ldapsearch -b "dc=me,dc=com" -h 192.0.2.200 -p 3269 -D asg2@me.com -W "(&(ObjectCategory=person)(objectClass=user)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(memberOf:1.2.840.113556.1.4.1941:=CN=grpMattermost,CN=Users,DC=me,DC=com))"

I'm sorry my Russian. I'm using Google Translate :(. (I'm from Spain).
Прошу прощения за мой русский язык. Я использую Google Translate :(. (Я из Испании)

Hello @AlvaroSed
No hablo español, lamentablemente.
Do you speak English?

Hi, Yes, a little bit. I apreciate your effort. :)

I can also use google translate if it's more easy for you to use your native Russian language.

I'm pretty okay with English, so most other people on this chat do (it's ugly, but biggest wealth of IT info is in English only).
Okay, let's try to debug the whole thing.
1. Use openssl s_connect - this allows you to check whether the connectivity exists.
2. If port is not being listened on, then try to use port 636 (this is an official TSL-secured  couterpart of port 389).

Just to note - port 3269 is a Global Catalog, i.e. Forest in terms of AD (when more than one domain exists), so I wonder if your AD installation listens to it at all.

yes, every AD server with a valid certificate is listen on 3269.

I can connect to 3269 using ldp.exe from another windows server.

I will use openssl s_connect in few minutes.

Okay, this makes perfect sense.
Your example uses Linux server and ldapsearch.
Have you managed to connect to that port with

openssl s_client connect <yourhost> <yourport>

?

Afaik its openssl s_client -connect <host>:<port> and maybe some more options

Type error. I corrected it. https://pastebin.com/gN6Z2Sfx

same result using the FQDN name of the DC

I will use stunnel and ldap 3268. https://christopherkeslar.wordpress.com/2013/07/17/performing-a-secure-ldap-query-using-stunnel/

it worked like a charm. :) stunnel client on Linux, stunnel server on windowsDC, pointing against localhost:3268.

Комрады, подскажите годную "админку" для LDAP.
Сейчас прямо всё в начале, юзеры разнесены везде локально, в качестве сервера выбираю ReOpenLDAP, админка к нему FusioonDirectory. Я пока только смотрю, что появилось новое за последнее время, давно не следил за проектами по LDAP.

Конечная задача - дать клиентам OpenID/OAuth, хранить всех в едином source of truth.
Понравились ещё фичи плагонов FusionDirectory, но не вдавался в подробности имплементации.

freeipa ^_^

семь бед, один ответ :))))

ИМХО, лучше FD и нету ничего.