AD Provisioning throws "ENTRY_EXISTS"

Question

Hi,
For one of the AD Provisioning Tasks for a User errored out with the following:
The Error:
=========
DEBUG 10:03:07,140, RMICallHandler-343 OIMCP.ADCS - tcADUtilLDAPController::createObject() Enter
*ERROR 10:03:07,182, RMICallHandler-343 OIMCP.ADCS - The error occured in tcADUtilLDAPController::createObject():[LDAP: error code 68 - 00002071: UpdErr: DSID-030502F7, problem 6005 (ENTRY_EXISTS), data 0*
*^@]*
*ERROR 10:03:07,182, RMICallHandler-343 OIMCP.ADCS - cn=XXXX XXXXXX already exists:[LDAP: error code 68 - 00002071: UpdErr: DSID-030502F7, problem 6005 (ENTRY_EXISTS), data 0*
*^@]*
DEBUG 10:03:07,182, RMICallHandler-343 OIMCP.ADCS - tcADUtilLDAPController::disconnect() Enter
DEBUG 10:03:07,183, RMICallHandler-343 OIMCP.ADCS - tcADUtilLDAPController::disconnect() Exit
DEBUG 10:03:07,183, RMICallHandler-343 OIMCP.ADCS - tcUtilADTasks::createUser() Exit
Apparently, when I searched for the user with the "cn=XXXX XXXXXX", it returned four users.
Also I found that Martin told this in another thread:
*"Both samaccountname and cn needs to be unique. (post AD 2000)"*
So, it looks like -> When it tries to create user, it is searching for a user with samaccountname and cn, it already found one. So it is not creating.
Temporariliy I am creating a user with the "uid=user_id" field in AD, then I am trying to run Target Recon to link.
Is it an accpetable practice? anybody has done this? any insights, ideas are welcome.
Regards
Vijay Chinnasamy

Answer 1

You got to make sure that your AD samaccountnames and cns are unique (cn needs to be globally unique from AD 2003 and forward)
This can be done either through recon of AD information and checking against that in prepop or by implementing a small JNDI routine at prepop. (http://iamreflections.blogspot.com/2010/08/manage-ad-with-jndi-demo-tool.html)
Best regards
-Martin