Thanks to Rob.

We finally got the root cause, it's a bug in the application. Our LDAP URL or DN is too long which triggered a bug in the JDK Properties. Java Properties doesn't allow the value to be longer than 47, and if the length is longer than 47, it will truncate the value and append the "..." at the end.

On Thu, Jul 6, 2017 at 1:33 AM, Rob Crittenden <rcritten@redhat.com> wrote:

wenxing zheng via FreeIPA-users wrote:
> Dear all,
>
> I met with an issue when doing the LDAP authentication on the Kylin. My
> FreeIPA works with Ranger very well, but on Kylin, when binding the DN
> with the admin, it failed to connect to the LDAP server:
>
> [05/Jul/2017:11:16:32 +0800] ipalockout_preop - [file ipa_lockout.c,
> line 756]: Failed to retrieve entry
> "uid=admin,cn=users,cn=accounts,dc=dat...": 32
> [05/Jul/2017:11:16:32 +0800] ipalockout_preop - [file ipa_lockout.c,
> line 756]: Failed to retrieve entry
> "uid=admin,cn=users,cn=accounts,dc=dat...": 32

I don't know what either Kylin or Ranger are. The only advice I can
suggest is to ensure the whole DN is correct (the dc= bits). The plugin
is just trying to fetch the entry that is doing the BIND. My memory is
fuzzy on the ordering of the plugins, it's possible that the bind hasn't
been authenticated yet at this point, I'm not sure.

You should be able to test on the command-line which might make this easier:

$ ldapsearch -D uid=admin,cn=users,cn=accounts,dc=example,dc=com -W -b
uid=admin,cn=users,cn=accounts,dc=example,dc=com

rob