Ldap – AD LDS cannot connect to port 389

3 questions:

1. Can you query port 389/tcp from a computer on the same LAN with the LDAP server?
2. Is the OpenVPN server the "firewall" between those lans, or does a third gateway exist? What are the operating systems for these devices?
3. On the LAN where the LDAP server sits can you setup a machine and run a netcat listener on port 389/tcp ? If so, does the connection reset immediately or not?

I can tell you how to do this (and I do below) but I first want to make a run at telling you about the cons.

The core issue is that AD domains are not the same thing as ADLDS. While the core code base is the same (ldap head, storage, replicator, ...) the protocol suite offered on top is different. And this is where it will get you. Many would say that if you're running your app on Windows, using pure LDAP binds as a form of auth is not ideal...using Windows APIs (ex: LogonUser) is a far better path. And this sort of dependency will always fail against LDS as it is only the LDAP core, not the rest of the protocol suite.

That said, many things do work the same. And so you can create users in LDS, so long as you import the user schema extension. This used to ship with the LDS product itself (ms-user.ldf or something like this) so search for *ldf files on your disk and you should find it kicking around. Even when you do this, however, not all tools will work. Tools like the one above might or might not, I honestly can't remember anymore. It will be a semi-random set. I predict you will never be fully satisfied.

This is not to say your dev effort can't be successful...I have done exactly what you are doing. You just will need to learn to live w/o the full toolset. LDP and adsiedit will soon become your friends.