LDAP: error code 53 - 0000055E: SvcErr: DSID-031A0FC0, problem 5003

Hi,
I Am trying to add an User(whose Primary Group is'Domian users') to a Group called "CN=DS_Disabled_IG,OU=Common,OU=Access Management,OU=Security Groups,OU=BAND,dc=something,DC=com" by using the below code:
LdapContext ctx = null;
ctx = new InitialLdapContext(env, null);
String groupDn = "CN=DS_Disabled_IG,OU=Common,OU=Access Management,etc....";
String completeDnOfUser = "This will be the current DN of the user";
ModificationItem[] mods = new ModificationItem[1];
mods[0] = new ModificationItem(DirContext.REPLACE_ATTRIBUTE,
new BasicAttribute("member", completeDnOfUser));
ctx.modifyAttributes(groupDn, mods); ------- line A
At 'line A' exception is being throwed as below:
In Exception catch block [LDAP: error code 53 - 0000055E: SvcErr: DSID-031A0FC0, problem 5003 (WILL_NOT_PERFORM), data 0
javax.naming.OperationNotSupportedException: [LDAP: error code 53 - 0000055E: SvcErr: DSID-031A0FC0, problem 5003 (WILL_NOT_PERFORM), data 0
remaining name 'CN=DS_Disabled_IG,OU=Common,OU=Access Mana etc......'
at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3114)
at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2987)
at goes on ......
But the same code is working for me in Lower environment but not in one of the upper environment.
It would of great help, if anyone can suggest solution on this.

Hi Colin,
I am talking about adding the user to a Disabled Group using the below code :
ModificationItem[] mods = new ModificationItem[1];
mods[0] = new ModificationItem(DirContext.REPLACE_ATTRIBUTE,
new BasicAttribute("member", completeDnOfUser));
ctx.modifyAttributes(groupDn, mods);
But what i suspect here is we should use ADD_ATTRIBUTE instead of REPLACE_ATTRIBUTE. Is that so?
This code success rate in local environment is 70% or 80%(around 70 users passed out of 100 users) but whereas in one of the Upper environment during initial days the same success rate was >70% and then nowadays suddenly it started failing for all the users completely 0%. So I have a confusion here ???
Yes, Domain Users is not a real Ldap group here but what i was conveying here is all created users will be assigned to this group.
Colin, what are those LDP or third party Applications and how useful it will be here??
Regards,
kiran

Similar Messages

LDAP Newbie:    javax.naming.NameNotFoundException: [LDAP: error code 32 - 0000208D: NameErr: DSID-031522C9, problem 2001 (NO_OBJECT)

Hi,
I am getting the following error when I try to do a search on an ldap (AD LDS) database:
javax.naming.NameNotFoundException: [LDAP: error code 32 - 0000208D: NameErr: DSID-031522C9, problem 2001 (NO_OBJECT), data 0, best match of:
'DC=AppPartFE,DC=com'
]; remaining name 'cn=Users,dc=AppPartFE,dc=com'
at com.sun.jndi.ldap.LdapCtx.mapErrorCode(Unknown Source)
at com.sun.jndi.ldap.LdapCtx.processReturnCode(Unknown Source)
at com.sun.jndi.ldap.LdapCtx.processReturnCode(Unknown Source)
at com.sun.jndi.ldap.LdapCtx.searchAux(Unknown Source)
at com.sun.jndi.ldap.LdapCtx.c_search(Unknown Source)
at com.sun.jndi.toolkit.ctx.ComponentDirContext.p_search(Unknown Source)
at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(Unknown Source)
at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(Unknown Source)
at javax.naming.directory.InitialDirContext.search(Unknown Source)
at Test.<init>(Test.java:70)
at Test.main(Test.java:118)
I can bind successfully using either the userPrincipalName (UPN) or the Distinguished Name (DN), however my search is failing.
It is almost as if I am connected to the db tree at the wrong place. Do I need a different search scope?
I appreciate any assistance you can provide.
Here is my code:
import java.util.*;
import static java.lang.System.err;
import javax.naming.Context;
import javax.naming.NamingEnumeration;
import javax.naming.NamingException;
import javax.naming.directory.DirContext;
import javax.naming.directory.SearchControls;
import javax.naming.directory.SearchResult;
import javax.naming.ldap.InitialLdapContext;
import javax.naming.ldap.LdapContext;
public class Test
public Test()
Properties prop = new Properties();
prop.put("java.naming.factory.initial", "com.sun.jndi.ldap.LdapCtxFactory");
prop.put("java.naming.provider.url", "ldap://MyHost.Mydomain.labs.CompanyX.com:50004");
String strProviderUrl = "ldap://MyHost.Mydomain.labs.CompanyX.com:50004";
// Can successfully bind with the userPrincipalName in AD LDS
//prop.put("java.naming.security.principal", "[email protected]");
// Can successfully bind with Distinguished Name
// Note: the string is case insensitive and embedded blank after a comma is not a problem
   prop.put("java.naming.security.principal", "cn=tst0001,cn=Users,dc=AppPartFE,dc=com");
prop.put("java.naming.security.credentials", "password");
try {
    LdapContext ctx = new InitialLdapContext(prop, null);
    System.out.println("Bind successful");
//I am successful to this point....
   //now try doing a search on another user
     String strFilter = "(&(objectClass=userProxy)(sAMAccountName=tst0001))";
    SearchControls searchControls = new SearchControls();
    searchControls.setSearchScope(SearchControls.SUBTREE_SCOPE); //works with object class=* to find top partition node
    NamingEnumeration<SearchResult> results = ctx.search("cn=Users,dc=AppPartFE,dc=com", strFilter, searchControls);
    SearchResult searchResult = null;
    if(results.hasMoreElements()) {
         searchResult = (SearchResult) results.nextElement();
        //make sure there is not another item available, there should be only 1 match
        if(results.hasMoreElements()) {
            System.err.println("Matched multiple users for the accountName");
catch (NamingException ex) {
    ex.printStackTrace();
public static void main(String[] args)
Test ldaptest = new Test();

Because you are specifiying a base distinguished name in your ldap url, the ldap context will be rooted at that context and all subsequent objects will be relative to that base distinguished name.//connect to my domain controller
String ldapURL = "ldaps://rhein:636/dc=bodensee,dc=de";andString userName = "CN=verena bit,OU=Lehrer,OU=ASR,DC=bodensee,DC=de";results in an fully distinguished name of:CN=verena bit,OU=Lehrer,OU=ASR,DC=bodensee,DC=de,dc=bodensee,dc=deEither specify your ldap url asString ldapURL = "ldaps://rhein:636";and leave your username as is, or specify the user object relative to the base distinguished name in the ldapurlString userName = "CN=verena bit,OU=Lehrer,OU=ASR";

LDAP: error code 49 - 8009030C: LdapErr: DSID-0C0903A9, comment: AcceptSecurityContext error, data 534, v1db0^@]

Hello,
What does the following error code data 534 mean?
LDAP: error code 49 - 8009030C: LdapErr: DSID-0C0903A9, comment: AcceptSecurityContext error, data 534, v1db0^@]

Hi,
Thanks for your patience.
The error code 49 related to LDAP is caused by the invalid credentials. Please refer to the following most possible causes.
1. The DN path or password which you have specified for the administrator is invalid. Any of the below will result in this error:
1). Pointed to non-user DN
2). Pointed to a non-existent user, but in existing DN
3). Pointed to non existent DN
4). Pointed to an existing user, but non existing DN
5). Pointed to an incorrect admin DN, uid instead of cn
6). Pointed to a non administrator user
7). Pointed to a valid admin but password is incorrect
2. Could not authenticate the user trying to login. This can be the result of an incorrect username or password, or an incorrect prefix and/or suffix specified in the Settings tab, depending on the type of LDAP/AD system. Could also mean the authentication
type is incorrect.
Best regards,
Ann Zhu

[LDAP: error code 49 - 80090308: LdapErr: DSID-0C0903A9, comment: AcceptSec

I am getting [LDAP: error code 49 - 80090308: LdapErr: DSID-0C0903A9, comment: AcceptSecurityContext error, data 52e, v1db1] when executing ctx.search() command of the below source code:
public void authenticateUser() throws AuthenticationException, NamingException {
Hashtable<String, String> props = new Hashtable<String, String>();
String principalName = "dctestuser1" + "@" + "example1.com";
props.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.dns.DnsContextFactory");
props.put("java.naming.provider.url", "dns://");
props.put(Context.REFERRAL, "follow");
props.put(Context.SECURITY_PRINCIPAL, principalName);
props.put(Context.SECURITY_CREDENTIALS, "admin@123");
props.put("com.sun.jndi.ldap.read.timeout", "90000");
try {
final DirContext ctx=LdapCtxFactory.getLdapCtxInstance("ldap://dc01.example1.com" ,props);
SearchControls ctls = new SearchControls();
ctls.setSearchScope(SearchControls.SUBTREE_SCOPE );
String userReturnedAtts[] = {"cn","member"};
ctls.setReturningAttributes(userReturnedAtts);
NamingEnumeration<SearchResult> answer =
ctx.search("DC=example2,DC=org","(&(objectclass=user)(sAMAccountName=dctestuser2)(userPassword=admin@123))",ctls);
boolean bFound = answer.hasMore();
System.out.println(bFound);
return;
} catch (CommunicationException e) {
Two domains used in this example, example1.com and example2.org exist on separate forests.
This scenario is working fine using the same credentials without any exception when tested with LDP.exe that comes with windows OS.

Same exception is received when execute following search command:
ctx.search("DC=example2,DC=org","(&(objectclass=user)(sAMAccountName=dctestuser2))",ctls);

Error : LDAP Error code 32 - in shared services export operation

Hi everyone !
I m using MS Active Directory in my Shared services for external authentication.
while exporting provisioning for all users against project:applications , it is not working
Trace error is :
2010-05-26 16:43:58,988 Export : Root cause : [LDAP: error code 32 - 0000208D: NameErr: DSID-031001CD, problem 2001 (NO_OBJECT), data 0, best match of:
'OU=NJ - Users,OU=CLI - NJ,DC=cli,DC=ad'
suggestions are highly appreciated
Thank you
Edited by: user11966901 on May 27, 2010 2:43 AM

Below is the solution we got when we had kind of same issue:
Steps To Reproduce:
Install the OIM AD base connector version 9.1.0
Upgrade the Connector to OIM 9.1.0.1 version using Patch 7553764
Provision a user from OIM to AD.
Cause
The OIM 9.1.0.1 patch contains a fix that can handle special characters in the process form. But there is special character like hyphen (-) in Root Context value (for example: 'OU=X-Test OU,DC=mydomain,DC=com' ) inthe IT Resource it causes provisioning to fail.
Solution
In this case the user is being provisioned to a Organization called 'X-Test OU' under the mydomain.com domain in the AD. There is Lookup called 'Lookup.ADReconciliation.Organization' which is populated using the Schedule task called "AD Organization Lookup Recon". This lookup is also used in the AD User
Process Form for populating the Organization Field.
-- To implement the solution, please execute the following steps::
Edit the Root Context value in the IT Resource to point above the OU=X-Test OU organization. So it looks like dc=mydomain,dc=com.
Run the Schedule task called "AD Organization Lookup Recon" by providing dc=mydomain,dc=com value to Search Base parameter in the schedule task. This recon would populate the 'Lookup.ADReconciliation.Organization'.
Now provision a user to AD resource and in the process form selected the OU=X-Test OU as the Organization.
This way the user gets successfully provisioned and gets created under the 'OU=X-Test OU,DC=mydomain,DC=com'
Cheers....!!!

Javax.naming.AuthenticationException [LDAP: error code 49 - 80090308

i am getting a problem in connection.
javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C090334, comment: AcceptSecurityContext error, data 525, vece
plz suggest

satish_dhn wrote:
plz suggesterr code 49 means problem with login credentials.
"525" (between "data" and "vece" ) means user not found.

Javax.naming.OperationNotSupportedException:[LDAP: error code 12-00000057

Hi All,
I getting the below OperationNotSupportedException while searching the LDAP container
"'ou=Subscriptions,ou=BMCMarimba,DC=marimba,DC=bmc-dns,DC=com'".
In our application during the initial search i'm able to search the above container and get the results.But during subsequent search getting the below mentioned error.
javax.naming.OperationNotSupportedException: [LDAP: error code 12 - 00000057: LdapErr: DSID-0C09068F, comment: Error processing control, data 0, vece]; remaining name 'ou=Subscriptions,ou=BMCMarimba,DC=marimba,DC=bmc-dns,DC=com'
     at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3048)\
     at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2934)\
     at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2740)\
     at com.sun.jndi.ldap.LdapCtx.searchAux(LdapCtx.java:1811)\
     at com.sun.jndi.ldap.LdapCtx.c_search(LdapCtx.java:1734)\
     at com.sun.jndi.toolkit.ctx.ComponentDirContext.p_search(ComponentDirContext.java:368)\
     at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(PartialCompositeDirContext.java:328)\
     at javax.naming.directory.InitialDirContext.search(InitialDirContext.java:245)\
     at com.marimba.tools.ldap.physical.LDAPConnectionImpl.getResult(LDAPConnectionImpl.java:901)\
     at com.marimba.tools.ldap.physical.LDAPConnectionPoolImpl.searchWithConnection(LDAPConnectionPoolImpl.java:1369)\
     at com.marimba.tools.ldap.physical.LDAPPagedSearchPR.getPage(LDAPPagedSearchPR.java:402)\
     at com.marimba.tools.ldap.physical.LDAPPagedSearchPR.getPage(LDAPPagedSearchPR.java:238)\
     at com.marimba.tools.ldapsync.util.PageResultEnumeration.getNextPage(PageResultEnumeration.java:159)\
     at com.marimba.tools.ldapsync.policy.core.PolicySync.processNewPolicies(PolicySync.java:351)\
     at com.marimba.tools.ldapsync.policy.core.PolicySync.syncPolicies(PolicySync.java:164)\
     at com.marimba.tools.ldapsync.core.TargetSync.syncTargets(TargetSync.java:163)\
     at com.marimba.tools.ldapsync.core.LDAPDBSync.run(LDAPDBSync.java:617)\
     at java.lang.Thread.run(Thread.java:534)
Any idea why this exception is coming only in the subsequent search.
Any help would be greatly appriciated.
Thanks
Vallinayagam

Hope this question raised long back and no suitable answers provided. I want to share my solution which worked for this problem to all the developers hitting their heads to thier PC :-)
You must use single LDAP connection to retrive all the results.
For example:
If your query returns around 10000 results, best way to get the results is using paging. Let us assume you set the page size to 500. Once you retrieve the first 500 results LDAP Connection will give you cookie which stores the information on last page. We need to set the cookie to future use i.e., for retrieving next page (next 500 results). If the connection to get next page is new/different (can be new instance or retrieved from pool) you will get "javax.naming.OperationNotSupportedException:[LDAP: error code 12-00000057".
So, to avoid this you need to use the same LDAP connection (conext) till you retieve all the results.
Regards,
Nageswara Rao.V

Error resetting AD password LDAP: error code 19

I am getting following exceptions when i try to reset the password of some users in some of my Active directories.
please help me
//set password is a ldap modify operation
               ModificationItem[] mods = new ModificationItem[2];
               String oldQuotedPassword =
                    AD_PASSWORD_QUOTE + oldPassword + AD_PASSWORD_QUOTE;
               byte[] oldUnicodePassword =
                    oldQuotedPassword.getBytes(AD_PASSWORD_ENCODE);
               String newQuotedPassword =
                    AD_PASSWORD_QUOTE + newPwd + AD_PASSWORD_QUOTE;
               byte[] newUnicodePassword =
                    newQuotedPassword.getBytes(AD_PASSWORD_ENCODE);
               mods[0] =
                    new ModificationItem(
                         DirContext.REMOVE_ATTRIBUTE,
                         new BasicAttribute(
                              AD_PASSWORD_ATTRIBUTE,
                              oldUnicodePassword));
               mods[1] =
                    new ModificationItem(
                         DirContext.ADD_ATTRIBUTE,
                         new BasicAttribute(
                              AD_PASSWORD_ATTRIBUTE,
                              newUnicodePassword));
               TR.trace(
                    Trace.LEVEL1,
                    "changeADPassword",
                    "Start reset password for AD ");
               // Perform the update of pasword.
               ctx.modifyAttributes(dnUser, mods);
Unable to changePassword - Reason: com.ibm.swservices.websphere.registry.RegistryException: Could not change AD password. Reason: javax.naming.directory.InvalidAttributeValueException: [LDAP: error code 19 - 00000005: AtrErr: DSID-03190EFF, #1:
     0: 00000005: DSID-03190EFF, problem 1005 (CONSTRAINT_ATT_TYPE), data 0, Att 9005a (unicodePwd); remaining name 'CN=zxx22,OU=Test,OU=Clients,OU=Customer,DC=xxx,DC=xxx'
faultActor: null
faultDetail:
javax.xml.soap.SOAPException: Unable to changePassword - Reason: com.ibm.swservices.websphere.registry.RegistryException: Could not change AD password. Reason: javax.naming.directory.InvalidAttributeValueException: [LDAP: error code 19 - 00000005: AtrErr: DSID-03190EFF, #1:
     0: 00000005: DSID-03190EFF, problem 1005 (CONSTRAINT_ATT_TYPE), data 0, Att 9005a (unicodePwd); remaining name 'CN=zxx22,OU=Test,OU=Clients,OU=Customer,DC=xxx,DC=xxx'
     at com.ibm.ws.webservices.engine.WebServicesFault.makeFault(WebServicesFault.java:156)
     at com.ibm.ws.webservices.engine.providers.java.JavaProvider.invoke(JavaProvider.java:294)
     at com.ibm.ws.webservices.engine.PivotHandlerWrapper.invoke(PivotHandlerWrapper.java:212)
     at com.ibm.ws.webservices.engine.handlers.WrappedHandler.invoke(WrappedHandler.java:61)
     at com.ibm.ws.webservices.engine.PivotHandlerWrapper.invoke(PivotHandlerWrapper.java:212)
     at com.ibm.ws.webservices.engine.PivotHandlerWrapper.invoke(PivotHandlerWrapper.java:212)
     at com.ibm.ws.webservices.engine.WebServicesEngine.invoke(WebServicesEngine.java:255)
     at com.ibm.ws.webservices.engine.transport.http.WebServicesServlet.doPost(WebServicesServlet.java:893)
     at javax.servlet.http.HttpServlet.service(HttpServlet.java(Compiled Code))
     at com.ibm.ws.webservices.engine.transport.http.WebServicesServletBase.service(WebServicesServletBase.java:341)
     at javax.servlet.http.HttpServlet.service(HttpServlet.java(Compiled Code))
     at com.ibm.ws.cache.servlet.ServletWrapper.serviceProxied(ServletWrapper.java(Inlined Compiled Code))
     at com.ibm.ws.cache.servlet.CacheHook.handleFragment(CacheHook.java(Compiled Code))
     at com.ibm.ws.cache.servlet.CacheHook.handleServlet(CacheHook.java(Compiled Code))
     at com.ibm.ws.cache.servlet.ServletWrapper.service(ServletWrapper.java(Compiled Code))
     at com.ibm.ws.webcontainer.servlet.StrictServletInstance.doService(StrictServletInstance.java(Compiled Code))
     at com.ibm.ws.webcontainer.servlet.StrictLifecycleServlet._service(StrictLifecycleServlet.java(Compiled Code))
     at com.ibm.ws.webcontainer.servlet.IdleServletState.service(StrictLifecycleServlet.java(Compiled Code))
     at com.ibm.ws.webcontainer.servlet.StrictLifecycleServlet.service(StrictLifecycleServlet.java(Inlined Compiled Code))
     at com.ibm.ws.webcontainer.servlet.ServletInstance.service(ServletInstance.java(Compiled Code))
     at com.ibm.ws.webcontainer.servlet.ValidServletReferenceState.dispatch(ValidServletReferenceState.java(Compiled Code))
     at com.ibm.ws.webcontainer.servlet.ServletInstanceReference.dispatch(ServletInstanceReference.java(Inlined Compiled Code))
     at com.ibm.ws.webcontainer.webapp.WebAppRequestDispatcher.handleWebAppDispatch(WebAppRequestDispatcher.java(Compiled Code))
     at com.ibm.ws.webcontainer.webapp.WebAppRequestDispatcher.dispatch(WebAppRequestDispatcher.java(Compiled Code))
     at com.ibm.ws.webcontainer.webapp.WebAppRequestDispatcher.forward(WebAppRequestDispatcher.java(Compiled Code))
     at com.ibm.ws.webcontainer.srt.WebAppInvoker.doForward(WebAppInvoker.java(Compiled Code))
     at com.ibm.ws.webcontainer.srt.WebAppInvoker.handleInvocationHook(WebAppInvoker.java(Compiled Code))
     at com.ibm.ws.webcontainer.cache.invocation.CachedInvocation.handleInvocation(CachedInvocation.java(Compiled Code))
     at com.ibm.ws.webcontainer.cache.invocation.CacheableInvocationContext.invoke(CacheableInvocationContext.java:116)
     at com.ibm.ws.webcontainer.srp.ServletRequestProcessor.dispatchByURI(ServletRequestProcessor.java(Compiled Code))
     at com.ibm.ws.webcontainer.oselistener.OSEListenerDispatcher.service(OSEListener.java(Compiled Code))
     at com.ibm.ws.webcontainer.http.HttpConnection.handleRequest(HttpConnection.java(Compiled Code))
     at com.ibm.ws.http.HttpConnection.readAndHandleRequest(HttpConnection.java(Compiled Code))
     at com.ibm.ws.http.HttpConnection.run(HttpConnection.java:449)
     at com.ibm.ws.util.ThreadPool$Worker.run(ThreadPool.java:912)

It's most likely to be a password policy problem.
If your Active Directory password policy is enforcing password history, minimum password length, minimum password age or password complexity, then this will raise the LDAP Error Code 19 (invalid attribute exception), with an Active Directory problem code of 1005.

Synchronization errors with AD: LDAP error code 65 : orclObjectSid

I'm trying to get synchronization working - importing data from Microsoft AD.
The bootstrap seemed to go ok, and the synchronization is up and running - but I still get errors in the profile's trace file as follows at the end of this post.
The error always seem to complain about the orclObjectSid attribute
Do I need to do anything to the OID schema?
Or is this a mapping problem?
Either way, how would I correct this error?
Thanks!!
Howard Dickins
Here's an example of the errors I'm getting:
DN : dc=connectutilities,dc=co,dc=uk
Normalized DN : dc=connectutilities,dc=co,dc=uk
Processing modifyRadd Operation ..
Proceeding with checkNReplace..
Performing checkNReplace..
Naming attribute: dc
Naming attribute value: dc
Naming attribute value: orclObjectSID
Adding Attribute in OID : orclObjectSID
Naming attribute value: orclobjectguid
Adding Attribute in OID : orclobjectguid
Total # of Mod Items : 2
Exception Modifying Entry : javax.naming.directory.SchemaViolationException: [LDAP: error code 65 - Failed to find orclobjectsid in mandatory or optional attribute list.]; remaining name 'dc=connectutilities,dc=co,dc=uk'
javax.naming.directory.SchemaViolationException: [LDAP: error code 65 - Failed to find orclobjectsid in mandatory or optional attribute list.]; remaining name 'dc=connectutilities,dc=co,dc=uk'
     at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3019)
     at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2934)
     at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2740)
     at com.sun.jndi.ldap.LdapCtx.c_modifyAttributes(LdapCtx.java:1440)
     at com.sun.jndi.toolkit.ctx.ComponentDirContext.p_modifyAttributes(ComponentDirContext.java:255)
     at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.modifyAttributes(PartialCompositeDirContext.java:172)
     at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.modifyAttributes(PartialCompositeDirContext.java:161)
     at javax.naming.directory.InitialDirContext.modifyAttributes(InitialDirContext.java:146)
     at oracle.ldap.odip.gsi.LDAPWriter.checkNReplace(LDAPWriter.java:839)
     at oracle.ldap.odip.gsi.LDAPWriter.modifyRadd(LDAPWriter.java:717)
     at oracle.ldap.odip.gsi.LDAPWriter.writeChanges(LDAPWriter.java:310)
     at oracle.ldap.odip.engine.AgentThread.mapExecute(AgentThread.java:581)
     at oracle.ldap.odip.engine.AgentThread.execMapping(AgentThread.java:306)
     at oracle.ldap.odip.engine.AgentThread.run(AgentThread.java:186)
[LDAP: error code 65 - Failed to find orclobjectsid in mandatory or optional attribute list.]
Entry Not Found. Converting to an ADD op..
Processing Insert Operation ..
Performing createEntry..
Exception creating Entry : javax.naming.directory.SchemaViolationException: [LDAP: error code 65 - Failed to find orclobjectsid in mandatory or optional attribute list.]; remaining name 'dc=connectutilities,dc=co,dc=uk'
[LDAP: error code 65 - Failed to find orclobjectsid in mandatory or optional attribute list.]
javax.naming.directory.SchemaViolationException: [LDAP: error code 65 - Failed to find orclobjectsid in mandatory or optional attribute list.]; remaining name 'dc=connectutilities,dc=co,dc=uk'
     at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3019)
     at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2934)
     at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2740)
     at com.sun.jndi.ldap.LdapCtx.c_createSubcontext(LdapCtx.java:777)
     at com.sun.jndi.toolkit.ctx.ComponentDirContext.p_createSubcontext(ComponentDirContext.java:319)
     at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.createSubcontext(PartialCompositeDirContext.java:248)
     at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.createSubcontext(PartialCompositeDirContext.java:236)
     at javax.naming.directory.InitialDirContext.createSubcontext(InitialDirContext.java:176)
     at oracle.ldap.odip.gsi.LDAPWriter.createEntry(LDAPWriter.java:1031)
     at oracle.ldap.odip.gsi.LDAPWriter.insert(LDAPWriter.java:386)
     at oracle.ldap.odip.gsi.LDAPWriter.modifyRadd(LDAPWriter.java:725)
     at oracle.ldap.odip.gsi.LDAPWriter.writeChanges(LDAPWriter.java:310)
     at oracle.ldap.odip.engine.AgentThread.mapExecute(AgentThread.java:581)
     at oracle.ldap.odip.engine.AgentThread.execMapping(AgentThread.java:306)
     at oracle.ldap.odip.engine.AgentThread.run(AgentThread.java:186)
DIP_LDAPWRITER_ERROR_CREATE
Error in executing mapping DIP_LDAPWRITER_ERROR_CREATE
DIP_LDAPWRITER_ERROR_CREATE
     at oracle.ldap.odip.engine.AgentThread.mapExecute(AgentThread.java:722)
     at oracle.ldap.odip.engine.AgentThread.execMapping(AgentThread.java:306)
     at oracle.ldap.odip.engine.AgentThread.run(AgentThread.java:186)
DIP_LDAPWRITER_ERROR_CREATE
AD_OID_Import:Error in Mapping EngineDIP_LDAPWRITER_ERROR_CREATE
DIP_LDAPWRITER_ERROR_CREATE
     at oracle.ldap.odip.engine.AgentThread.mapExecute(AgentThread.java:741)
     at oracle.ldap.odip.engine.AgentThread.execMapping(AgentThread.java:306)
     at oracle.ldap.odip.engine.AgentThread.run(AgentThread.java:186)
AD_OID_Import:about to Update exec status
Updated Attributes
orclodipLastExecutionTime: 20090617062658
orclodipConDirLastAppliedChgNum: 12242192
orclOdipSynchronizationStatus: Mapping Failure, Agent Execution Not Attempted
orclOdipSynchronizationErrors:
Sleeping for 1secs
LDAP URL : (inexus-srv01:389 oracleextract
Specifying binary attributes: mpegvideo objectguid objectsid guid usercertificate orclodipcondirlastappliedchgnum
LDAP Connection success
Applied ChangeNum : 12242192Available chg num = 12245972
Reader Initialised !!
LDAP URL : (inexus-srv34:389 cn=odisrv+orclhostname=inexus-srv34,cn=registered instances,cn=directory integration platform,cn=products,cn=oraclecontext
Specifying binary attributes: mpegvideo objectguid objectsid guid usercertificate orclodipcondirlastappliedchgnum
LDAP Connection success
Writer Initialised!!
Writer proxy connection initialised!!
MapEngine Initialised!!
Filter Initialised!!
searchF :
CHGLOGFILTER : (&(USNChanged>=12242193)(USNChanged<=12242692))
Search Time 0
Search Successful till # 12242692
Search Changes Done
Changenumber uSNChanged: 12242193
targetdn distinguishedName: DC=connectutilities,DC=co,DC=uk
ChangeRecord : ----------
Changetype: ADDRMODIFY
ChangeKey: dc=connectutilities,dc=co,dc=uk
Attributes:
Class: null Name: objectGUID Type: null ChgType: REPLACE Value: [[B@1c999c4]
Class: null Name: objectSid Type: null ChgType: REPLACE Value: [[B@8e5360]
Class: null Name: dc Type: null ChgType: REPLACE Value: [connectutilities]
Class: null Name: objectClass Type: nonbinary ChgType: REPLACE Value: [top, domain, domainDNS]
-----------

I found a solution - I added the offending attribute orclObjectSid to the domain objectClass as an optional attribute.
It was a bit of a "clutching at straws" solution - but it does seem to have worked.
I'm not sure why the data being imported had such a value, but the synchronization hasn't thrown up any further errors since then.
Thanks for your help everyone.
Howard

Error while create user in LDAP - LDAP: error code 1

Hi Guy's, I am getting below error while creating user in LDAP MS AD.
cn=3001,ou=sAP_IDM,dc=springswf,dc=comcn<mx:TEXT>putNextEntry failed storingOU=SAP_IDM,DC=springswf,DC=com</mx:TEXT>
<mx:LTEXT>Exception from Add operation:javaxnaming.NamingException: {LDAP: error code 1 = 00000000: LdapErr: DSID-OC090AE2, coment: In order to perform this operation a successful bind must be completed on the connection.,data0,vece
Steps I am following:
1. create a job through wizard and pick from (IC->jobs->Active Directory->Create Active Directory User)
2. Destination tab values that I am passing:
dn: cn=Dummyuser,ou=SAP_IDM,dc=<main domain>,dc=com
objectClass: top|person|organizationalPerson|user
sn: Surname
givenName: GivenName
displayName: Dummy user displayname
Under <main domain> an OU has been created called SAP_IDM for testing user creation from IDM.
Admin user account created called <XYZ> and has full control over SAP_IDM OU.
I am passing <XYZ> credentials into my job for user creation.
Thanks for you help!

Farhan,
Based on the error message presented,
In order to perform this operation a successful bind must be completed on the connection
Make sure that you're using the correct information to do the AD Bind. User name should be something like cn=administrator,cn=users,dc=xxx,dc=xxx and the proper password.
Matt

LDAP Error code 65 - givenName

I have tried dozens of things and reviewed many metalink documents, but none of them seem to zero in on my exact issue. Can someone please tell me why it is unable to map the givenName attribute. I have verified that inetOrgPerson is the correct objectclass to map this attribute, so I really don't understand.
My mapping is as follows:
givenName: : :person:givenName: :inetorgperson
Here is the details from my import.trc file.
Command exec succesful
LDAP URL : (server.mycompanyenergy.com:port : 389cn=AdminOID,cn=users,dc=mycompanyenergy,dc=com
LDAP Connection success
LDAP URL : (server.mycompanyenergy.com:389 cn=AdminOID,cn=users,dc=mycompanyenergy,dc=com
Specifying binary attributes: mpegvideo objectguid objectsid guid usercertificate orclodipcondirlastappliedchgnum
LDAP Connection success
Last Cookie:TVNEUwMAAAAZWAkygJLLAQAAAAAAAAAAGAEAAMxcJgAAAAAAAAAAAAAAAADMXCYAAAAAAIYe+wZstEBBmZS0D5tgsHIBAAAAAAAAAAsAAAAAAAAAhh77Bmy0QEGZlLQPm2CwctRcJgAAAAAAyXc5FZpI0EKT2vApaqLf0QbybAAAAAAAxQ7dMLsVXEORsgFd1HJd4/OvhAAAAAAAEX6EMgTxVk+GUsZbGZvEYEyIgwAAAAAAUt0eQY/5c0+YwrHTuSWj6oi+iwMAAAAA8fdCZEQBBUS7GM7m8LxW3eFvqwEAAAAADFg9fo0Mhk6gjY+SsJSaYh4NLgAAAAAArLDumHJ2NEyD4z8FAKGRU4p0AAAAAAAAC+CWoJbJsk2lkF9r8XwUKGZ+bwAAAAAA5ABDre7ZDU+vzdZhaHJCR8EsAQAAAAAAVUA8umstpEaHIpGN0a8S124iCAAAAAAA
Last IgnoreCnt:0
Reader Initialised !!
LDAP URL : (drsnt17.mycompanyenergy.com:389 cn=odisrv+orclhostname=DRSNT17,cn=registered instances,cn=directory comegration platform,cn=products,cn=oraclecontext
Specifying binary attributes: mpegvideo objectguid objectsid guid usercertificate orclodipcondirlastappliedchgnum
LDAP Connection success
Writer Initialised!!
Writer proxy connection initialised!!
MapEngine Initialised!!
Filter Initialised!!
searchF : (|(objectclass=organizationalunit)(&(objectclass=user)(userprincipalname=*)(!(objectclass=computer)))(isDeleted=TRUE))
searchF : (|(objectclass=organizationalunit)(&(objectclass=user)(userprincipalname=*)(!(objectclass=computer)))(isDeleted=TRUE))
Search Time 63
Search Changes Done
Value of mIgnoreCnt: 0
ChangeRecord : ----------
Changetype: ADDRMODIFY
ChangeKey: CN=AdminGEL,CN=Users,DC=mycompanyenergy,DC=com
Attributes:
Class: null Name: objectclass Type: null ChgType: REPLACE Value: [top, person, organizationalPerson, user]
Class: null Name: objectguid Type: null ChgType: REPLACE Value: [[B@39443f]
Source ChangeRecord Created
MAPPING : Source Change Record : ChangeRecord : ----------
Changetype: ADDRMODIFY
ChangeKey: CN=AdminGEL,CN=Users,DC=mycompanyenergy,DC=com
Attributes:
Class: null Name: CN Type: null ChgType: Value: [AdminGEL]
Class: null Name: objectclass Type: null ChgType: REPLACE Value: [top, person, organizationalPerson, user]
Class: null Name: objectguid Type: null ChgType: REPLACE Value: [[B@39443f]
MAPPING: Attributes - Start
MAPPING: Processing Map Rule : 7
MAPPING: Processing Map Rule : 7
Value is empty after evaluation of mapping rule
MAPPING: Processing Map Rule : 8
MAPPING: Processing Map Rule : 8
MAPPING: Processing Map Rule : 7
MAPPING: DstChangeRecord after Attribute Mapping : ChangeRecord : ----------
Changetype: ADDRMODIFY
ChangeKey: CN=AdminGEL,CN=Users,DC=mycompanyenergy,DC=com
Attributes:
Class: null Name: objectclass Type: null ChgType: REPLACE Value: [orcladuser, orcluserv2]
Class: null Name: orclSAMAccountName Type: null ChgType: NOCHANGE Value: [$ ]
Class: null Name: krbPrincipalName Type: null ChgType: NOCHANGE Value: [@ ]
Class: null Name: orclObjectGUID Type: null ChgType: REPLACE Value: [s+86AiXo4EW5VplAtIXjkQ==]
Not able to construct DN
MAPPING : Dst Change Record : ChangeRecord : ----------
Changetype: ADDRMODIFY
ChangeKey: *
Attributes:
Class: null Name: objectclass Type: null ChgType: REPLACE Value: [orcladuser, orcluserv2]
Class: null Name: orclSAMAccountName Type: null ChgType: NOCHANGE Value: [$ ]
Class: null Name: krbPrincipalName Type: null ChgType: NOCHANGE Value: [@ ]
Class: null Name: orclObjectGUID Type: null ChgType: REPLACE Value: [s+86AiXo4EW5VplAtIXjkQ==]
Output ChangeRecord ChangeRecord : ----------
Changetype: ADDRMODIFY
ChangeKey: *
Attributes:
Class: null Name: objectclass Type: null ChgType: REPLACE Value: [orcladuser, orcluserv2]
Class: null Name: orclSAMAccountName Type: null ChgType: NOCHANGE Value: [$ ]
Class: null Name: krbPrincipalName Type: null ChgType: NOCHANGE Value: [@ ]
Class: null Name: orclObjectGUID Type: null ChgType: REPLACE Value: [s+86AiXo4EW5VplAtIXjkQ==]
DN : *
Normalized DN : cn=admingel,ou=oidusers,cn=users,dc=mycompanyenergy,dc=com
Changetype is 5
Processing modifyRadd Operation ..
Proceeding with checkNReplace..
Performing checkNReplace..
Naming attribute: cn
Naming attribute value: orclObjectGUID
Naming attribute value: objectclass
Total # of Mod Items : 1
Exception Modifying Entry : javax.naming.directory.SchemaViolationException: [LDAP: error code 65 - Failed to find givenname in mandatory or optional attribute list.]; remaining name 'cn=admingel,ou=oidusers,cn=users,dc=mycompanyenergy,dc=com'
javax.naming.directory.SchemaViolationException: [LDAP: error code 65 - Failed to find givenname in mandatory or optional attribute list.]; remaining name 'cn=admingel,ou=oidusers,cn=users,dc=mycompanyenergy,dc=com'
     at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3019)
     at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2934)
     at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2740)
     at com.sun.jndi.ldap.LdapCtx.c_modifyAttributes(LdapCtx.java:1440)
     at com.sun.jndi.toolkit.ctx.ComponentDirContext.p_modifyAttributes(ComponentDirContext.java:255)
     at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.modifyAttributes(PartialCompositeDirContext.java:172)
     at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.modifyAttributes(PartialCompositeDirContext.java:161)
     at javax.naming.directory.InitialDirContext.modifyAttributes(InitialDirContext.java:146)
     at oracle.ldap.odip.gsi.LDAPWriter.checkNReplace(LDAPWriter.java:862)
     at oracle.ldap.odip.gsi.LDAPWriter.modifyRadd(LDAPWriter.java:740)
     at oracle.ldap.odip.gsi.LDAPWriter.writeChanges(LDAPWriter.java:335)
     at oracle.ldap.odip.engine.AgentThread.mapExecute(AgentThread.java:581)
     at oracle.ldap.odip.engine.AgentThread.execMapping(AgentThread.java:306)
     at oracle.ldap.odip.engine.AgentThread.run(AgentThread.java:186)
[LDAP: error code 65 - Failed to find givenname in mandatory or optional attribute list.]
Entry Not Found. Converting to an ADD op..
Processing Insert Operation ..
Performing createEntry..
Exception creating Entry : javax.naming.directory.SchemaViolationException: [LDAP: error code 65 - Failed to find cn in mandatory or optional attribute list.]; remaining name 'cn=admingel,ou=oidusers,cn=users,dc=mycompanyenergy,dc=com'
[LDAP: error code 65 - Failed to find cn in mandatory or optional attribute list.]
javax.naming.directory.SchemaViolationException: [LDAP: error code 65 - Failed to find cn in mandatory or optional attribute list.]; remaining name 'cn=admingel,ou=oidusers,cn=users,dc=mycompanyenergy,dc=com'
     at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3019)
     at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2934)
     at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2740)
     at com.sun.jndi.ldap.LdapCtx.c_createSubcontext(LdapCtx.java:777)
     at com.sun.jndi.toolkit.ctx.ComponentDirContext.p_createSubcontext(ComponentDirContext.java:319)
     at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.createSubcontext(PartialCompositeDirContext.java:248)
     at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.createSubcontext(PartialCompositeDirContext.java:236)
     at javax.naming.directory.InitialDirContext.createSubcontext(InitialDirContext.java:176)
     at oracle.ldap.odip.gsi.LDAPWriter.createEntry(LDAPWriter.java:1054)
     at oracle.ldap.odip.gsi.LDAPWriter.insert(LDAPWriter.java:409)
     at oracle.ldap.odip.gsi.LDAPWriter.modifyRadd(LDAPWriter.java:748)
     at oracle.ldap.odip.gsi.LDAPWriter.writeChanges(LDAPWriter.java:335)
     at oracle.ldap.odip.engine.AgentThread.mapExecute(AgentThread.java:581)
     at oracle.ldap.odip.engine.AgentThread.execMapping(AgentThread.java:306)
     at oracle.ldap.odip.engine.AgentThread.run(AgentThread.java:186)
DIP_LDAPWRITER_ERROR_CREATE
Error in executing mapping DIP_LDAPWRITER_ERROR_CREATE
DIP_LDAPWRITER_ERROR_CREATE
     at oracle.ldap.odip.engine.AgentThread.mapExecute(AgentThread.java:722)
     at oracle.ldap.odip.engine.AgentThread.execMapping(AgentThread.java:306)
     at oracle.ldap.odip.engine.AgentThread.run(AgentThread.java:186)
DIP_LDAPWRITER_ERROR_CREATE
Last chg key: TVNEUwMAAAAZWAkygJLLAQAAAAAAAAAAGAEAAMxcJgAAAAAAAAAAAAAAAADMXCYAAAAAAIYe+wZstEBBmZS0D5tgsHIBAAAAAAAAAAsAAAAAAAAAhh77Bmy0QEGZlLQPm2CwctRcJgAAAAAAyXc5FZpI0EKT2vApaqLf0QbybAAAAAAAxQ7dMLsVXEORsgFd1HJd4/OvhAAAAAAAEX6EMgTxVk+GUsZbGZvEYEyIgwAAAAAAUt0eQY/5c0+YwrHTuSWj6oi+iwMAAAAA8fdCZEQBBUS7GM7m8LxW3eFvqwEAAAAADFg9fo0Mhk6gjY+SsJSaYh4NLgAAAAAArLDumHJ2NEyD4z8FAKGRU4p0AAAAAAAAC+CWoJbJsk2lkF9r8XwUKGZ+bwAAAAAA5ABDre7ZDU+vzdZhaHJCR8EsAQAAAAAAVUA8umstpEaHIpGN0a8S124iCAAAAAAA
ActiveImport:Error in Mapping EngineDIP_LDAPWRITER_ERROR_CREATE
DIP_LDAPWRITER_ERROR_CREATE
     at oracle.ldap.odip.engine.AgentThread.mapExecute(AgentThread.java:741)
     at oracle.ldap.odip.engine.AgentThread.execMapping(AgentThread.java:306)
     at oracle.ldap.odip.engine.AgentThread.run(AgentThread.java:186)
ActiveImport:about to Update exec status
Updated Attributes
orclodipLastExecutionTime: 20101208201740
orclodipConDirLastAppliedChgNum: TVNEUwMAAAAZWAkygJLLAQAAAAAAAAAAGAEAAMxcJgAAAAAAAAAAAAAAAADMXCYAAAAAAIYe+wZstEBBmZS0D5tgsHIBAAAAAAAAAAsAAAAAAAAAhh77Bmy0QEGZlLQPm2CwctRcJgAAAAAAyXc5FZpI0EKT2vApaqLf0QbybAAAAAAAxQ7dMLsVXEORsgFd1HJd4/OvhAAAAAAAEX6EMgTxVk+GUsZbGZvEYEyIgwAAAAAAUt0eQY/5c0+YwrHTuSWj6oi+iwMAAAAA8fdCZEQBBUS7GM7m8LxW3eFvqwEAAAAADFg9fo0Mhk6gjY+SsJSaYh4NLgAAAAAArLDumHJ2NEyD4z8FAKGRU4p0AAAAAAAAC+CWoJbJsk2lkF9r8XwUKGZ+bwAAAAAA5ABDre7ZDU+vzdZhaHJCR8EsAQAAAAAAVUA8umstpEaHIpGN0a8S124iCAAAAAAA
orclOdipSynchronizationStatus: Mapping Failure, Agent Execution Not Attempted
orclOdipSynchronizationErrors:
Sleeping for 1secs

Is there anyone who can help? I am getting the error on krbprincipalname now. Here is the mapping of the change record, I can't determine where the problem is.
ChangeRecord : ----------
Changetype: ADDRMODIFY
ChangeKey: CN=AdminGEL,CN=Users,DC=mycompany,DC=com
Attributes:
Class: null Name: objectclass Type: null ChgType: REPLACE Value: [top, person, organizationalPerson, user]
Class: null Name: objectguid Type: null ChgType: REPLACE Value: [[B@edc3a2]
Source ChangeRecord Created
MAPPING : Source Change Record : ChangeRecord : ----------
Changetype: ADDRMODIFY
ChangeKey: CN=AdminGEL,CN=Users,DC=mycompany,DC=com
Attributes:
Class: null Name: CN Type: null ChgType: Value: [AdminGEL]
Class: null Name: objectclass Type: null ChgType: REPLACE Value: [top, person, organizationalPerson, user]
Class: null Name: objectguid Type: null ChgType: REPLACE Value: [[B@edc3a2]
MAPPING: Attributes - Start
MAPPING: Processing Map Rule : 7
MAPPING: Processing Map Rule : 7
Value is empty after evaluation of mapping rule
MAPPING: Processing Map Rule : 8
MAPPING: Processing Map Rule : 7
MAPPING: DstChangeRecord after Attribute Mapping : ChangeRecord : ----------
Changetype: ADDRMODIFY
ChangeKey: CN=AdminGEL,CN=Users,DC=mycompany,DC=com
Attributes:
Class: null Name: objectclass Type: null ChgType: REPLACE Value: [orcladuser]
Class: null Name: orclSAMAccountName Type: null ChgType: NOCHANGE Value: [$ ]
Class: null Name: orclObjectGUID Type: null ChgType: REPLACE Value: [s+86AiXo4EW5VplAtIXjkQ==]
Not able to construct DN
MAPPING : Dst Change Record : ChangeRecord : ----------
Changetype: ADDRMODIFY
ChangeKey: *
Attributes:
Class: null Name: objectclass Type: null ChgType: REPLACE Value: [orcladuser]
Class: null Name: orclSAMAccountName Type: null ChgType: NOCHANGE Value: [$ ]
Class: null Name: orclObjectGUID Type: null ChgType: REPLACE Value: [s+86AiXo4EW5VplAtIXjkQ==]
Output ChangeRecord ChangeRecord : ----------
Changetype: ADDRMODIFY
ChangeKey: *
Attributes:
Class: null Name: objectclass Type: null ChgType: REPLACE Value: [orcladuser]
Class: null Name: orclSAMAccountName Type: null ChgType: NOCHANGE Value: [$ ]
Class: null Name: orclObjectGUID Type: null ChgType: REPLACE Value: [s+86AiXo4EW5VplAtIXjkQ==]
DN : *
Normalized DN : cn=admingel,ou=oidusers,cn=users,dc=mycompany,dc=com
Changetype is 5
Processing modifyRadd Operation ..
Proceeding with checkNReplace..
Performing checkNReplace..
Naming attribute: cn
Naming attribute value: orclObjectGUID
Naming attribute value: objectclass
Total # of Mod Items : 1
Exception Modifying Entry : javax.naming.directory.SchemaViolationException: [LDAP: error code 65 - Failed to find krbprincipalname in mandatory or optional attribute list.]; remaining name 'cn=admingel,ou=oidusers,cn=users,dc=mycompany,dc=com'
javax.naming.directory.SchemaViolationException: [LDAP: error code 65 - Failed to find krbprincipalname in mandatory or optional attribute list.]; remaining name 'cn=admingel,ou=oidusers,cn=users,dc=mycompany,dc=com'
     at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3019)
     at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2934)
     at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2740)
     at com.sun.jndi.ldap.LdapCtx.c_modifyAttributes(LdapCtx.java:1440)
     at com.sun.jndi.toolkit.ctx.ComponentDirContext.p_modifyAttributes(ComponentDirContext.java:255)
     at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.modifyAttributes(PartialCompositeDirContext.java:172)
     at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.modifyAttributes(PartialCompositeDirContext.java:161)
     at javax.naming.directory.InitialDirContext.modifyAttributes(InitialDirContext.java:146)
     at oracle.ldap.odip.gsi.LDAPWriter.checkNReplace(LDAPWriter.java:862)
     at oracle.ldap.odip.gsi.LDAPWriter.modifyRadd(LDAPWriter.java:740)
     at oracle.ldap.odip.gsi.LDAPWriter.writeChanges(LDAPWriter.java:335)
     at oracle.ldap.odip.engine.AgentThread.mapExecute(AgentThread.java:581)
     at oracle.ldap.odip.engine.AgentThread.execMapping(AgentThread.java:306)
     at oracle.ldap.odip.engine.AgentThread.run(AgentThread.java:186)
[LDAP: error code 65 - Failed to find krbprincipalname in mandatory or optional attribute list.]
Based on the objects attributes list, the krbprincipalname is part of the orcluserv2 object class, so the mapping should be fine.
objectclasses: ( 2.16.840.1.113894.1.2.52 NAME 'orclUserV2' SUP 'top' AUXILIAR
Y MAY ( orclHireDate $ orclDateOfBirth $ orclMaidenName $ orclIsVisible $ or
clDisplayPersonalInfo $ middleName $ orclDefaultProfileGroup $ c $ orclTimeZ
one $ orclIsEnabled $ orclPasswordHintAnswer $ orclPasswordHint $ orclWorkfl
owNotificationPref $ orclTimeZone $ c $ orclActiveStartDate $ orclActiveEndD
ate $ orclGender $ userPKCS12 $ orclPKCS12Hint $ orclPassword $ authPassword
$ orclPasswordVerifier $ orclSecondaryUID $ krbPrincipalName $ orclWireless
AccountNumber $ orclUIAccessibilityMode $ assistant $ orclSAMAccountName $ o
rclUserProvMode ) )

OID - OperationalNotSupportedException: [LDAP: error code 53 - Server ... ]

Hi,
I'm using JNDI (Java Native Directory Interface) accessing OID, and I received a javax.naming.OperationalNotSupportedException: [LDAP: error code 53 - Server currently in read only mode. Update operations not allowed];
I am not sure what's wrong.
I tried the following command
"./ldapsearch -b "" -s base "objectclass=*" orclservermode" The returned result is "orclservermode=rw"
So it is in read-write mode. I'm not sure what's wrong.
This started happen after I apply the 10.1.4.2.0 patch.

Unfortunately I am not an OID expert so I can't really comment on the OID server part of the problem.
What I actually have plenty of experience of is the JNDI package and there has been a number of times when the error messages produced by JNDI have been cryptic or simply wrong. I would recommend sniffing the LDAP connection and check what error messages are actually created by the OID server.
Good luck!
/M

Error when performing search: getExtendedProperties [LDAP: error code 50

Hi there,
We are currently running OAS 10.1.2. We have an application which is running Oracle Forms. To get access to these forms, the authenication is a combination of the user logging on to their windows domain, (AD SSO) and having the correct username and groups within Oracle OID and DAS.
We have a major problem at the moment in Production where every so often a user will get rejected for having insufficient access rights, and the UserID in the logs being Null. Yet if they try again it works.
Does anyone know why this might be happening for?
Here is the Forms log :
09/07/31 06:59:32 Forms session <967> runtime process id = 10,780
09/07/31 07:02:27 oracle.ldap.util.AccessDeniedException: General Error when performing search: getExtendedProperties [LDAP: er
ror code 50 - Insufficient Access Rights]
09/07/31 07:02:27 at oracle.ldap.util.User.getExtendedProperties(User.java:365)
09/07/31 07:02:27 at oracle.forms.servlet.FormsOIDContext.getUserCredentials(Unknown Source)
09/07/31 07:02:27 at oracle.forms.servlet.FormsServlet.getUserId(Unknown Source)
09/07/31 07:02:27 at oracle.forms.servlet.FormsServlet.doRequest(Unknown Source)
09/07/31 07:02:27 at oracle.forms.servlet.FormsServlet.doGet(Unknown Source)
09/07/31 07:02:27 at javax.servlet.http.HttpServlet.service(HttpServlet.java:740)
09/07/31 07:02:27 at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
09/07/31 07:02:27 at com.evermind.server.http.ServletRequestDispatcher.invoke(ServletRequestDispatcher.java:824)
09/07/31 07:02:27 at com.evermind.server.http.ServletRequestDispatcher.forwardInternal(ServletRequestDispatcher.java:330)
09/07/31 07:02:27 at com.evermind.server.http.HttpRequestHandler.processRequest(HttpRequestHandler.java:830)
09/07/31 07:02:27 at com.evermind.server.http.AJPRequestHandler.run(AJPRequestHandler.java:224)
09/07/31 07:02:27 at com.evermind.server.http.AJPRequestHandler.run(AJPRequestHandler.java:133)
09/07/31 07:02:27 at com.evermind.util.ReleasableResourcePooledExecutor$MyWorker.run(ReleasableResourcePooledExecutor.java:192
09/07/31 07:02:27 at java.lang.Thread.run(Thread.java:534)
09/07/31 07:02:27 oracle.ldap.util.AccessDeniedException: General Error when performing search: getExtendedProperties [LDAP: er
ror code 50 - Insufficient Access Rights]
09/07/31 07:02:27 In getUserId method: caught oracle.ldap.util.AccessDeniedException: General Error when performing search: ge
tExtendedProperties [LDAP: error code 50 - Insufficient Access Rights]
09/07/31 07:02:27 In doRequest method in ue.isNamingException
09/07/31 07:02:27 Redirecting to DAS to update the resviewer list
09/07/31 07:02:27 UserID is NULL redirecting to DAS
09/07/31 07:02:27 Forms Group DNcn=Logical Application Group, orclApplicationCommonName=formsApp_dras03.workcover.qld.gov.au_63A
36930655911DBBF37F32F8ED7FD07, cn=forms, cn=Products, cn=OracleContext
09/07/31 07:02:27 The DAS URL generated: http://prinfds.workcover.qld.gov.au:7777/oiddas/ui/oracle/ldap/das/mypage/AppCreateReso
urceInfo?resKey=prcar_sso&resType=oracleDB&resViewer=cn%3DLogical+Application+Group%2C+orclApplicationCommonName%3DformsApp_dras
03.workcover.qld.gov.au_63A36930655911DBBF37F32F8ED7FD07%2C+cn%3Dforms%2C+cn%3DProducts%2C+cn%3DOracleContext&doneURL=http%3A%2F
%2Fdras03.workcover.qld.gov.au%3A7778%2Fforms%2Ffrmservlet%3Fconfig%3Dprcar_sso%26form%3DSY0001.fmx&cancelURL=
09/07/31 07:05:26 oracle.ldap.util.AccessDeniedException: General Error when performing search: getExtendedProperties [LDAP: er
ror code 50 - Insufficient Access Rights]
09/07/31 07:05:26 at oracle.ldap.util.User.getExtendedProperties(User.java:365)
09/07/31 07:05:26 at oracle.forms.servlet.FormsOIDContext.getUserCredentials(Unknown Source)
09/07/31 07:05:26 at oracle.forms.servlet.FormsServlet.getUserId(Unknown Source)
09/07/31 07:05:26 at oracle.forms.servlet.FormsServlet.doRequest(Unknown Source)
09/07/31 07:05:26 at oracle.forms.servlet.FormsServlet.doGet(Unknown Source)
09/07/31 07:05:26 at javax.servlet.http.HttpServlet.service(HttpServlet.java:740)
09/07/31 07:05:26 at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
09/07/31 07:05:26 at com.evermind.server.http.ServletRequestDispatcher.invoke(ServletRequestDispatcher.java:824)
09/07/31 07:05:26 at com.evermind.server.http.ServletRequestDispatcher.forwardInternal(ServletRequestDispatcher.java:330)
09/07/31 07:05:26 at com.evermind.server.http.HttpRequestHandler.processRequest(HttpRequestHandler.java:830)
09/07/31 07:05:26 at com.evermind.server.http.AJPRequestHandler.run(AJPRequestHandler.java:224)
09/07/31 07:05:26 at com.evermind.server.http.AJPRequestHandler.run(AJPRequestHandler.java:133)
09/07/31 07:05:26 at com.evermind.util.ReleasableResourcePooledExecutor$MyWorker.run(ReleasableResourcePooledExecutor.java:192
09/07/31 07:05:26 at java.lang.Thread.run(Thread.java:534)
09/07/31 07:05:26 oracle.ldap.util.AccessDeniedException: General Error when performing search: getExtendedProperties [LDAP: er
ror code 50 - Insufficient Access Rights]
09/07/31 07:05:26 In getUserId method: caught oracle.ldap.util.AccessDeniedException: General Error when performing search: ge
tExtendedProperties [LDAP: error code 50 - Insufficient Access Rights]
09/07/31 07:05:26 In doRequest method in ue.isNamingException

I fixed it in my environment.
formweb.cfg has oid_formsid and formsid_group_dn. Verify if these values are correct.
Also ensure that formsid_group_dn has no blank spaces after ',' (commas)
formsid_group_dn=cn=Logical Application Group,orclApplicationCommonName=formsApp_xyzhost_1224C3F0A73B11DBBFC783346A955D8F,cn=forms,cn=Products,cn=OracleContext

SGD-AD "LDAP error code 49"

Dear all,
I saw the following error in the server-login log file:
2007/07/24 15:15:03.098 (pid 2698) server/login/moreinfo #1185261303098
Loaded class com.sco.tta.server.login.LdapLoginAuthority: {
LDAPRoot=.../_ldapmulti/forest/
accountEnabledChecked=false
anonLogin=false
attemptPasswordChange=true
generalLdapProfileName=.../_ens/o=Tarantella System Objects/cn=LDAP Profile
mustChangePasswordResult[0]=LDAP: error code 49 - 80090308: LdapErr: DSID-0C090290, comment: AcceptSecurityContext error, data 701
mustChangePasswordResult[1]=LDAP: error code 49 - 80090308: LdapErr: DSID-0C090290, comment: AcceptSecurityContext error, data 773
mustChangePasswordResult[2]=LDAP: error code 49 - 80090308: LdapErr: DSID-0C09030F, comment: AcceptSecurityContext error, data 773
mustChangePasswordResult[3]=LDAP: error code 49 - 80090308: LdapErr: DSID-0C090334, comment: AcceptSecurityContext error, data 773
name=com.sco.tta.server.login.LdapLoginAuthority
propAccEnabled=scottaaccountenabled
userMustChangePasswordResult=LDAP: error code 49 - 80090308: LdapErr: DSID-0C090290, comment: AcceptSecurityContext error, data 773
userPasswordExpiredResult=LDAP: error code 49 - 80090308: LdapErr: DSID-0C090290, comment: AcceptSecurityContext error, data 701
version=4.31.905
What should i do in my SGD server ?
What should i do in my AD server ?
What is the solution to resolve the error ?
Appreciate any help given.

Hi,
I am also getting the same error. Please let me explain what i have encountered.
In the active directory (version 2003), the administrator has limited the user to login to only his workstation. This has been set by putting his workstation host name or IP (which is allowed to accessed by the user) into a "log on to" list (at the user level) in Active Directory.There is another option if the administrator allow the user to be able to log on to any workstation, that is by checking the "log on to all computer" check box at that particular user id.
When my user has been set to "log on to all computer", i don't encounter the error message i.e. error code 49, as mentioned in the subject of this topic. However, when a particular user has been limited to only access to his own workstation, the error appears. However, if the Active Directory server host name or IP has been added into the "log on to" list, the authentication is successful.
My application is actually running on an application server and the user is using Internet Explorer to login to my application from his workstation. And also, the application server has been joined to the same domain as the Active Directory server. My question is, is it a must that the Active Directory server name be added to the "log on to" list of that particular user in order for it to be authenticated by Active Directory? Does anyone has any ideas why this is happening? I definitely don't want to add the AD server name into the list as this will give the user rights to login to the AD server. Any advise would be of great help. Thanks a million in advance.

LDAP: error code 49 - 80090308

I recently saw my log files as we were experiencing slowness in our application and found the follwoing error message :
javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C09030B, comment: AcceptSecurityContext
error, data 52e, v893]; remaining name 'dc=hess,dc=pri,dc=com'
at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:2988)
at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2934)
at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2735)
at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2649)
at com.sun.jndi.ldap.LdapCtx.ensureOpen(LdapCtx.java:2549)
at com.sun.jndi.ldap.LdapCtx.ensureOpen(LdapCtx.java:2523)
at com.sun.jndi.ldap.LdapCtx.doSearch(LdapCtx.java:1904)
at com.sun.jndi.ldap.LdapCtx.searchAux(LdapCtx.java:1809)
at com.sun.jndi.ldap.LdapCtx.c_search(LdapCtx.java:1734)
at com.sun.jndi.toolkit.ctx.ComponentDirContext.p_search(ComponentDirContext.java:368)
at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(PartialCompositeDirContext.java:328)
at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(PartialCompositeDirContext.java:313)
at javax.naming.directory.InitialDirContext.search(InitialDirContext.java:238)
at com.retek.rsw.persistence.ldap.LdapRswSecurityDao.getGroupNames(LdapRswSecurityDao.java:197)
at com.retek.rsw.persistence.ldap.LdapRswSecurityDao.authenticateAndReadUser(LdapRswSecurityDao.java:92)
at com.retek.rsw.service.RswSecurity.getUser(RswSecurity.java:47)
at com.retek.rsw.ui.control.security.LoginDoneAction.perform(LoginDoneAction.java:37)
at org.apache.struts.action.ActionServlet.processActionPerform(ActionServlet.java:1787)
at org.apache.struts.action.ActionServlet.process(ActionServlet.java:1586)
at com.retek.struts.action.ActionServlet.process(ActionServlet.java:227)
at org.apache.struts.action.ActionServlet.doPost(ActionServlet.java:510)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:760)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
Can anyone please help me understand this message. I looked it up on the internet and it said that you DN's are not set properly, if that is the case then none of the users should be able to login then howcome users are able to login?
Thanks in Advance,
Joyce

LDAP error code 49 means that invalid credentials were provided, so perhaps the application is trying to bind with the wrong dn/password.

LDAP: error code 53 - 0000055E: SvcErr: DSID-031A0FC0, problem 5003

Similar Messages

Maybe you are looking for