Troubleshooting LDAP integration
Diagnose and resolve common LDAP configuration and synchronization issues for IBM Bob on-premises.
Use the following table to diagnose and resolve common LDAP configuration and synchronization issues.
Troubleshooting
| Symptom | Possible cause and resolution |
|---|---|
LDAPReachable is False | The cluster cannot connect to the LDAP server. Verify the connectionUrl value and confirm that the LDAP server is reachable from the cluster on the required port (389 for LDAP or 636 for LDAPS). Check network policies, firewalls, and DNS resolution. |
LDAPAuthenticated is False | The configured bindDn or bind password is incorrect. Verify the credentials and reapply the configuration. |
UserSyncSucceeded is False | User synchronization failed or timed out. Verify the usersDn and customUserSearchFilter values. For large directories, increase the BOB_LDAP_WAIT_TIMEOUT value and retry the operation. |
| TLS errors when connecting to the LDAP server | The CA certificate is missing, invalid, or does not match the LDAP server certificate. Verify the certificate and recreate the ldapsCACertSecret if necessary. |
| LDAP users can authenticate but cannot access Bob | User roles are assigned through SCIM provisioning. Confirm that the sign-in completed successfully and allow up to five minutes for provisioning to finish. |
| Administrator user does not have administrator privileges | Verify that the user belongs to the LDAP administrator group mapped through groupMapper. Alternatively, add the user manually to the bob-admins group in the Keycloak console. |
| Direct Keycloak users cannot sign in | The user account might be disabled or missing credentials. Open the user record in the Keycloak administration console and verify the account status and credentials. |
| LDAP groups do not appear in Keycloak | Verify that groupMapper.groupsDn references the correct LDAP location and that the group entries contain the configured groupObjectClasses. |
| User group memberships are not resolved | Verify that the group membership attributes are populated in the LDAP directory. Depending on your configuration, this might be the group member attribute or the user memberOf attribute. |
| A newly added LDAP user does not appear in Bob | SCIM provisioning might have failed. Verify that the bob-admin pods are running, confirm that the BobLDAP resource reports Ready: True, and have the user attempt an initial sign-in to trigger provisioning. |
| Bob administration UI displays "Client not found" | The user's email domain is not included in the domains field of any BobLDAP resource. Update the configuration and rerun bobctl add-ldap. |
| A user removed from LDAP still has access to Bob | The SCIM deprovisioning event was not processed. Review the bob-admin logs, verify that the Keycloak SCIM plugin is functioning correctly, and, if required, manually remove the user from the bob realm in Keycloak. |
Collecting diagnostic information
If you need to perform additional troubleshooting or open a support case, collect the provider status and relevant logs.
# Provider status
oc get bobldap -n <instance-namespace> -o yaml > bobldap-status.yaml
# Operator logs
oc logs -n <operator-namespace> deployment/ibm-bob-operator --tail=500 > operator.log
# Keycloak logs (LDAP connection and authentication errors surface here)
oc logs -n <instance-namespace> -l app=keycloak --tail=500 > keycloak.logReview the collected files for errors before contacting support, and include them with any support request to help speed up issue resolution.
LDAP integration
Configure LDAP or Active Directory federation for IBM Bob on-premises using the BobLDAP custom resource and the bobctl add-ldap command.
Backup and restore
Configure, manage, and restore PostgreSQL database backups for IBM Bob on-premises to protect application data and support recovery scenarios.