Technical Tip: LDAP Error message ‘fnbamd_ldap_parse_response-Error 34’

Description

This article describes what debug log means when ‘fnbamd_ldap_parse_response-Error 34’ is checked and what is the solution to fix it.

When the client accesses the LDAP Server via FortiGate , the error messages captured by FortiGate is showing as below, and cannot access to it normally.

Solution

Run the following commands from the CLI:

diagnose debug disable
diagnose debug reset
diagnose debug application fnbamd -1
diagnose debug enable

To stop this debug type:

diagnose debug disable

diagnose debug reset

In the fnbamd debug logs, the error message is found when trying to log on via the LDAP server.

[981] __ldap_rxtx-state 11(DN search)
[751] fnbamd_ldap_build_dn_search_req-base:'dc=test\2C dc=lab' filter:sAMAccountName=xxxx
[981] __ldap_rxtx-state 12(DN search resp)
[1127] __fnbamd_ldap_read-Read 8
[1127] __fnbamd_ldap_read-Read 94
[1307] fnbamd_ldap_recv-Response len: 96, svr: x.x.x.x
[988] fnbamd_ldap_parse_response-Got one MESSAGE. ID:2, type:search-result
[1010] fnbamd_ldap_parse_response-Error 34(0000208F: LdapErr: DSID-0C090A90, comment: Error processing name, data 0, v4563)
[1023] fnbamd_ldap_parse_response-ret=34

LDAP Error Codes is a Result Code indicating something went wrong.

Error LDAP 34: Invalid syntax for DN

Check on the DN syntax in the LDAP configuration.

Example:

config user ldap
    edit "LDAP_Server"
        set server "X.X.X.X"
        set cnid "sAMAccountName"
        set dn "dc=test, dc=lab"                <----- Set dn 'dc=test,dc=lab', additional space between.
end

Refer to RFC 2253 - Lightweight Directory Access Protocol (v3): UTF-8 String Representation of Distinguished Names for UTF-8 String Representation of Distinguished Names.