LDAP Newbie: javax.naming.NameNotFoundException: [LDAP: error code 32 - 0000208D: NameErr: DSID-031522C9, problem 2001 (NO_OBJECT)

Question

Hi,
I am getting the following error when I try to do a search on an ldap (AD LDS) database:
javax.naming.NameNotFoundException: [LDAP: error code 32 - 0000208D: NameErr: DSID-031522C9, problem 2001 (NO_OBJECT), data 0, best match of:
'DC=AppPartFE,DC=com'
]; remaining name 'cn=Users,dc=AppPartFE,dc=com'
at com.sun.jndi.ldap.LdapCtx.mapErrorCode(Unknown Source)
at com.sun.jndi.ldap.LdapCtx.processReturnCode(Unknown Source)
at com.sun.jndi.ldap.LdapCtx.processReturnCode(Unknown Source)
at com.sun.jndi.ldap.LdapCtx.searchAux(Unknown Source)
at com.sun.jndi.ldap.LdapCtx.c_search(Unknown Source)
at com.sun.jndi.toolkit.ctx.ComponentDirContext.p_search(Unknown Source)
at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(Unknown Source)
at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(Unknown Source)
at javax.naming.directory.InitialDirContext.search(Unknown Source)
at Test.<init>(Test.java:70)
at Test.main(Test.java:118)
I can bind successfully using either the userPrincipalName (UPN) or the Distinguished Name (DN), however my search is failing.
It is almost as if I am connected to the db tree at the wrong place.  Do I need a different search scope?
I appreciate any assistance you can provide.
Here is my code:
import java.util.*; 
import static java.lang.System.err;
import javax.naming.Context;
import javax.naming.NamingEnumeration;
import javax.naming.NamingException;
import javax.naming.directory.DirContext;
import javax.naming.directory.SearchControls;
import javax.naming.directory.SearchResult;
import javax.naming.ldap.InitialLdapContext;
import javax.naming.ldap.LdapContext;
public class Test 
public Test() 
  Properties prop = new Properties(); 
  prop.put("java.naming.factory.initial", "com.sun.jndi.ldap.LdapCtxFactory"); 
  prop.put("java.naming.provider.url", "ldap://MyHost.Mydomain.labs.CompanyX.com:50004");
  String strProviderUrl = "ldap://MyHost.Mydomain.labs.CompanyX.com:50004";
  // Can successfully bind with the userPrincipalName in AD LDS
  //prop.put("java.naming.security.principal", "[email protected]");
  // Can successfully bind with Distinguished Name
  // Note: the string is case insensitive and embedded blank after a comma is not a problem
   prop.put("java.naming.security.principal", "cn=tst0001,cn=Users,dc=AppPartFE,dc=com"); 
  prop.put("java.naming.security.credentials", "password"); 
  try { 
    LdapContext ctx = new InitialLdapContext(prop, null); 
    System.out.println("Bind successful");
//I am successful to this point....
   //now try doing a search on another user
     String strFilter = "(&(objectClass=userProxy)(sAMAccountName=tst0001))";
    SearchControls searchControls = new SearchControls();
    searchControls.setSearchScope(SearchControls.SUBTREE_SCOPE); //works with object class=* to find top partition node
    NamingEnumeration<SearchResult> results = ctx.search("cn=Users,dc=AppPartFE,dc=com", strFilter, searchControls);
    SearchResult searchResult = null;
    if(results.hasMoreElements()) {
         searchResult = (SearchResult) results.nextElement();
        //make sure there is not another item available, there should be only 1 match
        if(results.hasMoreElements()) {
            System.err.println("Matched multiple users for the accountName");
  catch (NamingException ex) { 
    ex.printStackTrace(); 
public static void main(String[] args) 
  Test ldaptest = new Test(); 

Answer 1

Because you are specifiying a base distinguished name in your ldap url, the ldap context will be rooted at that context and all subsequent objects will be relative to that base distinguished name.//connect to my domain controller
String ldapURL = "ldaps://rhein:636/dc=bodensee,dc=de";andString userName = "CN=verena bit,OU=Lehrer,OU=ASR,DC=bodensee,DC=de";results in an fully distinguished name of:CN=verena bit,OU=Lehrer,OU=ASR,DC=bodensee,DC=de,dc=bodensee,dc=deEither specify your ldap url asString ldapURL = "ldaps://rhein:636";and leave your username as is, or specify the user object relative to the base distinguished name in the ldapurlString userName = "CN=verena bit,OU=Lehrer,OU=ASR";