LDAP

Hi,

I'm changing an LDAP access process to go after Active Directory rather
than one that is being retired. The retiring LDAP directory is not AD.

This should be an easy conversion: Get a service account on the AD system,
change the connection information to connect to AD and adjust the search
names to meet AD's naming.

So far this has been true. We can verify AD is reached and the process is
binding to AD

Here's the basic steps being followed.

ldap_init() returns a pointer/handle so it is connecting to something.
We've verified it is the correct AD.

ldap_simple_bind_s() returns 0 so it is binding to what it contacted.
We've verified the bind is occurring on the AD box

ldap_search_st() returns 0 and the result has something in it. So this
appears to work.

ldap_first_entry() returns null and there isn't an error code generated for
it.

ldap_get_errno() and ldap_get_iderrno() both return 0.

I need to find out what is happening between ldap_search_st() and
ldap_first_entry(). IBM's web site says adding an environment variable for
the ldap client will start tracing.
Assuming my job is the LDAP client I added it under my job.

ADDENVVAR ENVVAR(LDAP_DEBUG) VALUE(65535)

I then ran the process using LDAP to connect to AD.

When I tried dumping the trace data I received CPFA98B.

DMPUSRTRC JOB(*)

Message . . . . : The User Trace buffer associated with job

999999/xxxxxxx/xxxxxxxxxx could not be dumped.

Cause . . . . . : Either you are not authorized to dump the requested
User
Trace buffer or the buffer does not exist.

Recovery . . . : If the user space object associated with the User
Trace
buffer exists, have the owner grant you authority to that user space
object
and try the command again. If the buffer does not exist, omit the
command.


IBM then says to run

DSPPFM QAP0ZDMP

I can't find QAP0ADMP anywhere.

Anyone have any ideas on how I can get the LDAP debug process working, or
an inkling on what is occurring between ldap_search_st() and
ldap_first_entry()?



Thank you,

Gary Monnie
​r​