Content Manager OnDemand LDAP authentication to active directory server fails with an error

Attempting to log on through an OnDemand client results in the error "The server failed while attempting to logon."

Taking a Content Manager OnDemand server trace shows that the initial bind to the Active Directory server was successful, but the search failed with the error "Operations error":

ArcLDAP_Startup:
LDAP Config ArcLDAPServerPtr=example.com
ArcLDAPPort=389
ArcLDAPBaseDN=DC=example,DC=com
ArcLDAPBindDN=CN=sample-user,OU=sample,DC=example,DC=com
ArcLDAPBindAttrib=sAMAccountName
ArcLDAPMappedAttrib=sAMAccountName
ArcLDAPKeyRingFile=(null)
ArcLDAPKeyRingLabel=(null)
LDAP use SSL=FALSE
LDAP allow anonymous bind=FALSE
LDAP referrals=TRUE
LDAP SaslBind=FALSE
LDAP OD Authentication Fallback=TRUE
...
ArcLDAP_Startup:
...
ArcLDAP_Startup:Return
ArcLDAP_Authenticate:Enter
ArcLDAPP_Connect:Enter
ArcLDAPP_Connect:LDAP initialization successful
ArcLDAPP_Connect:Return arccs return code=0,ARCCS_OKAY
ArcLDAPP_Bind:Enter
ArcLDAPP_Bind:ldap_sasl_bind ldap_rc=0 extra_rc=1
ArcLDAPP_Bind:ldap_parse_result ldap_rc=0 extra_rc=0
ArcLDAPP_Bind:ldap_sasl_bind ldap_rc=0 extra_rc=0
ArcLDAPP_Bind:Return arccs return code=0,ARCCS_OKAY
ArcLDAP_Authenticate:Searching cur_userid=USER1 os_filter=sAMAccountName=USER1
ArcLDAP_Authenticate:ldap_search_s ldap_rc=1 ldap_ext=0 ldap_errno=1 extra_rc=0 ldap_str=Operations error extended_str=(null) errno_str=(null) err_msg=(null)
ArcLDAP_Authenticate:ldap_unbind ldap_rc=0 extra_rc=0
ArcLDAP_Authenticate:Return arccs return code=6,ARCCS_FAILED

This error typically occurs when Content Manager OnDemand is configured with a base distinguished name that searches across subordinate domains that are direct descendants of the directory server domain. In the previous example, the base distinguished name was set to DC=example,DC=com, which is at the root level of the Active Directory server example.com.

The Content Manager OnDemand server uses the Tivoli Directory Server LDAP API to communicate with the Active Directory server. The search scope is set to subtree and by default the referral option is enabled. With these conditions set, referral chasing might occur. See the Related Information section for more information.