title: Authenticate via LDAP fails when using TLS
body: <p>I found several discussions about this issue in the net but none of them worked for me.<br>
  I am trying to authenticate via LDAP using TLS connection.<br>
  I get contradicted responses when using ldapsearch command and Java code.<br>
  In the ldapsearch command, searching with TLS works and fails without it,<br>
  While in the Java code the standard LDAPS connection works and TLS fails.<br></p>
  
  <p>Here's the ldapsearch results:<br></p>
  
  <p>With TLS:</p>
  
  <blockquote>
    <blockquote>
      <p>/usr/bin/ldapsearch -h ldap.server.com -Z -x -D "#BIND_DN#" -W -b "#SEARCH_BASE#" -s sub "(cn=#USERNAME#)"<br>
          Enter LDAP Password: XXXXXXXX<br>
          ....<br>
          mail: test.user@ldap.server.com<br>
          result: 0 Success</p>
    </blockquote>
  </blockquote>
  
  <p>Without TLS:</p>
  
  <blockquote>
    <blockquote>
      <p>/usr/bin/ldapsearch -h ldap.server.com -p 636 -x -D "#BIND_DN#" -W -b "#SEARCH_BASE#" -s sub  "(cn=#USERNAME#)"<br>
          Enter LDAP Password: XXXXXXXXX <br> 
          ldap_result: Can't contact LDAP server (-1)</p>
    </blockquote>
  </blockquote>
  
  <p>And here are the Java results:</p>
  
  <p>Without TLS:</p>
  
  <pre><code>&gt;&gt;java -cp lib com.myapp.toolkit.auth.LDAPTestKit
  [LDAPTestKit] found authenContext.
  [LDAPTestKit] Authentication Success
  [LDAPTestKit] Found attributes:
  [LDAPTestKit] mail : test.user@ldap.server.com
  
  ....
  </code></pre>
  
  <p>With TLS:</p>
  
  <pre><code>&gt;&gt;java -cp lib com.myapp.toolkit.auth.LDAPTestKit
  ERROR [main] [] [LDAPTestKit] Initial binding - Failure
                  [LDAP: error code 1 - TLS already started]
  
  javax.naming.NamingException: [LDAP: error code 1 - TLS already started]; remaining name ''
      at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3107)
      at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:3013)
      at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2820)
      at com.sun.jndi.ldap.LdapCtx.extendedOperation(LdapCtx.java:3192)
      at javax.naming.ldap.InitialLdapContext.extendedOperation(InitialLdapContext.java:164)
  </code></pre>
  
  <p>I use the following code:</p>
  
  <pre><code>bindEnv.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
  bindEnv.put(Context.SECURITY_AUTHENTICATION, "simple");
  bindEnv.put(Context.REFERRAL, "follow");
  bindEnv.put(Context.PROVIDER_URL, "ldaps://ldap.server.com:636");    
  bindEnv.put("java.naming.security.principal", "#BIND_DN#");
  bindEnv.put("java.naming.security.credentials", "#BIND_PASS#");
  LdapContext bindCtx = new InitialLdapContext(bindEnv, null);
  // So far O.K
  StartTlsResponse tls = (StartTlsResponse) bindCtx.extendedOperation(new StartTlsRequest()); 
  // Exception!!!
  tls.negotiate();
  </code></pre>
  
  <p>I tried it with "ldap://" instead of "ldaps://" but got the same response.<br>
  Is it a certificate issue? Or is there anything I am missing in the code?</p>
  
  <p>Thanks </p>