Symptom and Root Cause
A mapp View application using mapp UserX centralized user management establishes a connection to the Active Directory server but rejects every AD login, while local mapp UserX accounts log in normally. The B&R logger reports error -1061091324: "Error establishing the connection to MpUserX", and the AD side sees an incomplete request from the application — meaning transport is up but the authentication exchange fails. In the reported case, the environment was mapp Services 5.24.5 with Automation Studio 4.12, the AD was changed to LDAPS on port 636, certificates matched, the clock was NTP-synchronized, and the MpServer library was present — yet the error persisted because the customer AD still relied on unencrypted LDAP.
mapp Services Version Constraint: LDAP vs LDAPS
The decisive constraint is the mapp Services version. mapp Services 5.x does not support unsecured LDAP — only secured LDAPS. If the domain controller only accepts unencrypted LDAP on port 389 and the site cannot be changed to LDAPS, the function is simply not available in 5.x; the only resolution is to upgrade to mapp Services 6.x, which supports nearly all LDAP communication flavors, including unencrypted communication. Conversely, if you stay on 5.x, the AD must be switched to LDAPS on port 636.
| Scenario | mapp Services 5.x | mapp Services 6.x |
|---|---|---|
| LDAP, port 389, no certificate | Not supported (login fails) | Supported |
| LDAPS, port 636, root CA certificate | Supported | Supported |
Configuration Checklist for LDAPS on mapp UserX
When running LDAPS, the following items must all be correct; any single miss produces the same connection failure:
- Set the Authentication Mode to "MpUserX" in the mapp View configuration and confirm the OPC-UA System is set to "on" in the PLC configuration.
- Import the root authority certificate of the AD server (file extension .pem, .cer, or .crt) via AccessAndSecurity > CertificateStore > ThirdPartyCertificates > SoftwareCertificates, then reference that certificate and port 636 in the MpUserX configuration. The certificate name in the project must match the server certificate.
- Log in with a fully qualified identity: either the SAMAccountName form "DOMAIN\user" (backslash before the username) or the UPN form "[email protected]". mapp UserX centralized user management requires one of these two formats.
- If the MpUserX Active Directory Host is a fully qualified domain name (e.g. PDC-AMI-01.example.net), the PLC must be able to resolve it — configure DNS servers in the CPU configuration. To eliminate DNS as a variable, point the Host at the server's direct IP address instead.
- Keep the PLC clock synchronized with the site NTP server; certificate validation is time-sensitive.
For the complete step-by-step procedure, follow the "Active Directory user management in mapp UserX" use case in the B&R Online Help. Note that this checklist assumes LDAPS; if diagnostics (frame capture or AD logs showing an incomplete request) reveal the server is actually terminating plain LDAP on 389 and the site forbids LDAPS, no amount of project-side configuration will fix it on 5.x — upgrade to mapp Services 6.x.
FAQ
What does B&R error -1061091324 mean in mapp View?
It means the mapp View login widget could not establish the connection to MpUserX. Verify that Authentication Mode is set to "MpUserX", the OPC-UA System is "on" in the PLC configuration, and the MpServer library is added to the project.
Does mapp Services 5.x support unencrypted LDAP on port 389?
No. mapp Services 5.x supports only secured LDAPS (port 636 with an imported root CA certificate). For unencrypted LDAP on port 389, upgrade to mapp Services 6.x, which supports unencrypted LDAP communication.
How do I configure the certificate for LDAPS Active Directory in mapp UserX?
Import the AD server's root authority certificate (.pem, .cer, or .crt) under AccessAndSecurity > CertificateStore > ThirdPartyCertificates > SoftwareCertificates, then set port 636 and select that certificate in the MpUserX configuration. Log in as DOMAIN\user or [email protected].
