Skip to main content Skip to search
Help us improve your experience: In general, do you find what you're looking for in the Help Center?
Thank you for your contribution!
close

Troubleshoot LDAP, LDAPS, proxy and synchronization issues

Related to

Quentin Grabenstaetter
  • Updated
Edit article Translate article Notify subscribers

You can use this article when the connector does not start, cannot reach LDAP/LDAPS, fails behind a proxy or does not return the expected synchronization result. It gives you a practical path to identify the failing layer before escalating to support.

LDAPS diagnostics

The local console displays structured LDAPS diagnostics with severity, category, cause and recommended action. Always read that diagnosis before going deeper into logs.

Error family Examples Typical action
Network ECONNREFUSED, ETIMEDOUT, EHOSTUNREACH, ENOTFOUND Check server address, DNS, firewall and LDAPS availability.
TLS certificate CERT_HAS_EXPIRED, SELF_SIGNED_CERT_IN_CHAIN, ERR_TLS_CERT_ALTNAME_INVALID Renew the certificate, use the correct FQDN, or upload the correct CA bundle.
TLS chain UNABLE_TO_VERIFY_LEAF_SIGNATURE, UNABLE_TO_GET_ISSUER_CERT_LOCALLY Upload the full PEM chain or configure the LDAP server to send intermediate CAs.
LDAP bind 49, 48, 32 Check bind DN, password and account existence.

Verify LDAPS with openssl

openssl.exe s_client -showcerts -connect ldap.example.com:636

Expected result: return code 0 and server, intermediate and root certificates listed in order.

Proxy authentication

  • Verify proxy host, port and credentials in the local console.
  • Restart the connector service after changing proxy settings.
  • Remember the service runs as LocalSystem and does not inherit per-user proxy settings.

Service does not start

  • Check Windows Event Log for the Rainbow AD Connector source.
  • Verify rainbow-service.exe exists in the install folder.
  • Confirm the assigned local console port is free.
  • Use sc.exe queryex RainbowADService_3001 to inspect service state and exit code.

Sync stuck or no dry run response

  • Confirm Connection to Rainbow is connected on the local console.
  • Check LDAP filters for syntax issues.
  • Save logs and look for webImportStatus entries.
  • Restart the connector service if a previous run is stuck in progress.

Avatar not syncing

  • Avatar synchronization is available for Active Directory only.
  • Confirm the avatar field is mapped and non-empty.
  • Confirm the LDAP account can read thumbnailPhoto.
  • Allow time for large directories because avatars are processed after users.

Auto-update failures

  • Check connectivity to the update URL.
  • Verify SHA-512 verification did not reject the downloaded installer.
  • Look for applyUpdater entries in the logs.
Was this article helpful?
0 out of 0 found this helpful