HR sync to LDAP - specify destination OU?

Hi all,
<b>Note</b>: We are not using NetWeaver IdM on my project, so the following refers only to tools available in NetWeaver ABAP+Java 7.0. The HR - LDAP sync I talk about has been around since R/3 4.7.
I am configuring a scenario to synchronise employees from HR to LDAP (Active Directory in this case). The company's AD instance has several top-level OUs containing users, and I want new users to be created in another top-level OU (e.g. OU=NewUsers,dc=company,dc=com).
As standard in transaction LDAP, I can specify the LDAP server to use OU=NewUsers, but then existing users only get synchronised if they are underneath OU=NewUsers (i.e. users in other top-level OUs fdo not get synced).
I need existing users to be synchronised if they exist anywhere in the directory, and currently the only way to do this is to specify the LDAP server as dc=company,dc=com, which means that all new users get put in the top of the directory tree instead of in OU=NewUsers.
Can anyone tell me how to set up HR-LDAP sync so that new users get put in OU=NewUsers but all users in other OUs still get synced?
Best regards,
Darren

Hi Frank,
Yes, we are moving the users to other locations afterwards. The NewUsers OU is the place where IT look for newly created users - once the users are given email addresses etc by IT then they are moved to the correct OU. Synching after the move is no problem in principle because the SAP sync job does a search based on user ID over the whole subtree first.
Unfortunately there is no connection between the HR org structure (hierarchical) and the AD OU structure, which is geographical in our case.
It looks like we may have to go with the option of creating new users at the top of the AD tree so that the subtree search for synching will work. This is a shame, because we would rather put new users tidily away in their own OU.
Cheers,
Darren

Similar Messages

Destination disabled. []: [CrystalEnterprise.Ftp]. Please note the name of the job server used for your request and contact your system administrator to make sure the specified destination is enabled. (FWB 00031)

Hi
In BO 4.0 SP 9 when a administrator tries to schedule a report via CMC there is no error
But when a user schedules a report and the destination is FTP location -> Use default settings he gets following error
Destination disabled. []: [CrystalEnterprise.Ftp]. Please note the name of the job server used for your request and contact your system administrator to make sure the specified destination is enabled. (FWB 00031)
There is only one Job Server and the destinations are enabled in it
There is no Job server for Crystal Reports Job Server
Do i need to create it and how.

Please check if you have proper rights to schedule to FTP. You can create a new job server, whenever you schedule it, there are multiple job servers, it will handle based on the load. But it is not mandatory, depends on the load.

Sync SUN Ldap with Windows

Hi Folks,
We have SUN Java Directory Server 5.2 / MS Windows 2003 server Active Directory. And we have successfully configured Synchronization for Windows. Both LDAP are hierarchical structure.....e.g ou=poeple,ou=unit,ou=dept,o=organization...etc
Now we have to move SUN Java Directory Server 5.2 to flat structure where all the user are under one container (Flat Structure). BUT our Active Directory is still hierarchical....My question is is there any way we can sync Flat LDAP to hierarchical Active Directory...???? or create dynamic sync list.....???
Any thought/suggestion.....ll much appreciate....
Kind Regards,

Hi,
I tired once to create two SULs which share the same base DN on the Sun Directory Server side but each SUL remove the users from the other one as they don't exist in their base DN on AD side.
In our case, the synchronization flows from AD to Sun DS. And in the SUL the users from suborganisations of the AD base DN are synchronized into the Sun DS base DN like this:
samaccountname=foo1,ou=bar2,o=users,dc=myorg (AD) -> uid=foo1,ou=people,dc=myorg (DS)
samaccountname=foo2,ou=bar2,o=users,dc=myorg (AD) -> uid=foo2,ou=people,dc=myorg (DS)
So if you select the dc=myorg as base DN for the AD side you will have hierarchical to flat replication from AD to DS. And if you don't want to synchronize everybody, you can still put a filter in the SUL.
If you want to synchronize the other way (flat to hierarchical), I have no idea if it's possible.
Regards,
Vincent

No javax.jms.Destination found at the specified destination-location (jms/

i m trying to create new message driven bean
i made entry in ejb-jar like this
<message-driven>
<description>Message Driven Bean</description>
<display-name>UploadMultiFilesMDB</display-name>
<ejb-name>UploadMultiFilesMDB</ejb-name>
<ejb-class>com.tcs.sgv.fms.messagedrivenbeans.impl.UploadMultiFilesMDB</ejb-class>
<transaction-type>Bean</transaction-type>
<acknowledge-mode>Auto-acknowledge</acknowledge-mode>
<message-driven-destination>
<destination-type>javax.jms.Queue</destination-type>
</message-driven-destination>
<ejb-ref>
<ejb-ref-name>ejb/CommonUtility</ejb-ref-name>
<ejb-ref-type>Entity</ejb-ref-type>
<home>com.tcs.sgv.common.entitybeans.CommonUtilityHome</home>
<remote>com.tcs.sgv.common.entitybeans.CommonUtility</remote>
<ejb-link>CommonUtility</ejb-link>
</ejb-ref>
<ejb-ref>
<ejb-ref-name>ejb/DmsUtility</ejb-ref-name>
<ejb-ref-type>Entity</ejb-ref-type>
<home>com.tcs.sgv.dms.entitybeans.DmsUtilityHome</home>
<remote>com.tcs.sgv.dms.entitybeans.DmsUtility</remote>
<ejb-link>DmsUtility</ejb-link>
</ejb-ref>
<resource-ref>
<res-ref-name>jms/QueueConnectionUploadMultiFiles</res-ref-name>
<res-type>javax.jms.QueueConnectionFactory</res-type>
<res-auth>Container</res-auth>
</resource-ref>
</message-driven>
in orion-ejb-jar entry is
<message-driven-deployment name="UploadMultiFilesMDB"
connection-factory-location="jms/QueueConnectionUploadMultiFiles"
destination-location="jms/UploadMultiFiles"
max-instances="0" min-instances="0"/>
in jms.xml entry is like
<queue name="UploadMultiFilesQueue" location="jms/UploadMultiFiles">
<description>Upload Queue</description>
</queue>
<queue-connection-factory location="jms/QueueConnectionUploadMultiFiles" />
but still it is giving me error like ....
No javax.jms.Destination found at the specified destination-location (jms/UploadMultiFiles) for MessageDrivenBean UploadMultiFilesMDB
Please do help
thanks in Advance

The files orion-ejb-jar and jms.xml are not defined in JMS or Java EE, so unless there are any Orion experts on this forum you may need to ask in a forum specific to your application server.
Nigel

Specifying destination and folder strudture when restoring

I am moving from PSE 11 on my old computer to PSE 13 on a new computer. On the old computer I created a catalog backup. Photos are in various folders in c:\users\rrr\pictures. When I restored the catalog in the new computer with PSE 13 after specifying that the folder structure be retained, it put the photo folders in c:\users\rrr\my pictures\users\rrr\pictures.
This is a pretty cumbersome path. Basically it duplicates the path. What I would like is to have the files restored to c:\users\rrr\pictures, like it was on the old computer. I can't select c: drive as the destination folder to restore. I get a restore message saying "you do not have access to write to the folder you have selected." I can create a top level folder, such as c:\photos, and restore to that. I assume it will include subpaths in that folder to users\rrr\pictures. An improvement, but still lots of excess. Also, I assume the extra files addressed in the next paragraph will be created.
Also created by the restore in c:\users\rrr\my pictures are folders for My Catalog, My Catalog 1 and Other Photos. Other Photos is empty. My Catalog and My Catalog 1 have a number of files apparently created by Adobe. Can I delete these folders and files?
Thanks.
Adobe could make migration from one computer to another much easier.

Bobh123us a écrit:
Adobe could make migration from one computer to another much easier.
As a matter of fact, that's Microsoft who are the culprits.
To keep things short, Microsoft thought long ago that it was a good idea to show the folder tree with shortcuts for 'documents' and 'images' instead of showing the full path in 'documents and settings'. For most users that's good because the folder tree looks simpler. Some users are puzzled because they can see both ways of showing the folder tree, with or without shortcuts. And they think everything is duplicated...
At that point, Adobe followed the shortcut idea and put the default location for the photo library in the 'My images' default folder.
Then Microsoft changed the default images structure...
That explains you can't get back to the old structure after a restore to the new system.
Being an old user since the beginning of the DOS operating system, I have never followed the suggested 'My images' suggestion and I have always created my own master folder with adequate permissions.
Note that the result of the restore is often to create intermediate subfolders with nothing in them. If you have a structure like C:\A\B\C\D and if there is nothing in B and C, you can move the D folder directly under A with all the subfolders of D. Use the drag and drop method in the 'Folders' panel.

Can you make the iTouch sync with only specified folder(s) on your PC?

I share a PC with my girlfriend and basically when I sync I only want to sync with my tunes, pictures etc and not her's as well.
Is there a way to do this?
Thanks in advance for any help you can offer me.
Darren

hold shift when you are loading itunes up, and you will be able to create a separate library.
when you load up itunes again, it will load up the last library opened, to get back to the other one you need to repeat this process and open the other one.

Javax.jms.Destination found at the specified.....

I am making a Message Driven EJB, but i get this error when i try to run it."javax.jms.Destination found at the specified destination-location (jms/theTopic) for MessageDrivenBean MessageDrivenEJB".I am using JDeveloper 9.0.5
My ejb-jar
<enterprise-beans>
<message-driven>
<description>Message Driven Bean</description>
<display-name>MessageDrivenEJB</display-name>
<ejb-name>MessageDrivenEJB</ejb-name>
<ejb-class>mypackage1.MessageDrivenEJBBean</ejb-class>
<transaction-type>Container</transaction-type>
<acknowledge-mode>Auto-acknowledge</acknowledge-mode>
<message-driven-destination>
<destination-type>javax.jms.Topic</destination-type>
<subscription-durability>NonDurable</subscription-durability>
</message-driven-destination>
<resource-ref>
<res-ref-name>TopicFactory</res-ref-name>
<res-type>javax.jms.TopicConnectionFactory</res-type>
<res-auth>Container</res-auth>
</resource-ref>
</message-driven>
</enterprise-beans>
<assembly-descriptor/>
</ejb-jar>
My orion-ejb-jar
<orion-ejb-jar>
<enterprise-beans>
<message-driven-deployment name="MessageDrivenEJB" destination-location="jms/theTopic" connection-factory-location="jms/theTopicConnectionFactory">
<resource-ref-mapping name="The Topic" location=" jms/theTopic"/>
</message-driven-deployment>
</enterprise-beans>
<assembly-descriptor>
<default-method-access>
<security-role-mapping/>
</default-method-access>
</assembly-descriptor>
</orion-ejb-jar>
and my jms.xml
<topic name="The Topic" location="jms/theTopic">
<description>A dummy topic</description>
</topic>
<topic-connection-factory name="jms/theTopicConnectionFactory" location="jms/theTopicConnectionFactory">
<description>A dummy topic connection factory</description>
</topic-connection-factory>
I hope that there i somebody who can help.. :-)

The files orion-ejb-jar and jms.xml are not defined in JMS or Java EE, so unless there are any Orion experts on this forum you may need to ask in a forum specific to your application server.
Nigel

LDAP user sync in GRC.

Hi Experts,
We are trying to configure LDAP AD on a GRC system(sp 13).
Done all the required configuration and field mapping.
Connector is working and able to login to LDAP server with system user.
LDAP connector name is same as LDAP Server name.
Base Entry is maintained in LDAP tcode for LDAP server.
But, not able to perform repository sync,showing error message as "USER ADAPTER IS EMPTY".
Not mentioned attributes for the connector in "maintain connector settings", do i need to maintain these to run repository sync.
Please suggest,
Thank you in advance.....

Dear Sai,
please follow the instructions below:
1. LDAP connector name should be identical as LDAP Server name. Please check if this is same?
2. What string is used while searching users in LDAP. Execute LDAP tcode and find the users with default string. for example ...(&(objectclass=*)(samaccountname = a*)). If you have some different string to serach users, then we need to find out from LDAP team if they can set your searchable string as default.
3. Check whether Base Entry is maintained in LDAP tcodes for your LDAP server. If not, maintain that as well.
4. Refer to SAP Note "1755767 - Repository object sync from LDAP fails".
Following these steps will ensure that you have all the configuration as per recommendations.
Regards,
Alessandro

LDAP user sync - CanonicalName is null

Hi!
I need to setup user sync from LDAP to LiveCycle. It seems to be very intuitive and easy, but ...
I can connect LDAP well, but no users are transfered. I found the LDAP query was OK and LDAP response was OK. LiveCycle complains about:
This record is missing a required attribute and cannot be used. Specifically CanonicalName is null. Common Name: Adam Agama
The LDAP entry is:
dn: cn=Adam Agama, ou=Users, o=My org,c=CZ
o: My org
givenName: Adam
sn: Agama
ou: Users
mail: [email protected]
userCertificate;binary:: MIIIODCCB....
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: opencaEmailAddress
objectClass: pkiUser
uid: [email protected]
cn: Adam Agama
What does the LiveCycle mean by CanonicalName? I have not seen such an attribute anywhere.
Any help would be appreciated.
--- Jaroslav Pavlicek

I reply myself:
When configuring LDAP connection, there are predefined templates for various LDAP types: SunOne, ActiveDirectory, IBM Domino, ...
You probably must select one. If you don't, "Unique identifier" field would not appear on following page and you are not allowed to edit it. And also you would have no idea, what the Unique identifier is expected to be :)

Is it possible to sync 'act_key' to LDAP

Has anyone attempted to synchronize the OIM user attribute 'act_key' (display name = 'Organization') to LDAP.
We have LDAP Sync configured and this specific attribute is not getting synced to LDAP by default. I wanted to find out if we can use the procedure documented as "Synchronizing User-Defined Fields Between Oracle Identity Manager and LDAP" at
http://download.oracle.com/docs/cd/E14571_01/doc.1111/e14308/conf_mangmnt.htm#BABEHGAD
to sync up this user attribute to LDAP.
I know that OIM also has an additional user attribute called "LDAP Organization" which does get synced to LDAP. Can anyone help explain why OIM has these two attributes (act_key and 'LDAP Organization') that both seem to serve the same purpose.
Thanks
Aspi Engineer

ACT is part of the OIM database. It is the primary table identifying organizations within OIM. ACT_KEY links the USR and ACT table to identify which organization a user is a member of. It's not something that can be removed, so in order to integrate with LDAP as well, the need for an LDAP organization is required too.
-Kevin

Security Issue - LDAP Authentication and supply of empty passwords

Security Issue with OC4J and JAZN LDAP Realm
Product Versions:
OC4J 9.0.3
Infrastructure 9.0.2.1
When using form based authentication or basic authentication in a WebApp, OC4J authenticates any existing user that as a password defined with an empty password.
Example: If you have a user with the username "user" and password "password". In the login of the WebApp if you supply only the username, OC4J authenticates the user.
Notes:
- If we supply a wrong password we are not authenticated
- If we supply the correct password we are authenticated.
To reproduce the problem, I have used Oracle callerInfo jazdemo, configured to used the JAZN LDAP Realm named sample_subrealm, that is installed with 9ias infrastructure
Notes: If I use JAZN XML Realm everything works as expected.
Bruno Antunes
Java Software Engineer

Jeremy - You'd have to use database authentication to achieve that. Create a DAD without specifying a username/password and change the app's current authentication scheme to DATABASE. Then users can login using their database account credentials. LDAP won't be used when you do this so you'll have to keep the database account passwords in sync with LDAP somehow if that's important.
Scott

Jabber for Windows and Ldap Contacts without CUPC license

Dear Sr:
It is possible to add a user on ldap as a jabber contact WITHOUT assigning a CUPC license to the user?
The idea is that some users on the ldap don't have jabber but we should be able to add them as a contact AND we dont want to use jabber licenses for those users or have Presence server to load balance those users.
We can add Microsoft contact as jabber contact with no issues...
Thanks

LDAP Authentication of End Users in CUCM is strongly recommended for CUPC/Jabber. When you login to CUPC/Jabber it authenticates against CUCM. If LDAP doesn't have the same password (i.e. CUCM isn't synced from LDAP) the client won't be able to do LDAP queries if using BDI. This is because it re-uses the same credentials when it attempts to bind to LDAP. If Jabber is configured for EDI, which is only even possible on Jabber for Windows running on domain-joined workstations, then this is not as critical since it would use the Windows ADSI API in the context of the logged-in user. Using EDI exclusively would rule out Jabber for Mac, iOS, Android, and Windows on a non-domain joined workstation though.
As for usernames: You can continue to use employeeNumber if you wish. You'll need to ensure that the jabber-config.xml file maps the username to this value for everything to work. Note that this will be their XMPP URI: [email protected] so be sure that you're comfortable with employee numbers being public.
Please remember to rate helpful responses and identify helpful or correct answers.

LDAP user no longer able to log in

We have CQ 5.3 set up using LDAP authentication. We have one user who has been using CQ with her AD Userid/password for over a year with no issues, but she came in one day and now it's saying her user id and password don't match.
We've tried on multiple different instances of CQ and she gets the same message every time. She is able to log into other applicaitons that use LDAP for authentication just fine. We have tried resting CQ to see if that resolves the issue and it hasn't. I originally thought it was some sort of issue with her LDAP account, but because she can log into other apps, I'm wondering if not? Or maybe there WAS an issue with her account, but it was resolved (she thought maybe her account was locked, so she ran an unlock procedure), but CQ just hasn't caught up to that fact? This started happening a week ago.

Hi Jennifer,
Have you tried running a manual LDAP User sync for the single user (http://localhost:4502/crx/config/ldap.jsp)? Since the user can login to other systems via LDAP, the problem is most likely with their account in CQ. Maybe try deleting their account in CQ and re-creating/re-sync via LDAP User sync.
Hope this helps.
Ron

Error while creating the HTTP client with destination

Hi ,
I am getting this error while connecting to https location on receiver channel . The below error i am getting in SXMB_moni
Error while creating the HTTP client with destination
The receiver party is doing some security setting on there end and for that purpose we have provided the external IP address to them , after that we are getting the above error.
We have already installed the client certificate on our staging server , and have done the correct setting in SM59 and channel.

Check few things..
1) I believe you use specify destination for the addressing type field in the comm channel. If so make sure you entered valid target URL address in the SM59 of type http destination.
2) Check the validitity of the certificate. You can import the certificate both in java and abap stack.
3) Make sure certificate is installed as expected.
4) Send the request and talk to the target system and check what error information they get in their log related to ssl.

How to populate/sync IDM accounts (Lighthouse accounts) in a directory

We have a specific need to populate a directory with the IDM Lighthoust account information. e.g Name, email, type='AdminRole', type='ObjectGroup', etc.
Again, we don't want to sync IDM with what is added/changed in the directory, we want to sync the directory with what is added/changed to accounts in IDM.
Any high-level thoughts on how we should approach this?
IDM v. 8.1 SunOne Directory 6.x

Hi
I think it is going to be pretty simple. Unless you do an Active Sync with LDAP (with retro change log plugin enabled) or do a recon you would not get the attributes of LDAP back in IDM.
However everytime you change something for the user in IDM ... all you need to take care is that the DIRECTORY is selected in the "resources to be updated" should complete your requirement.

HR sync to LDAP - specify destination OU?

Similar Messages

Maybe you are looking for