The following sample log messages will help you troubleshoot an LDAP connection. If you see similar log messages, use the show ldap command and check the settings for all LDAP-related items.
If a cryptographic session cannot be established with the LDAP server, remote authentication will not be possible, and no authentication data is sent unencrypted. The encrypted session will automatically reconnect during the next authentication attempt or when the peer is available on the network.
For example, the following log message indicates that the LDAP ciphers have failed:
Apr 30 11:53:37 jdoe-7500 sshd[11661]: pam_ldap: ldap_starttls_s: server www.fireeye.com:389: Connect error
For example, the following log message indicates that your appliance could not reach the LDAP server:
Apr 30 11:55:23 jdoe-7500 sshd[21853]: pam_ldap: ldap_starttls_s: server xyz.com:389: Can't contact LDAP server
For example, the following log message indicates that the certificate failed:
Apr 30 11:59:14 jdoe-7500 sshd[6499]: pam_ldap: ldap_starttls_s: server www.fireeye.com:389: Connect error: certificate verify failed (self signed certificate)