title: Tomcat Active Directry authentication
body: <p>I'm trying to migrate a Tomcat webapp from Tomcat 6 to 9. This app needs to authenticate users against  AD, which it successfully did in the old instance for years. The JNDI realm settings that worked on the old server are:</p>
  
  <pre><code> &lt;Realm className="org.apache.catalina.realm.JNDIRealm"
          connectionURL="ldap://ourIP:389"
          alternateURL="ldap://ourIP:389"
          connectionName="cn=ourService Account,cn=Users,dc=ourDomain,dc=lan"
          connectionPassword="ourServiceAcctPW"
          referrals="follow"
          userBase="ou=ourOU,dc=ourDomain,dc=lan"
          userSearch="(sAMAccountName={0})"
          userSubtree="true"
          roleBase="dc=ourDomain,dc=lan"
          roleName="name"
          roleSearch="(member={0})"
          roleSubtree="true"
        /&gt;
  </code></pre>
  
  <p>When I apply this config to server.xml in the new version I get the following error:</p>
  
  <p>javax.naming.PartialResultException [Root exception is javax.naming.CommunicationException: ourDomain.lan:389 [Root exception is java.net.ConnectException: Connection refused (Connection refused)]]</p>
  
  <p>It appears that Tomcat is ignoring the connectionURL parameter. I have verified that the new server can authenticate against AD using ldapsearch.</p>
  
  <p>I am thoroughly perplexed and would greatly appreciate some guidance.</p>