Error occurs with the idsldapsearch command

Edit online

The idsldapsearch command with -h option gives an error with the DIGEST-MD5 mechanism. Follow the steps to resolve this error.

The DIGEST-MD5 SASL bind mechanism requires the client to be able to resolve the fully qualified host name of the server. If the client cannot resolve the server's fully qualified host name, the bind fails with an LDAP_PROTOCOL_ERROR. To correctly resolve the host name, you might be required to make system changes or make DNS configuration changes, such as enabling reverse DNS mapping.

For example, AIX® and Linux™ systems have lines in the /etc/hosts file with the syntax:

IP address fully qualified distinguished name alias

This syntax is used to define the local host name to the IP address mappings.

If the syntax is something like:

127.0.0.1 localhost

When localhost is resolved, it is seen as the fully qualified distinguished name of the system, which causes DIGEST-MD5 to fail.

For the DIGEST-MD5 mechanism to work correctly, the syntax must be similar to the following syntax:

127.0.0.1 ldap.myserver.mycompany.com localhost

The syntax of the line is now such that ldap.myserver.mycompany.com is a valid fully qualified distinguished name for the localhost system.