LDAP Server-Side and Client-Side Result-Error Codes

LDAP result codes tell you exactly what went wrong when a bind, search, or modify operation fails. This reference walks through every common server-side and client-side code so you can stop guessing and start diagnosing.

Various LDAP specifications define a number of common result codes that may be included in responses to clients. These result codes include (but are not necessarily limited to):

Server-Side Result Codes

0: Success

This indicates that the operation completed successfully. It may be returned in response to an add, bind, delete, extended, modify, modify DN, or search operations.

Compare operations will not return a success result. If a compare operation does not encounter an error during processing, then the server should return a result of either “compare true” or “compare false”, based on whether the target entry had the specified attribute value.

1: Operations Error

This is intended to indicate that the client has requested an operation at an inappropriate time or in an incorrect order. For example, it may be used if a client sends a non-bind request in the middle of a multi-stage bind operation.

2: Protocol Error

This generally indicates that the client request was improperly formatted in some way. For a bind operation, it may indicate that the client attempted to use an unsupported LDAP protocol version. For an extended operation, it may indicate that the server does not support the extended request type.

3: Time Limit Exceeded

This indicates that a search operation took longer to complete than allowed by the maximum time limit for that operation. This may be the time limit specified by the client in the search request, or it may be a time limit imposed by the server.

4: Size Limit Exceeded

This indicates that a search operation would have returned more entries than were allowed for that operation. This may be the size limit specified by the client in the search request, or it may be a size limit imposed by the server. Note that the server may return a portion of the matching entries before this result.

5: Compare False

This indicates that a compare operation was processed successfully but that the target entry did not match the provided attribute value assertion.

6: Compare True

This indicates that a compare operation was processed successfully and that the target entry matched the provided attribute value assertion.

7: Authentication Method Not Supported

This indicates that a bind operation failed because the server does not support the requested authentication type.

8: Stronger Authentication Required

This indicates that the server requires that the client be authenticated with a stronger mechanism than has previously been performed in order to process the request.

This result code may be used in a notice of disconnection unsolicited notification if the server believes that the security of the connection has been compromised.

10: Referral

This indicates that the server could not process the requested operation, but that it may succeed if attempted in another location, as specified by the referral URIs included in the response.

11: Administrative Limit Exceeded

This indicates that an administrative limit was exceeded while processing the request. For example, some directory servers use this response to indicate that it would have required examining too many entries to process the request.

12: Unavailable Critical Extension

This indicates that the request included a critical control that was not recognized or could not be processed.

13: Confidentiality Required

This indicates that the requested operation is only allowed over a secure connection.

14: SASL Bind in Progress

This indicates that the server requires more information from the client in order to complete the SASL bind operation. In such responses, the “server SASL credentials” element of the result message will often include information the client needs for subsequent phases of bind processing.

16: No Such Attribute

This indicates that the client attempted to interact with an attribute that does not exist in the target entry (e.g., to remove an attribute or value that does not exist).

17: Undefined Attribute Type

This indicates that the client request included an attribute type that is not defined in the server schema.

18: Inappropriate Matching

This indicates that the client request attempted to perform an unsupported type of matching against an attribute. For example, this may be used if the attribute type does not have an appropriate matching rule for the type of matching requested for that attribute.

19: Constraint Violation

This indicates that the client request would have caused the server to violate some constraint defined in the server (e.g., to add more than one value to a single-valued attribute).

20: Attribute or Value Exists

This indicates that the client request attempted to add an attribute or value to an entry that already contained that attribute or value.

21: Invalid Attribute Syntax

This indicates that the client request would have resulted in an attribute value that did not conform to the syntax for that attribute type.

32: No Such Object

This indicates that the client request targeted an entry that does not exist. Note that some servers use this result for a bind request that targets a nonexistent user, even though “invalid credentials” is a more appropriate result for that case.

33: Alias Problem

This indicates that a problem was encountered while interacting with an alias entry (e.g., the alias refers to an entry that does not exist).

34: Invalid DN Syntax

This indicates that the request included a malformed or invalid DN or RDN.

36: Alias Dereferencing Problem

This indicates that the client attempted to interact with an alias entry in a manner that was not allowed (e.g., for an operation that does not allow the use of aliases, or if the client does not have permission to access the entry referenced by the alias).

48: Inappropriate Authentication

This indicates that the client attempted to perform a type of authentication that is not allowed for the target user (e.g., because the user does not have the necessary credentials for that type of authentication). This may also indicate that the client attempted to perform anonymous authentication when that is not allowed.

49: Invalid Credentials

This indicates that the client attempted to bind as a user that does not exist, attempted to bind as a user that is not allowed to bind (e.g., because it has expired, because it has been locked because of too many failed authentication attempts, etc.), or attempted to bind with credentials that were not correct for the target user.

49/52e: AD Invalid Credentials

Indicates an Active Directory (AD) AcceptSecurityContext error, which is returned when the username is valid but the combination of password and user credential is invalid. This is the AD equivalent of LDAP error code 49.

49/525: User Not Found

Indicates an Active Directory (AD) AcceptSecurityContext data error that is returned when the username is invalid.

49/530: Not Permitted To Logon At This Time

Indicates an Active Directory (AD) AcceptSecurityContext data error that is a logon failure caused because the user is not permitted to log on at this time. Returns only when presented with a valid username and valid password credential.

49/531: Restricted To Specific Machines

Indicates an Active Directory (AD) AcceptSecurityContext data error that is a logon failure caused because the user is not permitted to log on from this computer. Returns only when presented with a valid username and valid password credential.

49/532: Password Expired

Indicates an Active Directory (AD) AcceptSecurityContext data error that is a logon failure. The specified account password has expired. Returns only when presented with valid username and password credential.

49/533: Account Disabled

Indicates an Active Directory (AD) AcceptSecurityContext data error that is a logon failure. The account is currently disabled. Returns only when presented with valid username and password credential.

49/568: Error Too Many Context IDs

Indicates that during a log-on attempt, the user’s security context accumulated too many security IDs. This is an issue with the specific LDAP user object/account which should be investigated by the LDAP administrator.

49/70: Account Expired

Indicates an Active Directory (AD) AcceptSecurityContext data error that is a logon failure. The user’s account has expired. Returns only when presented with valid username and password credential.

49/773: User Must Reset Password

Indicates an Active Directory (AD) AcceptSecurityContext data error. The user’s password must be changed before logging on the first time. Returns only when presented with valid user-name and password credential.

50: Insufficient Access Rights

This indicates that the client does not have permission to perform the requested operation.

51: Busy

This indicates that the server is currently too busy to process the requested operation.

52: Unavailable

This indicates that the server is currently unavailable (e.g., because it is being shut down or is in a maintenance state).

52e: AD Invalid Credentials

Indicates an Active Directory (AD) AcceptSecurityContext error, which is returned when the username is valid but the combination of password and user credential is invalid. This is the AD equivalent of LDAP error code 49: LDAP_INVALID_CREDENTIALS.

53: Unwilling to Perform

This indicates that the server is unwilling to process the requested operation for some reason.

54: Loop Detected

This indicates that the server has detected an internal loop while processing the requested operation (e.g., if two alias entries reference each other).

60: Sort Control Missing

This indicates that the search request included a virtual list view request control without also including the required server-side sort request control.

61: Offset Range Error

This indicates that the search request included a virtual list view request control with an invalid offset or content count.

64: Naming Violation

This indicates that the requested add or modify DN operation would have resulted in an entry that violates server naming restrictions (e.g., as might be imposed by a name form defined in the server schema).

65: Object Class Violation

This indicates that the requested operation would have resulted in an entry that violates schema restrictions imposed by its object classes (e.g., to include an attribute that is not allowed to be present in the entry, or to omit an attribute that is required to be present in the entry).

66: Not Allowed on Non-Leaf Entry

This indicates that the requested operation cannot be performed against an entry that has one or more subordinate entries. For example, a delete operation is normally not allowed to remove an entry that has one or more subordinates.

67: Not Allowed on RDN

This indicates that the requested operation is not allowed because it would have altered the entry to remove an attribute value used in the entry’s RDN.

68: Entry Already Exists

This indicates that the requested add or modify DN operation could not be processed because another entry already exists with the DN that would have resulted from that operation.

69: Object Class Modifications Prohibited

This indicates that the requested operation would have resulted in a disallowed change to the object classes contained in the entry (e.g., the operation would have changed the entry’s structural object class).

71: Affects Multiple DSAs

This indicates that the requested operation could not be processed because it would have required interacting with data in multiple directory server instances in a way that is not supported.

76: Virtual List View Error

This indicates that a search operation failed because of processing associated with a virtual list view request control included in the request (e.g., if a necessary index was not in place to facilitate the virtual list view processing).

80: Other

This indicates that some problem was encountered during processing that is not covered by any of the other defined result codes (e.g., a server error).

118: Canceled

This indicates that an operation was canceled through the use of the cancel extended request. If an operation is canceled in this way, then this result code will be used for both the operation that was canceled and for the cancel extended operation itself.

119: No Such Operation

This indicates that an attempt to cancel an operation via the cancel extended request was not successful because the server did not have any knowledge of the target operation. This often means that the server had already completed processing for the operation by the time it received and attempted to process the cancel request.

120: Too Late

This indicates that an attempt to cancel an operation via the cancel extended request was not successful because processing for that operation had already reached a point beyond which it could be canceled.

121: Cannot Cancel

This indicates that an attempt to cancel an operation via the cancel extended request was not successful because the target operation is not an operation that can be canceled. Operations that cannot be canceled include abandon, bind, unbind, and the cancel and StartTLS extended operations.

122: Assertion Failed

This indicates that the requested operation could not be processed because the request included an LDAP assertion request control, but the assertion filter did not match the target entry.

123: Authorization Denied

This indicates that the requested operation could not be processed because the request included a proxied authorization request control (or some similar control intended to specify an alternate authorization identity for the operation), but the client was not allowed to request the use of that alternate authorization identity.

4096: Synchronization Refresh Required

This indicates that an attempt to use the content synchronization request control in order to perform an incremental update failed for some reason and the client will instead need to request an initial content.

16654: No Operation

This indicates that the associated operation would likely have succeeded, to the extent that the server was able to make the determination, but was not actually processed because the request included the LDAP no operation control. Note that at present, the numeric value for this result code is not an official standard because the specification for the no operation request control has not progressed far enough to be assigned an official numeric value, but the value 16654 is in common use by a number of servers for this purpose.

Client-Side Result Codes

There are also a number of result codes that are not intended to be returned by LDAP servers, but may still be useful to indicate problems that may arise in LDAP client applications. These client-side result codes include those listed below:

81: Server Down

This generally indicates that a previously-established connection is no longer valid. It may indicate that the server to which the connection was established has shut down, but it could also mean that the connection was closed or has become invalid for some other reason (e.g., the client was idle for too long, there was a network outage, etc.).

82: Local Error

This indicates that some client-side problem occurred that interfered with its ability to interact with a directory server. This should generally be used when no other client-side result code is more appropriate.

83: Encoding Error

This indicates that a client-side problem was encountered while attempting to encode a request to send to a directory server.

84: Decoding Error

This indicates that a client-side problem was encountered while attempting to decode a request received from a directory server.

85: Timeout

This indicates that a client-side timeout was encountered while waiting for a response to an LDAP request.

86: Authentication Unknown

This indicates that a client application attempted to use an unknown authentication type.

87: Filter Error

This indicates that a client-side problem was encountered while interacting with a search filter (e.g., if the client failed to parse a string as a search filter).

88: User Canceled

This indicates that an operation was interrupted on the client before a response was received from the directory server. Note that this does not necessarily mean that the associated operation was aborted in the server, and it is entirely possible that an operation that was canceled on the client still succeeded in the server.

89: Parameter Error

This indicates that some invalid parameter was provided to an LDAP client that prevented it from conducting the desired processing.

90: No Memory

This indicates that the client ran out of memory when attempting to process the requested operation, or that the client was able to determine that the operation would have consumed too much of the client’s memory.

91: Connect Error

This indicates that an LDAP client was unable to successfully establish a connection to the directory server. This may suggest that the client was unable to establish the underlying TCP connection, or that a problem was encountered while attempting to negotiate a security layer on top of it in a manner that was not related to LDAP communication.

92: Not Supported

This indicates that a client attempted to do something that was not supported by the LDAP API used by that client.

93: Control Not Found

This indicates that the client expected to find a particular control in a request or response, but that control was not present.

94: No Results Returned

This indicates that the client did not receive any search results for an operation in which results were expected.

95: More Results to Return

This indicates that the client has received or conveyed a portion of the search results for an operation, but there are still more results to be retrieved.

96: Client Loop

This indicates that the client encountered some kind of a loop during processing. This generally indicates that a referral loop was encountered, in which attempting to follow a referral ends eventually causes the client to encounter the same referral multiple times.

97: Referral Limit Exceeded

This indicates that, in the attempt to follow a referral, the client encountered one or more additional referrals and reached the limit of the number of referral hops it is willing to follow.

• Technology
• Security

• Active-Directory
• Sso
• Troubleshooting