhost_auuUOeavP1gSAN6Z9VyT_being-group, localPort= 64559], acknowledgeMode=AUTO local queue size=0 |
The AD Connector cannot access the TrustLogin AD server |
Please configure your network so that the PC on which the AD Connector is installed can access the above two servers. |
|
WARN c.g.i.a.s.LdapFunctionalityService - Group SearchTerm(dn="CN=SSS,DC=aaa,DC=co,DC=jp", matchCriteriaIdList=[3ddcf0cb-753a-424b-9349-d893d9bfcff1], staticUserSearchQuery=null) was not found ...
|
The UserDN setting is incorrect |
Please correctly configure UserBase and UserDN in the "AD User with Read Permissions" section of the "User Sync Settings" screen. Note: Use the "dsquery user "UserDN"" command in the "Useful Commands for AD Troubleshooting" section below to verify that UserDN is correct. |
|
org.springframework.ldap.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C090453, comment: AcceptSecurityContext error, data 52e, v3839 ]; nested exception is javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C090453, comment: AcceptSecurityContext error, data 52e, v3839 ]
|
The UserDN setting is incorrect |
In the userDN field of the "AD User with Read Permissions" section on the "User Sync Settings" screen, please specify userPrincipalName instead of the distinguished name. ・Example of a distinguished name: ・Example of userPrincipalName: |
|
WARN c.g.i.a.s.LdapFunctionalityService - Group SearchTerm(dn=CN=aaaaGroupName,OU=OUName,DC=test,DC=com, matchCriteriaIdList=[d125d0db-304b-4e76-a44f-8cebbe912802], staticUserSearchQuery=null) was not found ..... |
The Source AD Security Group setting is incorrect |
Please correctly configure the Source AD Security Group. Note: Use the "dsquery group "GroupDN"" command in the "Useful Commands for AD Troubleshooting" section below to verify that the group's DN is correct. |
|
No error message |
The AD Attributes to Sync setting is incorrect
|
Please correctly enter the AD Attributes to Sync. Note: Normally, enter the following: First Name: givenName Last Name: sn Email Address: mail
If configured correctly, the AD-side user attributes will be reflected in TrustLogin. |
Useful Commands for AD Troubleshooting
|
Category
|
Command
|
|
|---|---|---|
| CMD | dsquery user "UserDN" |
Verifies the accuracy of the UserDN entered for "AD User with Read Permissions" on the TrustLogin AD settings screen. If the entered UserDN is correct, the entered UserDN is displayed as-is.
If the entered UserDN is incorrect, an error is displayed. |
| CMD | dsquery group "GroupDN" |
Verifies the accuracy of the "Source AD Security Group" entered on the TrustLogin AD settings screen. If the entered GroupDN is correct, the entered GroupDN is displayed.
If the entered GroupDN is incorrect, an error is displayed. |
Q4. I want to check whether integration with the AD server is working.
A4. You can use the telnet command to check whether access to the two AD servers is open.
telnet a-mq-ad.services.sku.id 5671 [Currently stopped]
telnet b-mq-ad.services.sku.id 5671
Note: If telnet is not available, please refer to this page to enable telnet.
If the connection fails, a connection failure error message is displayed.
Please check your firewall settings and other configurations to see whether the IP address or port of the target server is open.
If the connection to the AD server and port succeeds, a blank screen is displayed.
After confirming this, please close the telnet window.
Q5. When installing the AD Connector, the message "The TrustLoginConnector Setup Wizard could not be completed" is displayed and installation cannot be completed.
A5. This may be caused by insufficient permissions, among other factors. Please check the following points.
・Log back in as the server's local administrator
・Run the installer with the following command using administrator privileges
msiexec /i [AD Connector file name]