Symptoms

When using a picker control the following error was being thrown:

A referral was returned from the server

Additionally, when accessing workspace the following error was had:

An error has occurred
Please contact your administrator.

Error:
Initialization failed before PreInit: Unable to establish a secure connection with the Active Directory Server.

Possible Causes
-the ADConnectionString in the K2 Workspace web.config may have an incorrect LDAP path.
-the physical connection to the Active Directory Server might be down.
-please review log files for more information.

 

Diagnoses

Cracking open the web.config for Workspace unveiled four unique LDAP paths. Each path was tested by shooting it through ADSTester tool and one of the four failed.

The root cause here was that the 3rd party AD admin team took down one of the domains but didn't bother telling the K2 admins about it.
 

Resolution

That failure of a connection string was commented out and after a K2 service restart workspace was working as expected.

The referral error was still present (but tied to the bad string) and a refresh of the AD services instances allowed the picker controls to resume.