Logon problem with Active Directory

I maintain iMacs and Mac Pros connected to a Windows campus network using a combination of Mac OS X's Active Directory utility and DAVE, a Windows file and print sharing software from Thursby Software. I have found that a handful of users cannot connect to the network. They can log on, but they get the default screen and the sparse default Dock. The campus network services are not available to them.
I have found on studying the issue is that their active directory accounts of aliases in lower-case letters; in contrast, the vast majority have aliases in upper-case letters. Evidently, users with upper-case aliases in their Active Directory accounts can enjoy full network access, whereas those with lower-case aliases do not.
Is there an underlying issue here that keeps users with lower-case aliases from accessing both Apple and network resources, or should I look elsewhere for the cause?

There are several folders in the User Template on Leopard. One, English.lproj, is what I use to store the user template settings. There are also two others, user.template and non-localized.
user.template is a truly root-level folder which is inaccessible from the Aqua visual interface; when unlocked its icon turns into a folder. In terminal mode, logged on as root, I found a basic set of folders. I decided to leave those alone.
non-localized appears to be the same thing as English.lproj; it certainly has the same set of user folders. I decided to copy the folders and settings I made for English.lproj into non-localized. I invited another person with the lower-case alias problem to log on. He got the entire configuration, wallpaper, Dock and all. I confirmed this with the same person I had test the log on yesterday. He too got the whole config.
So it is evident that Leopard was using information from LDAP/AD to determine which template to download. The majority with the upper-case aliases gets the configuration from the English.lproj folder; the lower-case-alias minority get the non-localized configuration, i.e., nothing at all. Knowing this, I can now prepare our iMacs to accommodate everyone.

Similar Messages

  • Problems with Active Directory and Windows 2003

    Hello,
    I'm using Mac OS X Server 10.4.9 with Active Directory bound to a Windows 2003 Active Directory Domain. I can bind successfully to the domain using the graphical interface. Then in Samba I can access shared directories using Windows users. However, after some time somehow there are problems and Windows users aren't authenticated anymore on the Mac. I've looked at the firewall and there are no denied packets from the Mac. There are two servers in the domain, all clocks are synchronized and domain information is up to date. When I unbind the Mac, I can see the machine account being deleted on both domain servers and created too on both machines when I bind to the domain.
    Problems occur when I try login in using ssh or samba do I think this is a problem with the AD module.
    I turned on debugging messages on DirectoryServices:
    sudo killall -USR1 DirectoryService
    When in Windows, using the Administrator user I try:
    net use \\10.0.0.1 /user:domain\Administrator
    Where 10.0.0.1 is the Mac.
    In the Mac I get from
    tail -f /Library/Logs/DirectoryService/DirectoryService.debug.log |grep ADPlug
    2007-06-27 10:48:37 CDT - ADPlugin: Calling GetRecordList
    2007-06-27 10:48:37 CDT - ADPlugin: 16784372 - Calling GetRecordList Routine
    2007-06-27 10:48:37 CDT - ADPlugin: Search Records called in ADSWrapper
    2007-06-27 10:48:37 CDT - ADPlugin: Searching attribute: dsAttrTypeStandard:RecordName
    2007-06-27 10:48:37 CDT - ADPlugin: Searching domain domain.com.mx for User administrator
    2007-06-27 10:48:37 CDT - ADPlugin: Failed getting credentials at line 2687 in ADSEngine.mm
    2007-06-27 10:48:37 CDT - ADPlugin: Returning 0 Results
    2007-06-27 10:48:37 CDT - ADPlugin: 16784372 - Put 0 records in Buffer for RecordList
    2007-06-27 10:48:37 CDT - ADPlugin: Calling AttributeValueSearch
    2007-06-27 10:48:37 CDT - ADPlugin: Search Records called in ADSWrapper
    2007-06-27 10:48:37 CDT - ADPlugin: Searching attribute: dsAttrTypeStandard:RealName
    2007-06-27 10:48:37 CDT - ADPlugin: Adding Search for Attribute displayName containing DOMAIN\administrator
    2007-06-27 10:48:37 CDT - ADPlugin: Did DC search with queryFilter = (&(objectCategory=cn=person,cn=schema,cn=configuration,dc=domain,dc=com,dc=mx)( displayName=DOMAIN\\administrator)), limit 1
    2007-06-27 10:48:37 CDT - ADPlugin: Failed getting credentials at line 2687 in ADSEngine.mm
    2007-06-27 10:48:37 CDT - ADPlugin: 16784372 - Put 0 records in Buffer for AttributeValueSearch
    2007-06-27 10:48:37 CDT - ADPlugin: Calling GetRecordList
    2007-06-27 10:48:37 CDT - ADPlugin: 16784372 - Calling GetRecordList Routine
    2007-06-27 10:48:37 CDT - ADPlugin: Search Records called in ADSWrapper
    2007-06-27 10:48:37 CDT - ADPlugin: Searching attribute: dsAttrTypeStandard:RecordName
    2007-06-27 10:48:37 CDT - ADPlugin: Searching domain domain.com.mx for User administrator
    2007-06-27 10:48:37 CDT - ADPlugin: Failed getting credentials at line 2687 in ADSEngine.mm
    2007-06-27 10:48:37 CDT - ADPlugin: Returning 0 Results
    2007-06-27 10:48:37 CDT - ADPlugin: 16784372 - Put 0 records in Buffer for RecordList
    2007-06-27 10:48:37 CDT - ADPlugin: Calling AttributeValueSearch
    2007-06-27 10:48:37 CDT - ADPlugin: Search Records called in ADSWrapper
    2007-06-27 10:48:37 CDT - ADPlugin: Searching attribute: dsAttrTypeStandard:RealName
    2007-06-27 10:48:37 CDT - ADPlugin: Adding Search for Attribute displayName containing domain\administrator
    2007-06-27 10:48:37 CDT - ADPlugin: Did DC search with queryFilter = (&(objectCategory=cn=person,cn=schema,cn=configuration,dc=domain,dc=com,dc=mx)( displayName=domain\\administrator)), limit 1
    2007-06-27 10:48:37 CDT - ADPlugin: Failed getting credentials at line 2687 in ADSEngine.mm
    2007-06-27 10:48:37 CDT - ADPlugin: 16784372 - Put 0 records in Buffer for AttributeValueSearch
    2007-06-27 10:48:37 CDT - ADPlugin: Calling GetRecordList
    2007-06-27 10:48:37 CDT - ADPlugin: 16784372 - Calling GetRecordList Routine
    2007-06-27 10:48:37 CDT - ADPlugin: Search Records called in ADSWrapper
    2007-06-27 10:48:37 CDT - ADPlugin: Searching attribute: dsAttrTypeStandard:RecordName
    2007-06-27 10:48:37 CDT - ADPlugin: Searching domain domain.com.mx for User ADMINISTRATOR
    2007-06-27 10:48:37 CDT - ADPlugin: Failed getting credentials at line 2687 in ADSEngine.mm
    2007-06-27 10:48:37 CDT - ADPlugin: Returning 0 Results
    2007-06-27 10:48:37 CDT - ADPlugin: 16784372 - Put 0 records in Buffer for RecordList
    2007-06-27 10:48:37 CDT - ADPlugin: Calling AttributeValueSearch
    2007-06-27 10:48:37 CDT - ADPlugin: Search Records called in ADSWrapper
    2007-06-27 10:48:37 CDT - ADPlugin: Searching attribute: dsAttrTypeStandard:RealName
    2007-06-27 10:48:37 CDT - ADPlugin: Adding Search for Attribute displayName containing domain\administrator
    2007-06-27 10:48:37 CDT - ADPlugin: Did DC search with queryFilter = (&(objectCategory=cn=person,cn=schema,cn=configuration,dc=domain,dc=com,dc=mx)( displayName=DOMAIN\\ADMINISTRATOR)), limit 1
    2007-06-27 10:48:37 CDT - ADPlugin: Failed getting credentials at line 2687 in ADSEngine.mm
    2007-06-27 10:48:37 CDT - ADPlugin: 16784372 - Put 0 records in Buffer for AttributeValueSearch
    2007-06-27 10:48:37 CDT - ADPlugin: Calling GetRecordList
    2007-06-27 10:48:37 CDT - ADPlugin: 16784372 - Calling GetRecordList Routine
    2007-06-27 10:48:37 CDT - ADPlugin: Search Records called in ADSWrapper
    2007-06-27 10:48:37 CDT - ADPlugin: Searching attribute: dsAttrTypeStandard:RecordName
    2007-06-27 10:48:37 CDT - ADPlugin: Locating User with Query (&(objectCategory=person)(|(cn=administrator)(sAMAccountName=administrator)(dis playName=administrator)(mail=administrator)(userPrincipalName=administrator)(use rPrincipalName=administrator@*)))
    2007-06-27 10:48:37 CDT - ADPlugin: Failed getting credentials at line 2687 in ADSEngine.mm
    2007-06-27 10:48:37 CDT - ADPlugin: Failed getting credentials at line 2687 in ADSEngine.mm
    2007-06-27 10:48:37 CDT - ADPlugin: Returning 0 Results
    2007-06-27 10:48:37 CDT - ADPlugin: 16784372 - Put 0 records in Buffer for RecordList
    2007-06-27 10:48:37 CDT - ADPlugin: Calling AttributeValueSearch
    2007-06-27 10:48:37 CDT - ADPlugin: Search Records called in ADSWrapper
    2007-06-27 10:48:37 CDT - ADPlugin: Searching attribute: dsAttrTypeStandard:RealName
    2007-06-27 10:48:37 CDT - ADPlugin: Adding Search for Attribute displayName containing ADMINISTRATOR
    2007-06-27 10:48:37 CDT - ADPlugin: Did DC search with queryFilter = (&(objectCategory=cn=person,cn=schema,cn=configuration,dc=domain,dc=com,dc=mx)( displayName=administrator)), limit 1
    2007-06-27 10:48:37 CDT - ADPlugin: Failed getting credentials at line 2687 in ADSEngine.mm
    2007-06-27 10:48:37 CDT - ADPlugin: 16784372 - Put 0 records in Buffer for AttributeValueSearch
    2007-06-27 10:48:37 CDT - ADPlugin: Calling GetRecordList
    2007-06-27 10:48:37 CDT - ADPlugin: 16784372 - Calling GetRecordList Routine
    2007-06-27 10:48:37 CDT - ADPlugin: Search Records called in ADSWrapper
    2007-06-27 10:48:37 CDT - ADPlugin: Searching attribute: dsAttrTypeStandard:RecordName
    2007-06-27 10:48:37 CDT - ADPlugin: Locating User with Query (&(objectCategory=person)(|(cn=ADMINISTRATOR)(sAMAccountName=ADMINISTRATOR)(dis playName=ADMINISTRATOR)(mail=ADMINISTRATOR)(userPrincipalName=ADMINISTRATOR)(use rPrincipalName=ADMINISTRATOR@*)))
    2007-06-27 10:48:37 CDT - ADPlugin: Failed getting credentials at line 2687 in ADSEngine.mm
    2007-06-27 10:48:38 CDT - ADPlugin: Failed getting credentials at line 2687 in ADSEngine.mm
    2007-06-27 10:48:38 CDT - ADPlugin: Returning 0 Results
    2007-06-27 10:48:38 CDT - ADPlugin: 16784372 - Put 0 records in Buffer for RecordList
    2007-06-27 10:48:38 CDT - ADPlugin: Calling AttributeValueSearch
    2007-06-27 10:48:38 CDT - ADPlugin: Search Records called in ADSWrapper
    2007-06-27 10:48:38 CDT - ADPlugin: Searching attribute: dsAttrTypeStandard:RealName
    2007-06-27 10:48:38 CDT - ADPlugin: Adding Search for Attribute displayName containing ADMINISTRATOR
    2007-06-27 10:48:38 CDT - ADPlugin: Did DC search with queryFilter = (&(objectCategory=cn=person,cn=schema,cn=configuration,dc=domain,dc=com,dc=mx)( displayName=ADMINISTRATOR)), limit 1
    2007-06-27 10:48:38 CDT - ADPlugin: Failed getting credentials at line 2687 in ADSEngine.mm
    2007-06-27 10:48:38 CDT - ADPlugin: 16784372 - Put 0 records in Buffer for AttributeValueSearch
    2007-06-27 10:48:38 CDT - ADPlugin: Calling GetRecordList
    2007-06-27 10:48:38 CDT - ADPlugin: 16784372 - Calling GetRecordList Routine
    2007-06-27 10:48:38 CDT - ADPlugin: Search Records called in ADSWrapper
    2007-06-27 10:48:38 CDT - ADPlugin: Searching attribute: dsAttrTypeStandard:RecordName
    2007-06-27 10:48:38 CDT - ADPlugin: Locating User with Query (&(objectCategory=person)(|(cn=administrator)(sAMAccountName=administrator)(dis playName=administrator)(mail=administrator)(userPrincipalName=administrator)(use rPrincipalName=administrator@*)))
    2007-06-27 10:48:38 CDT - ADPlugin: Failed getting credentials at line 2687 in ADSEngine.mm
    2007-06-27 10:48:38 CDT - ADPlugin: Failed getting credentials at line 2687 in ADSEngine.mm
    2007-06-27 10:48:38 CDT - ADPlugin: Returning 0 Results
    2007-06-27 10:48:38 CDT - ADPlugin: 16784372 - Put 0 records in Buffer for RecordList
    2007-06-27 10:48:38 CDT - ADPlugin: Calling AttributeValueSearch
    2007-06-27 10:48:38 CDT - ADPlugin: Search Records called in ADSWrapper
    2007-06-27 10:48:38 CDT - ADPlugin: Searching attribute: dsAttrTypeStandard:RealName
    2007-06-27 10:48:38 CDT - ADPlugin: Adding Search for Attribute displayName containing ADMINISTRATOR
    2007-06-27 10:48:38 CDT - ADPlugin: Did DC search with queryFilter = (&(objectCategory=cn=person,cn=schema,cn=configuration,dc=domain,dc=com,dc=mx)( displayName=administrator)), limit 1
    2007-06-27 10:48:38 CDT - ADPlugin: Failed getting credentials at line 2687 in ADSEngine.mm
    2007-06-27 10:48:38 CDT - ADPlugin: 16784372 - Put 0 records in Buffer for AttributeValueSearch
    2007-06-27 10:48:38 CDT - ADPlugin: Calling GetRecordList
    2007-06-27 10:48:38 CDT - ADPlugin: 16784372 - Calling GetRecordList Routine
    2007-06-27 10:48:38 CDT - ADPlugin: Search Records called in ADSWrapper
    2007-06-27 10:48:38 CDT - ADPlugin: Searching attribute: dsAttrTypeStandard:RecordName
    2007-06-27 10:48:38 CDT - ADPlugin: Locating User with Query (&(objectCategory=person)(|(cn=ADMINISTRATOR)(sAMAccountName=ADMINISTRATOR)(dis playName=ADMINISTRATOR)(mail=ADMINISTRATOR)(userPrincipalName=ADMINISTRATOR)(use rPrincipalName=ADMINISTRATOR@*)))
    2007-06-27 10:48:38 CDT - ADPlugin: Failed getting credentials at line 2687 in ADSEngine.mm
    2007-06-27 10:48:38 CDT - ADPlugin: Failed getting credentials at line 2687 in ADSEngine.mm
    2007-06-27 10:48:38 CDT - ADPlugin: Returning 0 Results
    2007-06-27 10:48:38 CDT - ADPlugin: 16784372 - Put 0 records in Buffer for RecordList
    2007-06-27 10:48:38 CDT - ADPlugin: Calling AttributeValueSearch
    2007-06-27 10:48:38 CDT - ADPlugin: Search Records called in ADSWrapper
    2007-06-27 10:48:38 CDT - ADPlugin: Searching attribute: dsAttrTypeStandard:RealName
    2007-06-27 10:48:38 CDT - ADPlugin: Adding Search for Attribute displayName containing ADMINISTRATOR
    2007-06-27 10:48:38 CDT - ADPlugin: Did DC search with queryFilter = (&(objectCategory=cn=person,cn=schema,cn=configuration,dc=domain,dc=com,dc=mx)( displayName=ADMINISTRATOR)), limit 1
    2007-06-27 10:48:38 CDT - ADPlugin: Failed getting credentials at line 2687 in ADSEngine.mm
    2007-06-27 10:48:38 CDT - ADPlugin: 16784372 - Put 0 records in Buffer for AttributeValueSearch
    2007-06-27 10:48:38 CDT - ADPlugin: Calling GetRecordList
    2007-06-27 10:48:38 CDT - ADPlugin: 16784372 - Calling GetRecordList Routine
    2007-06-27 10:48:38 CDT - ADPlugin: Search Records called in ADSWrapper
    2007-06-27 10:48:38 CDT - ADPlugin: Searching attribute: dsAttrTypeStandard:RecordName
    2007-06-27 10:48:38 CDT - ADPlugin: Searching domain domain.com.mx for User administrator
    2007-06-27 10:48:38 CDT - ADPlugin: Failed getting credentials at line 2687 in ADSEngine.mm
    2007-06-27 10:48:38 CDT - ADPlugin: Returning 0 Results
    2007-06-27 10:48:38 CDT - ADPlugin: 16784372 - Put 0 records in Buffer for RecordList
    2007-06-27 10:48:38 CDT - ADPlugin: Calling AttributeValueSearch
    2007-06-27 10:48:38 CDT - ADPlugin: Search Records called in ADSWrapper
    2007-06-27 10:48:38 CDT - ADPlugin: Searching attribute: dsAttrTypeStandard:RealName
    2007-06-27 10:48:38 CDT - ADPlugin: Adding Search for Attribute displayName containing DOMAIN\administrator
    2007-06-27 10:48:38 CDT - ADPlugin: Did DC search with queryFilter = (&(objectCategory=cn=person,cn=schema,cn=configuration,dc=domain,dc=com,dc=mx)( displayName=DOMAIN\\administrator)), limit 1
    2007-06-27 10:48:38 CDT - ADPlugin: Failed getting credentials at line 2687 in ADSEngine.mm
    2007-06-27 10:48:38 CDT - ADPlugin: 16784372 - Put 0 records in Buffer for AttributeValueSearch
    2007-06-27 10:48:38 CDT - ADPlugin: Calling GetRecordList
    2007-06-27 10:48:38 CDT - ADPlugin: 16784372 - Calling GetRecordList Routine
    2007-06-27 10:48:38 CDT - ADPlugin: Search Records called in ADSWrapper
    2007-06-27 10:48:38 CDT - ADPlugin: Searching attribute: dsAttrTypeStandard:RecordName
    2007-06-27 10:48:38 CDT - ADPlugin: Searching domain domain.com.mx for User administrator
    2007-06-27 10:48:38 CDT - ADPlugin: Failed getting credentials at line 2687 in ADSEngine.mm
    2007-06-27 10:48:38 CDT - ADPlugin: Returning 0 Results
    2007-06-27 10:48:38 CDT - ADPlugin: 16784372 - Put 0 records in Buffer for RecordList
    2007-06-27 10:48:38 CDT - ADPlugin: Calling AttributeValueSearch
    2007-06-27 10:48:38 CDT - ADPlugin: Search Records called in ADSWrapper
    2007-06-27 10:48:38 CDT - ADPlugin: Searching attribute: dsAttrTypeStandard:RealName
    2007-06-27 10:48:38 CDT - ADPlugin: Adding Search for Attribute displayName containing domain\administrator
    2007-06-27 10:48:38 CDT - ADPlugin: Did DC search with queryFilter = (&(objectCategory=cn=person,cn=schema,cn=configuration,dc=domain,dc=com,dc=mx)( displayName=domain\\administrator)), limit 1
    2007-06-27 10:48:38 CDT - ADPlugin: Failed getting credentials at line 2687 in ADSEngine.mm
    2007-06-27 10:48:38 CDT - ADPlugin: 16784372 - Put 0 records in Buffer for AttributeValueSearch
    2007-06-27 10:48:38 CDT - ADPlugin: Calling GetRecordList
    2007-06-27 10:48:38 CDT - ADPlugin: 16784372 - Calling GetRecordList Routine
    2007-06-27 10:48:38 CDT - ADPlugin: Search Records called in ADSWrapper
    2007-06-27 10:48:38 CDT - ADPlugin: Searching attribute: dsAttrTypeStandard:RecordName
    2007-06-27 10:48:38 CDT - ADPlugin: Searching domain domain.com.mx for User ADMINISTRATOR
    2007-06-27 10:48:38 CDT - ADPlugin: Failed getting credentials at line 2687 in ADSEngine.mm
    2007-06-27 10:48:38 CDT - ADPlugin: Returning 0 Results
    2007-06-27 10:48:38 CDT - ADPlugin: 16784372 - Put 0 records in Buffer for RecordList
    2007-06-27 10:48:38 CDT - ADPlugin: Calling AttributeValueSearch
    2007-06-27 10:48:38 CDT - ADPlugin: Search Records called in ADSWrapper
    2007-06-27 10:48:38 CDT - ADPlugin: Searching attribute: dsAttrTypeStandard:RealName
    2007-06-27 10:48:38 CDT - ADPlugin: Adding Search for Attribute displayName containing DOMAIN\ADMINISTRATOR
    2007-06-27 10:48:38 CDT - ADPlugin: Did DC search with queryFilter = (&(objectCategory=cn=person,cn=schema,cn=configuration,dc=domain,dc=com,dc=mx)( displayName=DOMAIN\\ADMINISTRATOR)), limit 1
    2007-06-27 10:48:38 CDT - ADPlugin: Failed getting credentials at line 2687 in ADSEngine.mm
    2007-06-27 10:48:38 CDT - ADPlugin: 16784372 - Put 0 records in Buffer for AttributeValueSearch
    2007-06-27 10:48:38 CDT - ADPlugin: Calling GetRecordList
    2007-06-27 10:48:38 CDT - ADPlugin: 16784372 - Calling GetRecordList Routine
    2007-06-27 10:48:38 CDT - ADPlugin: Search Records called in ADSWrapper
    2007-06-27 10:48:38 CDT - ADPlugin: Searching attribute: dsAttrTypeStandard:RecordName
    2007-06-27 10:48:38 CDT - ADPlugin: Locating User with Query (&(objectCategory=person)(|(cn=administrator)(sAMAccountName=administrator)(dis playName=administrator)(mail=administrator)(userPrincipalName=administrator)(use rPrincipalName=administrator@*)))
    2007-06-27 10:48:38 CDT - ADPlugin: Failed getting credentials at line 2687 in ADSEngine.mm
    2007-06-27 10:48:38 CDT - ADPlugin: Failed getting credentials at line 2687 in ADSEngine.mm
    2007-06-27 10:48:38 CDT - ADPlugin: Returning 0 Results
    2007-06-27 10:48:38 CDT - ADPlugin: 16784372 - Put 0 records in Buffer for RecordList
    2007-06-27 10:48:38 CDT - ADPlugin: Calling AttributeValueSearch
    2007-06-27 10:48:38 CDT - ADPlugin: Search Records called in ADSWrapper
    2007-06-27 10:48:38 CDT - ADPlugin: Searching attribute: dsAttrTypeStandard:RealName
    2007-06-27 10:48:38 CDT - ADPlugin: Adding Search for Attribute displayName containing ADMINISTRATOR
    2007-06-27 10:48:38 CDT - ADPlugin: Did DC search with queryFilter = (&(objectCategory=cn=person,cn=schema,cn=configuration,dc=domain,dc=com,dc=mx)( displayName=administrator)), limit 1
    2007-06-27 10:48:38 CDT - ADPlugin: Failed getting credentials at line 2687 in ADSEngine.mm
    2007-06-27 10:48:38 CDT - ADPlugin: 16784372 - Put 0 records in Buffer for AttributeValueSearch
    2007-06-27 10:48:38 CDT - ADPlugin: Calling GetRecordList
    2007-06-27 10:48:38 CDT - ADPlugin: 16784372 - Calling GetRecordList Routine
    2007-06-27 10:48:38 CDT - ADPlugin: Search Records called in ADSWrapper
    2007-06-27 10:48:38 CDT - ADPlugin: Searching attribute: dsAttrTypeStandard:RecordName
    2007-06-27 10:48:38 CDT - ADPlugin: Locating User with Query (&(objectCategory=person)(|(cn=ADMINISTRATOR)(sAMAccountName=ADMINISTRATOR)(dis playName=ADMINISTRATOR)(mail=ADMINISTRATOR)(userPrincipalName=ADMINISTRATOR)(use rPrincipalName=ADMINISTRATOR@*)))
    2007-06-27 10:48:38 CDT - ADPlugin: Failed getting credentials at line 2687 in ADSEngine.mm
    2007-06-27 10:48:38 CDT - ADPlugin: Failed getting credentials at line 2687 in ADSEngine.mm
    2007-06-27 10:48:38 CDT - ADPlugin: Returning 0 Results
    2007-06-27 10:48:38 CDT - ADPlugin: 16784372 - Put 0 records in Buffer for RecordList
    2007-06-27 10:48:38 CDT - ADPlugin: Calling AttributeValueSearch
    2007-06-27 10:48:38 CDT - ADPlugin: Search Records called in ADSWrapper
    2007-06-27 10:48:38 CDT - ADPlugin: Searching attribute: dsAttrTypeStandard:RealName
    2007-06-27 10:48:38 CDT - ADPlugin: Adding Search for Attribute displayName containing ADMINISTRATOR
    2007-06-27 10:48:38 CDT - ADPlugin: Did DC search with queryFilter = (&(objectCategory=cn=person,cn=schema,cn=configuration,dc=domain,dc=com,dc=mx)( displayName=ADMINISTRATOR)), limit 1
    2007-06-27 10:48:38 CDT - ADPlugin: Failed getting credentials at line 2687 in ADSEngine.mm
    2007-06-27 10:48:38 CDT - ADPlugin: 16784372 - Put 0 records in Buffer for AttributeValueSearch
    2007-06-27 10:48:38 CDT - ADPlugin: Calling GetRecordList
    2007-06-27 10:48:38 CDT - ADPlugin: 16784372 - Calling GetRecordList Routine
    2007-06-27 10:48:38 CDT - ADPlugin: Search Records called in ADSWrapper
    2007-06-27 10:48:38 CDT - ADPlugin: Searching attribute: dsAttrTypeStandard:RecordName
    2007-06-27 10:48:38 CDT - ADPlugin: Locating User with Query (&(objectCategory=person)(|(cn=administrator)(sAMAccountName=administrator)(dis playName=administrator)(mail=administrator)(userPrincipalName=administrator)(use rPrincipalName=administrator@*)))
    2007-06-27 10:48:38 CDT - ADPlugin: Failed getting credentials at line 2687 in ADSEngine.mm
    2007-06-27 10:48:38 CDT - ADPlugin: Failed getting credentials at line 2687 in ADSEngine.mm
    2007-06-27 10:48:38 CDT - ADPlugin: Returning 0 Results
    2007-06-27 10:48:38 CDT - ADPlugin: 16784372 - Put 0 records in Buffer for RecordList
    2007-06-27 10:48:38 CDT - ADPlugin: Calling AttributeValueSearch
    2007-06-27 10:48:38 CDT - ADPlugin: Search Records called in ADSWrapper
    2007-06-27 10:48:38 CDT - ADPlugin: Searching attribute: dsAttrTypeStandard:RealName
    2007-06-27 10:48:38 CDT - ADPlugin: Adding Search for Attribute displayName containing ADMINISTRATOR
    2007-06-27 10:48:38 CDT - ADPlugin: Did DC search with queryFilter = (&(objectCategory=cn=person,cn=schema,cn=configuration,dc=domain,dc=com,dc=mx)( displayName=administrator)), limit 1
    2007-06-27 10:48:38 CDT - ADPlugin: Failed getting credentials at line 2687 in ADSEngine.mm
    2007-06-27 10:48:38 CDT - ADPlugin: 16784372 - Put 0 records in Buffer for AttributeValueSearch
    2007-06-27 10:48:38 CDT - ADPlugin: Calling GetRecordList
    2007-06-27 10:48:38 CDT - ADPlugin: 16784372 - Calling GetRecordList Routine
    2007-06-27 10:48:38 CDT - ADPlugin: Search Records called in ADSWrapper
    2007-06-27 10:48:38 CDT - ADPlugin: Searching attribute: dsAttrTypeStandard:RecordName
    2007-06-27 10:48:38 CDT - ADPlugin: Locating User with Query (&(objectCategory=person)(|(cn=ADMINISTRATOR)(sAMAccountName=ADMINISTRATOR)(dis playName=ADMINISTRATOR)(mail=ADMINISTRATOR)(userPrincipalName=ADMINISTRATOR)(use rPrincipalName=ADMINISTRATOR@*)))
    2007-06-27 10:48:38 CDT - ADPlugin: Failed getting credentials at line 2687 in ADSEngine.mm
    2007-06-27 10:48:38 CDT - ADPlugin: Failed getting credentials at line 2687 in ADSEngine.mm
    2007-06-27 10:48:38 CDT - ADPlugin: Returning 0 Results
    2007-06-27 10:48:38 CDT - ADPlugin: 16784372 - Put 0 records in Buffer for RecordList
    2007-06-27 10:48:38 CDT - ADPlugin: Calling AttributeValueSearch
    2007-06-27 10:48:38 CDT - ADPlugin: Search Records called in ADSWrapper
    2007-06-27 10:48:38 CDT - ADPlugin: Searching attribute: dsAttrTypeStandard:RealName
    2007-06-27 10:48:38 CDT - ADPlugin: Adding Search for Attribute displayName containing ADMINISTRATOR
    2007-06-27 10:48:38 CDT - ADPlugin: Did DC search with queryFilter = (&(objectCategory=cn=person,cn=schema,cn=configuration,dc=domain,dc=com,dc=mx)( displayName=ADMINISTRATOR)), limit 1
    2007-06-27 10:48:38 CDT - ADPlugin: Failed getting credentials at line 2687 in ADSEngine.mm
    2007-06-27 10:48:38 CDT - ADPlugin: 16784372 - Put 0 records in Buffer for AttributeValueSearch
    2007-06-27 10:48:38 CDT - ADPlugin: Calling OpenDirNode
    2007-06-27 10:48:38 CDT - ADPlugin: Opening Specific Node domain.com.mx
    2007-06-27 10:48:38 CDT - ADPlugin: Calling GetRecordList
    2007-06-27 10:48:38 CDT - ADPlugin: 16833877 - Calling GetRecordList Routine
    2007-06-27 10:48:38 CDT - ADPlugin: Search Records called in ADSWrapper
    2007-06-27 10:48:38 CDT - ADPlugin: Searching attribute: dsAttrTypeStandard:RecordName
    2007-06-27 10:48:38 CDT - ADPlugin: Locating User with Query (&(objectCategory=person)(|(cn=administrator)(sAMAccountName=administrator)(dis playName=administrator)(mail=administrator)(userPrincipalName=administrator)(use rPrincipalName=administrator@*)))
    2007-06-27 10:48:38 CDT - ADPlugin: Failed getting credentials at line 2687 in ADSEngine.mm
    2007-06-27 10:48:38 CDT - ADPlugin: Failed getting credentials at line 2687 in ADSEngine.mm
    2007-06-27 10:48:38 CDT - ADPlugin: Returning 0 Results
    2007-06-27 10:48:38 CDT - ADPlugin: 16833877 - Put 0 records in Buffer for RecordList
    2007-06-27 10:48:38 CDT - ADPlugin: Calling CloseDirNode
    2007-06-27 10:48:42 CDT - ADPlugin: Calling OpenDirNode
    2007-06-27 10:48:43 CDT - ADPlugin: Opening Specific Node domain.com.mx
    2007-06-27 10:48:43 CDT - ADPlugin: Calling GetRecordList
    2007-06-27 10:48:43 CDT - ADPlugin: 16833881 - Calling GetRecordList Routine
    2007-06-27 10:48:43 CDT - ADPlugin: Search Records called in ADSWrapper
    2007-06-27 10:48:43 CDT - ADPlugin: Searching attribute: dsAttrTypeStandard:RecordName
    2007-06-27 10:48:43 CDT - ADPlugin: Locating User with Query (&(objectCategory=person)(|(cn=administrator)(sAMAccountName=administrator)(dis playName=administrator)(mail=administrator)(userPrincipalName=administrator)(use rPrincipalName=administrator@*)))
    2007-06-27 10:48:43 CDT - ADPlugin: Failed getting credentials at line 2687 in ADSEngine.mm
    2007-06-27 10:48:43 CDT - ADPlugin: Failed getting credentials at line 2687 in ADSEngine.mm
    2007-06-27 10:48:43 CDT - ADPlugin: Returning 0 Results
    2007-06-27 10:48:43 CDT - ADPlugin: 16833881 - Put 0 records in Buffer for RecordList
    2007-06-27 10:48:43 CDT - ADPlugin: Calling CloseDirNode
    I really don't know what to do. The Windows Event log shows no messages. The link used to work and there have been no changes in the domain servers.
    The key line seems to be:
    2007-06-27 10:48:43 CDT - ADPlugin: Failed getting credentials at line 2687 in ADSEngine.mm
    But I don't know what that ADSEngine.mm is.
    XServe G5   Mac OS X (10.4.9)  

    Hello.
    Thanks for your reply.
    I tried the net use with a drive letter with and without the /user switch. When I use a domain user domain\user1 I can't connect. When I use a user local to the XServe it works.
    When I use
    net use x: \\10.0.0.1\share /user:domain\user1
    I get prompted for a password, but it doesn't work.
    I checked the firewall and all packets to or from the mac are accepted, no denied or dropped packages.
    I already went through the MS document on fw ports. Before I opened to Kerberos ports the binding failed. No the binding work OK.
    Some users who were authenticated yesterday still can access files using the Windows domain accounts. It's new users trying to connect those who have problems.
    This is what the Samba log.smbd log shows:
    [2007/07/04 14:58:45, 2] /SourceCache/samba/samba-100.7/samba/source/smbd/sesssetup.c:setupnew_vcsession(662)
    setupnew_vcsession: New VC == 0, if NT4.x compatible we would close all old resources.
    [2007/07/04 14:58:45, 2] /SourceCache/samba/samba-100.7/samba/source/smbd/sesssetup.c:setupnew_vcsession(662)
    setupnew_vcsession: New VC == 0, if NT4.x compatible we would close all old resources.
    [2007/07/04 14:58:46, 0] /SourceCache/samba/samba-100.7/samba/source/auth/authutil.c:make_server_infoinfo3(1138)
    makeserver_infoinfo3: pdbinitsam failed!
    [2007/07/04 14:58:46, 0] pdbods.c:odssamgetsampwnam(2329)
    odssam_getsampwnam: [0]getsam_recordattributes dsRecTypeStandard:Users no account for 'user1'!
    [2007/07/04 14:58:46, 2] /SourceCache/samba/samba-100.7/samba/source/auth/auth.c:checkntlmpassword(367)
    checkntlmpassword: Authentication for user [user1] -> [user1] FAILED with error NTSTATUS_NO_SUCHUSER
    This is what the DS log shows:
    2007-07-04 14:58:46 CDT - ADPlugin: 16892201 - Calling GetRecordList Routine
    2007-07-04 14:58:46 CDT - ADPlugin: Search Records called in ADSWrapper
    2007-07-04 14:58:46 CDT - ADPlugin: Searching attribute: dsAttrTypeStandard:RecordName
    2007-07-04 14:58:46 CDT - ADPlugin: Locating User with Query (&(objectCategory=person)(|(cn=user1)(sAMAccountName=user1)(displayName=user1)( mail=user1)(userPrincipalName=user1)(userPrincipalName=user1@*)))
    2007-07-04 14:58:46 CDT - ADPlugin: Failed getting credentials at line 2687 in ADSEngine.mm
    2007-07-04 14:58:46 CDT - ADPlugin: Failed getting credentials at line 2687 in ADSEngine.mm
    2007-07-04 14:58:46 CDT - ADPlugin: Returning 0 Results
    2007-07-04 14:58:46 CDT - ADPlugin: 16892201 - Put 0 records in Buffer for RecordList
    XServe G5   Mac OS X (10.4.9)  

  • Problems with Active Directory Users showing as not found in Open Directory work group manager

    I’m running a golden triangle setup with Open directory assigning group policy and authentication provide by active directory. In workgroup manager I can search through the AD and add users or computers to groups in OD workgroup manager. However when I save and refresh the users or computer appear as ‘not found’. Is there a reason for this?

    Hi Zero
    It's very reassuring to know im not the only one having issues with this..
    Im on my second re install of the server.. I like you have no wish to do another clean install as everything else is connected and it seems like the answer is probably very simple.
    So today im going to re- run the terminal commands as layed out in the online guides.
    However i was kinda hoping someone would be able to supply us with an answer.
    thanks
    J

  • ACS 4.2.0.124 Appliance with Active Directory with windows 2008

    we have a solutions of 802.1x with Cisco ACS appliance wich is working fine, the soluction include two ACS appliance version 4.2.0.124, 02 remote Agent wich is setting up on windows 2003. The remote agent is integrated with Active Directory windows 2003. The computers have windows XP with service pack 2 and service pack 3, all computers do machine authentication and then user authentication. My customer in thinking in migrate the Active Directory windows 2003 to windows 2008. My question is ¿there wil be some problem with Active Directory 2008 with the current soluctión of ACS and 802.1x solution ? or I will have to do aditional task.     
    Marco

    Hi,
    You can find the suported Windows Server versions on the online documentation:
    ACS 4.2: http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.2/installation/guide/windows/install.html#wp1041376.
    ACS 4.2.1: http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.2.1/Installation_Guide/windows/install.html#wp1041376.
    So, i would suggest you to double-check carefuly the Release and Service Pack of the new 2008 Servers and also the OS bit version to make sure you migrate to Win2008 but continue on a supported scenario.
    HTH,
    Tiago
    If   this helps you and/or answers your question please mark the question  as  "answered" and/or rate it, so other users can easily find it.

  • Sync external database with Active Directory

    Hi,
    We are in the process of consolitating all user information in our systems in Active Directory.
    We have a system that can only authenicate users from information stored in a relational database. We are investigating options that would allow us to sync the password in this relational database with the password stored in Active Directory. Whenever the user changes their domain password, we would like for an JNDI application to update the relational database with their new password.
    I'm fairly new to JNDI/Active Directory. My research does not look too positive. Does anybody know of any way that we can perform this password synchronization? Any advice would be greatly appreciated!
    Thanks!
    Dave

    There are several mechanisms available that enable AD to authenticate users for your web application.
    1. Perform a simple LDAP bind using the user's credentials submitted from a form. If the bind is successful, then you can infer that the credentials are correct.
    2. If the users have already performed an interactive logon to Active Directory, provide a Single Sign-On experience by utilizing their existing Kerberos ticket. Refer to JNDI, Active Directory and Authentication (Part 1) (Kerberos)
    http://forum.java.sun.com/thread.jspa?threadID=579829&tstart=300
    for an explanation of using Kerberos & GSS-API.
    3. If the users are not performing an interactive logon to your Active Directory, but you want to provide a federated single sign-on experience, then you may be interested in Active Directory Federation Services which uses SAML 1.0 tokens & WS-* to assert claims. Information on ADFS can be found at http://www.microsoft.com/windowsserver2003/techinfo/overview/adfsoverview.mspx
    Two third party ISV's; Vintela and Centrify both provide solutions for non-Windows Web Servers to enable the second & third scenarios.

  • TFS 2010 with Active Directory 2012 R2

    Are there any known problems using TFS 2010 with Active Directory 2012 R2? Domain controllers are being updated from 2003 to 2012 R2, and the Domain/Forest mode will be set to AD DS Server 2012R2, value=6.
    James Bristow, Software Configuration Manager

    Hi James, 
    Thanks for your post.
    Your AD 2012 R2 will running on your Windows Server 2012 R2 machine, right? Please note that: TFS 2010 not support Windows Server 2012 R2, so you cannot install TFS 2010 Server on this Windows Server 2012 R2 machine. Please refer to this document:
    https://msdn.microsoft.com/en-us/library/dd578592.aspx.
    As far as I know TFS 2010 works fine with AD 2012 R2, so you can install your TFS 2010 another machine and use this AD 2012 R2 Server.
    We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
    Click
    HERE to participate the survey.

  • LDAP realm with Active Directory

    Hello,
    In the sun one app server admin console i have set the security role to LDAP.
    I have set up security roles in my web.xml such as this:
    <security-role>
    <description>This role represents administrators of the system, see actor administrators</description>
    <role-name>administrators</role-name>
    </security-role>
    ..and mapped the roles to groups in sun-application as follows:
    <security-role-mapping>
    <role-name>administrators</role-name>
    <group-name>CMS_PM</group-name>
    <principal-name>rlancett</principal-name>
    </security-role-mapping>
    My user and group information is stored in Active Directory so I have tried to configure the ldap realm in the admin console to get it working. These are the settings i have put in:
    directory: ldap://earth.tier2consulting.com:389
    base-dn: cn=Users,dc=tier2consulting,dc=com
    jaas-context: ldapRealm
    search-bind-dn: cn=administrator,cn=Users,dc=domain,dc=com
    search-bind-password: ******
    search-filter: sAMAccountName=%s
    I get the error message :javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C09030B, comment: AcceptSecurityContext error, data 525, v893
    WARNING: va:850)
    FINEST: JAAS authentication aborted.
    INFO: SEC5046: Audit: Authentication refused for [administrator].
    I am pretty stuck on this having looked arounds all the forums:
    Has anyone got sun one app server using Active Directory to get user/group information for security roles?
    Thanks.

    Howdy,
    I don't have a solution to your problem, but maybe this tid-bit will help in debugging with Active Directory error messages. I'm new to AD, so excuse me if everyone already knows this, but...
    The error message you get back from the directory contains an error code in hexidecimal:
    LDAP: error code 49 - 80090308: LdapErr: DSID-0C09030B, comment: AcceptSecurityContext error, data 525, v893
    If you translate '525' from hex to decimal you get '1317' which is the error message you can look up here:
    http://msdn.microsoft.com/library/default.asp?url=/library/en-us/debug/base/system_error_codes.asp
    1317 - ERROR_NO_SUCH_USER - The specified user does not exist.
    It took me a while to find this tip, so I thought I'd share it. Oh, and the easy way to get decimal from hexidecimal is:
    System.out.println( "Here is 525 in decimal: " + Integer.parseInt("525", 16));
    Okay, hope this helps somebody.
    Now it's up to you to find out why it can't find the administrator!
    Craig

  • 10.6 home directory mounting with active directory and open directory integration

    Hi guys i am having some issues in my new mac environment. I have a windows network with an server 2008 active directory. I have just recentlly created a "magic triangle" setup with active directory and open directory. When my users login via windows their home folders mount perfect. When any user logs in to any iMac in the building it does not work. They login perfectly fine, but their home folders do not mount. When i try mounting them manually with smb, i get a prompt for credentials. I am thinking this is my issue, my Single sign on with kerbos is working but for some reason is not logging in correctly. If i type in my credentials with my domain first then my name it works.
    For example DOMAIN\jsmith works, but the way i think the mac and active directory is doing it now is just jsmith without the DOMAIN.
    I feel like this is the problem with the home folders not mounting.
    Can anyone provide some help with this?
    Thanks,
    Dani

    Hi dani190,
    are you using the fully qualified domain name of the network server? ie if your server is bob. and your domain is domain.company.com. then the FQDNS would typically be bob.domain.company.com or bob.company.com.
    If the FQDNS works, then have you checked in the AD to make sure the path to the network home folder uses the FQDNS?
    For the contact search path, did you put the AD at the top the list? (in directory utility)
    Did you set the WINS work group on your client computer to your domain?
    ie:Apple Menu, System Preferences, Network, Active Network Port (ethernet and or airport) , Advanced Button, WINS Tab, set workgroup to the name of your domain. ie domain.company.com and or company.com

  • SQL Server 2000\2005 compatibility with Active Directory 2012

    Hi All,
    We are currently using Active Directory 2003 and will be upgrading to AD 2012.  I'm trying to determine if there is any known compatibility issues when running older versions of SQL Server (2000 and 2005) when upgrading to AD 2012.   I've
    read forums from when others went from AD 2003 to AD 2008 and didn't experience any issues.  We have the newer versions of SQL but I'm not too concerned about these.  Any advice would be greatly appreciated?   Has anyone been through
    this process. 
    Thanks,

    Hi CraftsmanRobert,
    Based on my understanding, you used Active Directory 2003, then it would be upgraded to Active Directory 2012. You wanted to run older versions of SQL Server (2000 and 2005) with Active Directory 2012.
    Firstly, there can be a compatibility problem when run older version with Active Directory 2012. SQL Server 2005 (the release version and service packs) and earlier versions of SQL Server are not supported on Windows Server 2012 R2, Windows Server 2012,
    Windows 8.1, or Windows 8. For more information, please refer to this article: How to use SQL Server in Windows and Windows Server environments (http://support.microsoft.com/kb/2681562/en-us).
    Besides, Microsoft doesn’t provide assisted support for SQL Server 2000 and SQL Server 2005 already. Please upgrade the existing instance of SQL Server 2000 and SQL Server 2005 to a new version like SQL Server 2012. You can download SQL Server 2012 Express
    from this link:
    http://www.microsoft.com/en-us/download/details.aspx?id=29062.
    Best regards,
    Qiuyun Yu

  • Issue in ldap-sync with active directory - OIM11gR2

    Hi Expert,
    I have enabled the ldap-sync with Active Directory in OIM11gR2. I followed the below document to enable the ldap-sync.
    Enabling LDAP Synchronization in Oracle Identity Manager - 11g Release 2 (11.1.2)
    For testing if ldap sync is working on not . I run the LDAPSync Post Enable Provision Users to LDAP schedule job. While running the job i encounter below exception in log. Please provide me some pointer to solve my issue. How we can sure ldap sync is configure properly? Please provide me some steps to test it out?
    <Jul 31, 2013 9:51:25 AM PDT> <Warning> <JMS> <BEA-040442> <While attempting to bind JNDI name jms/b2b/B2BEventQueue for destination SOAJMSModule!dist_B2BEventQueue_auto_1_auto in module null a JNDI name conflict was found. This destination has not been bound into JNDI.>
    <Jul 31, 2013 9:51:25 AM PDT> <Error> <oracle.iam.platform.entitymgr.provider.ldap> <BEA-000000> <An error occurred while searching the entity in LDAP, and the corresponding error is - {0}
    javax.naming.NameNotFoundException: Error: NO_SUCH_OBJECT
    LDAP Error 32 : No Such Object [Root exception is oracle.ods.virtualization.service.VirtualizationException: oracle.ods.virtualization.engine.util.DirectoryException: LDAP Error 32 : No Such Object]
      at oracle.ods.virtualization.jndi.OVDUtil.mapErrorCode(OVDUtil.java:151)
      at oracle.ods.virtualization.jndi.OVDContext.search(OVDContext.java:439)
      at javax.naming.directory.InitialDirContext.search(InitialDirContext.java:257)
      at oracle.iam.platform.entitymgr.provider.ldap.LDAPUtil.search(LDAPUtil.java:1073)
      at oracle.iam.platform.entitymgr.provider.ldap.LDAPDataProvider.search(LDAPDataProvider.java:1218)
      at oracle.iam.ldapsync.impl.util.CommonNamePolicyUtil.isUserExists(CommonNamePolicyUtil.java:84)
      at oracle.iam.ldapsync.impl.util.CommonNameGenerationUtil.isCommonNameExistingOrReserved(CommonNameGenerationUtil.java:192)
      at oracle.iam.ldapsync.impl.plugins.FirstNameLastNamePolicy.getCommonNameFromPolicy(FirstNameLastNamePolicy.java:157)
      at oracle.iam.ldapsync.impl.util.CommonNameGenerationUtil.generateCommonName(CommonNameGenerationUtil.java:116)
      at oracle.iam.ldapsync.impl.util.CommonNameGenerationUtil.generateCommonName(CommonNameGenerationUtil.java:82)
      at oracle.iam.oimtoldap.impl.SeedOIMDataInLDAPImpl.createUserInLDAP(SeedOIMDataInLDAPImpl.java:182)
      at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
      at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
      at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
      at java.lang.reflect.Method.invoke(Method.java:597)
      at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:307)
      at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:182)
      at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:149)
      at oracle.iam.platform.utils.DMSMethodInterceptor.invoke(DMSMethodInterceptor.java:25)
      at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:171)
      at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:204)
      at $Proxy710.createUserInLDAP(Unknown Source)
      at oracle.iam.oimtoldap.api.SeedOIMDataInLDAPEJB.createUserInLDAPx(Unknown Source)
      at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
      at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
      at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
      at java.lang.reflect.Method.invoke(Method.java:597)
      at com.bea.core.repackaged.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:310)
      at com.bea.core.repackaged.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:182)
      at com.bea.core.repackaged.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:149)
      at com.bea.core.repackaged.springframework.aop.support.DelegatingIntroductionInterceptor.doProceed(DelegatingIntroductionInterceptor.java:131)
      at com.bea.core.repackaged.springframework.aop.support.DelegatingIntroductionInterceptor.invoke(DelegatingIntroductionInterceptor.java:119)
      at com.bea.core.repackaged.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:171)
      at com.oracle.pitchfork.spi.MethodInvocationVisitorImpl.visit(MethodInvocationVisitorImpl.java:34)
      at weblogic.ejb.container.injection.EnvironmentInterceptorCallbackImpl.callback(EnvironmentInterceptorCallbackImpl.java:54)
      at com.oracle.pitchfork.spi.EnvironmentInterceptor.invoke(EnvironmentInterceptor.java:42)
      at com.bea.core.repackaged.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:171)
      at com.bea.core.repackaged.springframework.aop.interceptor.ExposeInvocationInterceptor.invoke(ExposeInvocationInterceptor.java:89)
      at com.bea.core.repackaged.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:171)
      at com.bea.core.repackaged.springframework.aop.support.DelegatingIntroductionInterceptor.doProceed(DelegatingIntroductionInterceptor.java:131)
      at com.bea.core.repackaged.springframework.aop.support.DelegatingIntroductionInterceptor.invoke(DelegatingIntroductionInterceptor.java:119)
      at com.bea.core.repackaged.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:171)
      at com.bea.core.repackaged.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:204)
      at $Proxy709.createUserInLDAPx(Unknown Source)
      at oracle.iam.oimtoldap.api.SeedOIMDataInLDAP_8d8qil_SeedOIMDataInLDAPRemoteImpl.__WL_invoke(Unknown Source)
      at weblogic.ejb.container.internal.SessionRemoteMethodInvoker.invoke(SessionRemoteMethodInvoker.java:40)
      at oracle.iam.oimtoldap.api.SeedOIMDataInLDAP_8d8qil_SeedOIMDataInLDAPRemoteImpl.createUserInLDAPx(Unknown Source)
      at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
      at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
      at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
      at java.lang.reflect.Method.invoke(Method.java:597)
      at weblogic.ejb.container.internal.RemoteBusinessIntfProxy.invoke(RemoteBusinessIntfProxy.java:85)
      at $Proxy163.createUserInLDAPx(Unknown Source)
      at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
      at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
      at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
      at java.lang.reflect.Method.invoke(Method.java:597)
      at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:307)
      at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:198)
      at $Proxy707.createUserInLDAPx(Unknown Source)
      at oracle.iam.oimtoldap.api.SeedOIMDataInLDAPDelegate.createUserInLDAP(Unknown Source)
      at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
      at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
      at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
      at java.lang.reflect.Method.invoke(Method.java:597)
      at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:307)
      at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:182)
      at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:149)
      at oracle.iam.platform.utils.DMSMethodInterceptor.invoke(DMSMethodInterceptor.java:25)
      at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:171)
      at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:204)
      at $Proxy708.createUserInLDAP(Unknown Source)
      at oracle.iam.oimtoldap.scheduletasks.user.SeedOIMUsersInLDAP.execute(SeedOIMUsersInLDAP.java:59)
      at oracle.iam.scheduler.vo.TaskSupport$1.processWithoutResult(TaskSupport.java:135)
      at oracle.iam.platform.tx.OIMTransactionCallbackWithoutResult.process(OIMTransactionCallbackWithoutResult.java:9)
      at oracle.iam.platform.tx.OIMTransactionCallback.doInTransaction(OIMTransactionCallback.java:13)
      at oracle.iam.platform.tx.OIMTransactionCallback.doInTransaction(OIMTransactionCallback.java:6)
      at org.springframework.transaction.support.TransactionTemplate.execute(TransactionTemplate.java:128)
      at oracle.iam.platform.tx.OIMTransactionManager.execute(OIMTransactionManager.java:22)
      at oracle.iam.scheduler.vo.TaskSupport.executeJob(TaskSupport.java:116)
      at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
      at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
      at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
      at java.lang.reflect.Method.invoke(Method.java:597)
      at oracle.iam.scheduler.impl.quartz.QuartzJob$TaskExecutionAction.run(QuartzJob.java:266)
      at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:321)
      at weblogic.security.service.SecurityManager.runAs(SecurityManager.java:120)
      at weblogic.security.Security.runAs(Security.java:41)
      at Thor.API.Security.LoginHandler.weblogicLoginSession.runAs(weblogicLoginSession.java:52)
      at oracle.iam.scheduler.impl.quartz.QuartzJob.execute(QuartzJob.java:75)
      at org.quartz.core.JobRunShell.run(JobRunShell.java:202)
      at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:529)
    Caused By: oracle.ods.virtualization.service.VirtualizationException: oracle.ods.virtualization.engine.util.DirectoryException: LDAP Error 32 : No Such Object
      at oracle.ods.virtualization.operation.SearchOperation.process(SearchOperation.java:209)
      at oracle.ods.virtualization.operation.SearchOperation.process(SearchOperation.java:47)

    I have checked the OIM vs AD attribute mapping. now I am getting  below error. I have also attached the LDAPUsers.xml file . I don't know what went wrong .. How to test ldap-sync is configure properly? I created the user in OIM but in AD user is not getting created. I am not able to see any thing log file liek (dignostic and nohup log)  .. Any idea where I can see the log to identify the issue??
    g 1, 2013 8:15:15 AM PDT> <Warning> <JMS> <BEA-040442> <While attempting to bind JNDI name jms/b2b/B2BEventQueue for destination SOAJMSModule!dist_B2BEventQueue_auto_1_auto in module null a JNDI name conflict was found. This destination has not been bound into JNDI.>
    <Aug 1, 2013 8:15:15 AM PDT> <Warning> <oracle.ods.virtualization.engine.backend.jndi.LDAP1.ConnectionHandle> <OVD-40082> <Could not modify entry.
    javax.naming.OperationNotSupportedException: [LDAP: error code 53 - 0000001F: SvcErr: DSID-031A120C, problem 5003 (WILL_NOT_PERFORM), data 0
    <?xml version='1.0' encoding='UTF-8'?>
    <tns:entity-definition xmlns:tns="http://www.oracle.com/schema/oim/entity" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.oracle.com/schema/oim/entity ../entity.xsd ">
    <entity-type child-entity="false">LDAPUser</entity-type>
    <provider-instance>
    <repository-instance>Directory Server</repository-instance>
    <provider-type>LDAPDataProvider</provider-type>
    <parameters>
    <parameter name="base">
    <value>dc=cgtest,dc=adtest,dc=com</value>
    </parameter>
    <parameter name="rdnattribute">
    <value>cn</value>
    </parameter>
    <parameter name="objectclass">
    <value>orclIDXPerson</value>
    </parameter>
    <parameter name="idattribute">
    <value>objectGUID</value>
    </parameter>
    <parameter name="entityIdentifierObjectclass">
    <value>inetorgperson</value>
    </parameter>
    <parameter name="excludeObjectclass">
    <value>orclappiduser</value>
    </parameter>
    </parameters>
    </provider-instance>
    <container-capability>
    <enabled>false</enabled>
    </container-capability>
    <entity-attributes>
    <attribute name="User Login">
    <type>string</type>
    <required>true</required>
    <attribute-group>Basic</attribute-group>
    <searchable>true</searchable>
    </attribute>
    <attribute name="First Name">
    <type>string</type>
    <required>false</required>
    <attribute-group>Basic</attribute-group>
    <searchable>true</searchable>
    <MLS>false</MLS>
    </attribute>
    <attribute name="Last Name">
    <type>string</type>
    <required>true</required>
    <attribute-group>Basic</attribute-group>
    <searchable>true</searchable>
    <MLS>false</MLS>
    </attribute>
    <attribute name="Middle Name">
    <type>string</type>
    <required>false</required>
    <attribute-group>Basic</attribute-group>
    <searchable>true</searchable>
    <MLS>false</MLS>
    </attribute>
    <attribute name="Display Name">
    <type>string</type>
    <required>false</required>
    <attribute-group>Basic</attribute-group>
    <searchable>true</searchable>
    <MLS>false</MLS>
    <multi-represented>true</multi-represented>
    </attribute>
    <attribute name="usr_password">
    <type>string</type>
    <required>false</required>
    <attribute-group>Basic</attribute-group>
    <searchable>false</searchable>
    </attribute>
    <attribute name="LDAP GUID">
    <type>string</type>
    <required>false</required>
    <attribute-group>Basic</attribute-group>
    <searchable>true</searchable>
    </attribute>
    <attribute name="LDAP DN">
    <type>string</type>
    <required>false</required>
    <attribute-group>Basic</attribute-group>
    <searchable>true</searchable>
    </attribute>
    <attribute name="Role">
    <type>string</type>
    <required>false</required>
    <attribute-group>Basic</attribute-group>
    <searchable>true</searchable>
    </attribute>
    <attribute name="Email">
    <type>string</type>
    <required>false</required>
    <attribute-group>Basic</attribute-group>
    <searchable>true</searchable>
    </attribute>
    <attribute name="Start Date">
    <type>date</type>
    <required>false</required>
    <attribute-group>Basic</attribute-group>
    <searchable>true</searchable>
    </attribute>
    <attribute name="End Date">
    <type>date</type>
    <required>false</required>
    <attribute-group>Basic</attribute-group>
    <searchable>true</searchable>
    </attribute>
    <attribute name="usr_timezone">
    <type>string</type>
    <required>false</required>
    <attribute-group>Basic</attribute-group>
    <searchable>true</searchable>
    </attribute>
    <attribute name="usr_manager_key">
    <type>string</type>
    <required>false</required>
    <attribute-group>Basic</attribute-group>
    <searchable>true</searchable>
    </attribute>
    <attribute name="Country">
    <type>string</type>
    <required>false</required>
    <attribute-group>Basic</attribute-group>
    <searchable>true</searchable>
    </attribute>
    <attribute name="Department Number">
    <type>string</type>
    <required>false</required>
    <attribute-group>Basic</attribute-group>
    <searchable>true</searchable>
    </attribute>
    <attribute name="Description">
    <type>string</type>
    <required>false</required>
    <attribute-group>Basic</attribute-group>
    <searchable>true</searchable>
    </attribute>
    <attribute name="Common Name">
    <type>string</type>
    <required>false</required>
    <attribute-group>Basic</attribute-group>
    <searchable>true</searchable>
    <MLS>false</MLS>
    </attribute>
    <attribute name="Employee Number">
    <type>string</type>
    <required>false</required>
    <attribute-group>Basic</attribute-group>
    <searchable>true</searchable>
    </attribute>
    <attribute name="Fax">
    <type>string</type>
    <required>false</required>
    <attribute-group>Basic</attribute-group>
    <searchable>true</searchable>
    </attribute>
    <attribute name="Generation Qualifier">
    <type>string</type>
    <required>false</required>
    <attribute-group>Basic</attribute-group>
    <searchable>true</searchable>
    <MLS>false</MLS>
    </attribute>
    <attribute name="Hire Date">
    <type>date</type>
    <required>false</required>
    <attribute-group>Basic</attribute-group>
    <searchable>true</searchable>
    </attribute>
    <attribute name="Home Phone">
    <type>string</type>
    <required>false</required>
    <attribute-group>Basic</attribute-group>
    <searchable>true</searchable>
    </attribute>
    <attribute name="Home Postal Address">
    <type>string</type>
    <required>false</required>
    <attribute-group>Basic</attribute-group>
    <searchable>true</searchable>
    </attribute>
    <attribute name="Locality Name">
    <type>string</type>
    <required>false</required>
    <attribute-group>Basic</attribute-group>
    <searchable>true</searchable>
    </attribute>
    <attribute name="Mobile">
    <type>string</type>
    <required>false</required>
    <attribute-group>Basic</attribute-group>
    <searchable>true</searchable>
    </attribute>
    <attribute name="Pager">
    <type>string</type>
    <required>false</required>
    <attribute-group>Basic</attribute-group>
    <searchable>true</searchable>
    </attribute>
    <attribute name="Postal Address">
    <type>string</type>
    <required>false</required>
    <attribute-group>Basic</attribute-group>
    <searchable>true</searchable>
    <MLS>false</MLS>
    </attribute>
    <attribute name="Postal Code">
    <type>string</type>
    <required>false</required>
    <attribute-group>Basic</attribute-group>
    <searchable>true</searchable>
    </attribute>
    <attribute name="PO Box">
    <type>string</type>
    <required>false</required>
    <attribute-group>Basic</attribute-group>
    <searchable>true</searchable>
    </attribute>
    <attribute name="usr_locale">
    <type>string</type>
    <required>false</required>
    <attribute-group>Basic</attribute-group>
    <searchable>true</searchable>
    </attribute>
    <attribute name="State">
    <type>string</type>
    <required>false</required>
    <attribute-group>Basic</attribute-group>
    <searchable>true</searchable>
    <MLS>false</MLS>
    </attribute>
    <attribute name="Street">
    <type>string</type>
    <required>false</required>
    <attribute-group>Basic</attribute-group>
    <searchable>true</searchable>
    </attribute>
    <attribute name="Telephone Number">
    <type>string</type>
    <required>false</required>
    <attribute-group>Basic</attribute-group>
    <searchable>true</searchable>
    </attribute>
    <attribute name="Title">
    <type>string</type>
    <required>false</required>
    <attribute-group>Basic</attribute-group>
    <searchable>true</searchable>
    <MLS>false</MLS>
    </attribute>
    <attribute name="Initials">
    <type>string</type>
    <required>false</required>
    <attribute-group>Basic</attribute-group>
    <searchable>true</searchable>
    </attribute>
    <attribute name="LDAP Organization">
    <type>string</type>
    <required>false</required>
    <attribute-group>Basic</attribute-group>
    <searchable>true</searchable>
    <MLS>false</MLS>
    </attribute>
    <attribute name="LDAP Organization Unit">
    <type>string</type>
    <required>false</required>
    <attribute-group>Basic</attribute-group>
    <searchable>true</searchable>
    <MLS>false</MLS>
    </attribute>
    <attribute name="User Status">
    <type>string</type>
    <required>false</required>
    <attribute-group>Basic</attribute-group>
    <searchable>true</searchable>
    </attribute>
    <attribute name="Lock Status">
    <type>string</type>
    <required>false</required>
    <attribute-group>Basic</attribute-group>
    <searchable>true</searchable>
    </attribute>
    <attribute name="Accessibility Mode">
    <type>string</type>
    <required>false</required>
    <attribute-group>Basic</attribute-group>
    <searchable>true</searchable>
    </attribute>
    <attribute name="Color Contrast">
    <type>string</type>
    <required>false</required>
    <attribute-group>Basic</attribute-group>
    <searchable>true</searchable>
    </attribute>
    <attribute name="Font Size">
    <type>string</type>
    <required>false</required>
    <attribute-group>Basic</attribute-group>
    <searchable>true</searchable>
    </attribute>
    <attribute name="Number Format">
    <type>string</type>
    <required>false</required>
    <attribute-group>Basic</attribute-group>
    <searchable>true</searchable>
    </attribute>
    <attribute name="Currency">
    <type>string</type>
    <required>false</required>
    <attribute-group>Basic</attribute-group>
    <searchable>true</searchable>
    </attribute>
    <attribute name="Date Format">
    <type>string</type>
    <required>false</required>
    <attribute-group>Basic</attribute-group>
    <searchable>true</searchable>
    </attribute>
    <attribute name="Time Format">
    <type>string</type>
    <required>false</required>
    <attribute-group>Basic</attribute-group>
    <searchable>true</searchable>
    </attribute>
    <attribute name="Embedded Help">
    <type>string</type>
    <required>false</required>
    <attribute-group>Basic</attribute-group>
    <searchable>true</searchable>
    </attribute>
    <attribute name="FA Language">
    <type>string</type>
    <required>false</required>
    <attribute-group>Basic</attribute-group>
    <searchable>true</searchable>
    </attribute>
    <attribute name="FA Territory">
    <type>string</type>
    <required>false</required>
    <attribute-group>Basic</attribute-group>
    <searchable>true</searchable>
    </attribute>
    <attribute name="User Name Preferred Language">
    <type>string</type>
    <required>false</required>
    <attribute-group>Basic</attribute-group>
    <searchable>true</searchable>
    </attribute>
    </entity-attributes>
    <target-fields>
    <field name="uid">
    <type>string</type>
    <required>true</required>
    </field>
    <field name="givenname">
    <type>string</type>
    <required>false</required>
    </field>
    <field name="sn">
    <type>string</type>
    <required>true</required>
    </field>
    <field name="middleName">
    <type>string</type>
    <required>false</required>
    </field>
    <field name="cn">
    <type>string</type>
    <required>true</required>
    </field>
    <field name="userPassword">
    <type>string</type>
    <required>false</required>
    </field>
    <field name="objectGUID">
    <type>string</type>
    <required>false</required>
    </field>
    <field name="dn">
    <type>string</type>
    <required>false</required>
    </field>
    <field name="employeeType">
    <type>string</type>
    <required>false</required>
    </field>
    <field name="mail">
    <type>string</type>
    <required>false</required>
    </field>
    <field name="orclActiveStartDate">
    <type>date</type>
    <required>false</required>
    </field>
    <field name="orclActiveEndDate">
    <type>date</type>
    <required>false</required>
    </field>
    <field name="orclTimeZone">
    <type>string</type>
    <required>false</required>
    </field>
    <field name="manager">
    <type>string</type>
    <required>false</required>
    </field>
    <field name="c">
    <type>string</type>
    <required>false</required>
    </field>
    <field name="departmentNumber">
    <type>string</type>
    <required>false</required>
    </field>
    <field name="description">
    <type>string</type>
    <required>false</required>
    </field>
    <field name="employeeNumber">
    <type>string</type>
    <required>false</required>
    </field>
    <field name="facsimileTelephoneNumber">
    <type>string</type>
    <required>false</required>
    </field>
    <field name="orclGenerationQualifier">
    <type>string</type>
    <required>false</required>
    </field>
    <field name="orclHireDate">
    <type>date</type>
    <required>false</required>
    </field>
    <field name="homePhone">
    <type>string</type>
    <required>false</required>
    </field>
    <field name="homePostalAddress">
    <type>string</type>
    <required>false</required>
    </field>
    <field name="l">
    <type>string</type>
    <required>false</required>
    </field>
    <field name="mobile">
    <type>string</type>
    <required>false</required>
    </field>
    <field name="pager">
    <type>string</type>
    <required>false</required>
    </field>
    <field name="postalAddress">
    <type>string</type>
    <required>false</required>
    </field>
    <field name="postalCode">
    <type>string</type>
    <required>false</required>
    </field>
    <field name="postOfficeBox">
    <type>string</type>
    <required>false</required>
    </field>
    <field name="preferredLanguage">
    <type>string</type>
    <required>false</required>
    </field>
    <field name="st">
    <type>string</type>
    <required>false</required>
    </field>
    <field name="street">
    <type>string</type>
    <required>false</required>
    </field>
    <field name="telephoneNumber">
    <type>string</type>
    <required>false</required>
    </field>
    <field name="title">
    <type>string</type>
    <required>false</required>
    </field>
    <field name="initials">
    <type>string</type>
    <required>false</required>
    </field>
    <field name="o">
    <type>string</type>
    <required>false</required>
    </field>
    <field name="ou">
    <type>string</type>
    <required>false</required>
    </field>
    <field name="displayName">
    <type>string</type>
    <required>false</required>
    </field>
    <field name="orclAccountEnabled">
    <type>string</type>
    <required>false</required>
    </field>
    <field name="orclAccountLocked">
    <type>string</type>
    <required>false</required>
    </field>
    <field name="orclAccessibilityMode">
    <type>string</type>
    <required>false</required>
    </field>
    <field name="orclColorContrast">
    <type>string</type>
    <required>false</required>
    </field>
    <field name="orclFontSize">
    <type>string</type>
    <required>false</required>
    </field>
    <field name="orclNumberFormat">
    <type>string</type>
    <required>false</required>
    </field>
    <field name="orclCurrency">
    <type>string</type>
    <required>false</required>
    </field>
    <field name="orclDateFormat">
    <type>string</type>
    <required>false</required>
    </field>
    <field name="orclTimeFormat">
    <type>string</type>
    <required>false</required>
    </field>
    <field name="orclEmbeddedHelp">
    <type>string</type>
    <required>false</required>
    </field>
    <field name="orclFALanguage">
    <type>string</type>
    <required>false</required>
    </field>
    <field name="orclFATerritory">
    <type>string</type>
    <required>false</required>
    </field>
    <field name="orclDisplayNameLanguagePreference">
    <type>string</type>
    <required>false</required>
    </field>
    </target-fields>
    <attribute-maps>
    <attribute-map>
    <entity-attribute>User Login</entity-attribute>
    <target-field>uid</target-field>
    </attribute-map>
    <attribute-map>
    <entity-attribute>First Name</entity-attribute>
    <target-field>givenname</target-field>
    </attribute-map>
    <attribute-map>
    <entity-attribute>Last Name</entity-attribute>
    <target-field>sn</target-field>
    </attribute-map>
    <attribute-map>
    <entity-attribute>Middle Name</entity-attribute>
    <target-field>middleName</target-field>
    </attribute-map>
    <attribute-map>
    <entity-attribute>Common Name</entity-attribute>
    <target-field>cn</target-field>
    </attribute-map>
    <attribute-map>
    <entity-attribute>usr_password</entity-attribute>
    <target-field>userPassword</target-field>
    </attribute-map>
    <attribute-map>
    <entity-attribute>LDAP GUID</entity-attribute>
    <target-field>objectGUID</target-field>
    </attribute-map>
    <attribute-map>
    <entity-attribute>LDAP DN</entity-attribute>
    <target-field>dn</target-field>
    </attribute-map>
    <attribute-map>
    <entity-attribute>Role</entity-attribute>
    <target-field>employeeType</target-field>
    </attribute-map>
    <attribute-map>
    <entity-attribute>Email</entity-attribute>
    <target-field>mail</target-field>
    </attribute-map>
    <attribute-map>
    <entity-attribute>Start Date</entity-attribute>
    <target-field>orclActiveStartDate</target-field>
    </attribute-map>
    <attribute-map>
    <entity-attribute>End Date</entity-attribute>
    <target-field>orclActiveEndDate</target-field>
    </attribute-map>
    <attribute-map>
    <entity-attribute>usr_timezone</entity-attribute>
    <target-field>orclTimeZone</target-field>
    </attribute-map>
    <attribute-map>
    <entity-attribute>usr_manager_key</entity-attribute>
    <target-field>manager</target-field>
    </attribute-map>
    <attribute-map>
    <entity-attribute>Country</entity-attribute>
    <target-field>c</target-field>
    </attribute-map>
    <attribute-map>
    <entity-attribute>Department Number</entity-attribute>
    <target-field>departmentNumber</target-field>
    </attribute-map>
    <attribute-map>
    <entity-attribute>Description</entity-attribute>
    <target-field>description</target-field>
    </attribute-map>
    <attribute-map>
    <entity-attribute>Employee Number</entity-attribute>
    <target-field>employeeNumber</target-field>
    </attribute-map>
    <attribute-map>
    <entity-attribute>Fax</entity-attribute>
    <target-field>facsimileTelephoneNumber</target-field>
    </attribute-map>
    <attribute-map>
    <entity-attribute>Generation Qualifier</entity-attribute>
    <target-field>orclGenerationQualifier</target-field>
    </attribute-map>
    <attribute-map>
    <entity-attribute>Hire Date</entity-attribute>
    <target-field>orclHireDate</target-field>
    </attribute-map>
    <attribute-map>
    <entity-attribute>Home Phone</entity-attribute>
    <target-field>homePhone</target-field>
    </attribute-map>
    <attribute-map>
    <entity-attribute>Home Postal Address</entity-attribute>
    <target-field>homePostalAddress</target-field>
    </attribute-map>
    <attribute-map>
    <entity-attribute>Locality Name</entity-attribute>
    <target-field>l</target-field>
    </attribute-map>
    <attribute-map>
    <entity-attribute>Mobile</entity-attribute>
    <target-field>mobile</target-field>
    </attribute-map>
    <attribute-map>
    <entity-attribute>Pager</entity-attribute>
    <target-field>pager</target-field>
    </attribute-map>
    <attribute-map>
    <entity-attribute>Postal Address</entity-attribute>
    <target-field>postalAddress</target-field>
    </attribute-map>
    <attribute-map>
    <entity-attribute>Postal Code</entity-attribute>
    <target-field>postalCode</target-field>
    </attribute-map>
    <attribute-map>
    <entity-attribute>PO Box</entity-attribute>
    <target-field>postOfficeBox</target-field>
    </attribute-map>
    <attribute-map>
    <entity-attribute>State</entity-attribute>
    <target-field>st</target-field>
    </attribute-map>
    <attribute-map>
    <entity-attribute>Street</entity-attribute>
    <target-field>street</target-field>
    </attribute-map>
    <attribute-map>
    <entity-attribute>Telephone Number</entity-attribute>
    <target-field>telephoneNumber</target-field>
    </attribute-map>
    <attribute-map>
    <entity-attribute>Title</entity-attribute>
    <target-field>title</target-field>
    </attribute-map>
    <attribute-map>
    <entity-attribute>Initials</entity-attribute>
    <target-field>initials</target-field>
    </attribute-map>
    <attribute-map>
    <entity-attribute>LDAP Organization</entity-attribute>
    <target-field>o</target-field>
    </attribute-map>
    <attribute-map>
    <entity-attribute>LDAP Organization Unit</entity-attribute>
    <target-field>ou</target-field>
    </attribute-map>
    <attribute-map>
    <entity-attribute>Display Name</entity-attribute>
    <target-field>displayName</target-field>
    </attribute-map>
    <attribute-map>
    <entity-attribute>User Status</entity-attribute>
    <target-field>orclAccountEnabled</target-field>
    </attribute-map>
    <attribute-map>
    <entity-attribute>Lock Status</entity-attribute>
    <target-field>orclAccountLocked</target-field>
    </attribute-map>
    <attribute-map>
    <entity-attribute>Accessibility Mode</entity-attribute>
    <target-field>orclAccessibilityMode</target-field>
    </attribute-map>
    <attribute-map>
    <entity-attribute>Color Contrast</entity-attribute>
    <target-field>orclColorContrast</target-field>
    </attribute-map>
    <attribute-map>
    <entity-attribute>Font Size</entity-attribute>
    <target-field>orclFontSize</target-field>
    </attribute-map>
    <attribute-map>
    <entity-attribute>Number Format</entity-attribute>
    <target-field>orclNumberFormat</target-field>
    </attribute-map>
    <attribute-map>
    <entity-attribute>Currency</entity-attribute>
    <target-field>orclCurrency</target-field>
    </attribute-map>
    <attribute-map>
    <entity-attribute>Date Format</entity-attribute>
    <target-field>orclDateFormat</target-field>
    </attribute-map>
    <attribute-map>
    <entity-attribute>Time Format</entity-attribute>
    <target-field>orclTimeFormat</target-field>
    </attribute-map>
    <attribute-map>
    <entity-attribute>Embedded Help</entity-attribute>
    <target-field>orclEmbeddedHelp</target-field>
    </attribute-map>
    <attribute-map>
    <entity-attribute>FA Language</entity-attribute>
    <target-field>orclFALanguage</target-field>
    </attribute-map>
    <attribute-map>
    <entity-attribute>FA Territory</entity-attribute>
    <target-field>orclFATerritory</target-field>
    </attribute-map>
    <attribute-map>
    <entity-attribute>User Name Preferred Language</entity-attribute>
    <target-field>orclDisplayNameLanguagePreference</target-field>
    </attribute-map>
    </attribute-maps>
    <control-attributes>
    <attribute name="container">
    <type>LDAPContainer</type>
    <required>false</required>
    </attribute>
    </control-attributes>
    </tns:entity-definition>

  • Cisco ISE Process Flow with Active Directory

    Hi guys,
    Today I did a lab and see this note at Authentication Policy Interface. This note is:
    Note: For authentications using PEAP, LEAP, EAP-FAST or RADIUS MSCHAP it is not possible to continue processing when authentication fails or user is not found. If continue option is selected in these cases, requests will be rejected.
    Then I thought that the best way to configure authetication policy for Flex Auth: Dot1x (with Active Directory) > MAB (Internal Endpoint) > CWA (Guest and other user) will be using EAP-TLS authentication protocol.
    Is this possible using another protocol instead of EAP-TLS (which is required client certificate has already been installed)? Would you mind helping me to reslove the problem? And the network authentication method at end user side will be?
    Any help will be much appreciated.

    Please refer the Supported Authentication Protocols ( including PEAP )  , database and authentication types from below
    http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/user_guide/ise_user_guide/ise_auth_pol.html#pgfId-1266680

  • Synchronization with Active Directory issue - Error ID 1004

    I  found the Application Event Log error below.  
    Error ID 1004: The resource 'D:\SharePoint 2010\14.0\Service\Microsoft.ResourceManagement.Service.exe' does not exist.
    This means, the Network Service account does not have rights to the %programfiles%\Microsoft Office Servers\14.0 folder so,
    the User Profile Synchronisation with Active Directory does not run properly.
    The solution is to grant read access to the Network Service account to the  ...\14.0 folder.
     https://support2.microsoft.com/kb/2473430?wa=wsignin1.0
    But I cannot find %programfiles%\Microsoft
    Office Servers\14.0 folder. Instead
    there is a folder in D drive: 'D:\SharePoint 2010\14.0 and I granted read access to the Network Service account to this
    folder and ran Full synchronization but still not a joy.
    Could you please advise me?
    Thanks

    Thanks Victoria, 
    I granted full access to the user
    NETWORK SERVICE:, which
    is listed in the error message on the folder D:\SharePoint 2010\14.0.
    Then reset IIS and ran a full
    synchronization, but there are still some user accounts who are a member of an AD group (this AD group has contribute right to the Intranet)  and when
    I check permission for those users, it seems they don't inherit permission from that AD group.
    For example :
    AD group name: TeamMembers
    TeamMembers has contribute
    permission.
    user1, user2, user3 and user4 are  members of TeamMembers
    user1 and user2 have contribute
    permissionGiven through the "TeamMembers"
    group.
    user3 and user4 have no permission!!!
    I don't know what the problem is. I don't have access to Active Directory but the people who have access to  say all users are  members of that AD group.
    Could you please advise?
    Thanks

  • Issue with Active Directory User Target Recon

    Hi ,
    I am facing an issue with Active Directory User Target Recon
    My environment is OIM 11g R2 with BP03 patch applied
    AD Connector is activedirectory-11.1.1.5 with bundle patch 14190610 applied
    In my Target there are around 28000 users out of which 14000 have AD account (includes Provisioned,Revoked,Disabled accounts)
    When i am running Active Directory User Target Recon i am not putting any filter cleared the batch start and batch size parameters and ran the recon job .Job ran successfully but it stopped after processing around 3000 users only.
    Retried the job two three times but every time it is stopping after processing some users but not processing all the users.
    Checked the log file oimdiagnostic logs and Connector server logs cannot see any errors in it.
    Checked the user profile of users processed can see AD account provisioned for users
    My query is why this job is not processing allthe users.Please point if i am missing some thing .
    thanks in advance

    Check the connector server load when you are running the recon. Last time I checked the connector, the way it was written is that it loads all the users from AD into the connector server memory and then sends them to OIM. So if the number was huge, then the connector server errored out and did not send data to OIM. We then did recon based on OUs to load/link all the users into OIM. Check the connector server system logs and check for memory usage etc.
    -Bikash

  • Single Signon and Integration with Active Directory

    Hi,
    We have a requirement to integrate Active Directory with SAP and implement Single Signon solution. Our Active Directory is running on Windows 2003 and we are having systems 4.7 , ECC6.0 which run on Linux OS in our landscape.
    Can anyone of you help me by answering following questions
    1. Is there any need of any third party solution(tool) to integrate  Active Directory and SAP and activate single signon?
    2.Is there any difference in integration from SAP 4.7 and ECC6.0 of SAP on Linux OS with Active Directory ?
    3. If possible please share any documents or links on above issue.
    Suitable answers will be rewarded with points. Thanks in advance for your help
    Regards
    Murali

    > Thank you very much for providing me the link. But the document on link seem to be in German. Can you please let me know how to get English version of this document.
    I'm sorry, you'd have to ask Realtech for that document in English.
    Basically you can follow
    http://osdir.com/ml/encryption.kerberos.general/2004-11/msg00007.html
    Markus

  • Tighter Integration with Active Directory User Groups

    I just wrapped up a Jabber deployment with IM&P 9.1(1) and J4W clients 9.1(3).
    The customer asked me if it is on Cisco's roadmap to allow groups in Active Directory to be pulled into the Jabber client.  The primary business case is to allow those in IT to send out IM blasts to the corporation or certain departments.
    Obviously, this would require a significant amount of development and a much tighter integration with Active Directory, but I need to ask anyway.
    Has something like this been identified and placed on any roadmap?
    Thanks,
    Matthew Berry

    Unfortunately this kind of questions cannot be addressed here, roadmap questions need to go thru official channels for an answer.
    You need to reach your SE/AM for this question.
    HTH
    java
    if this helps, please rate
    www.cisco.com/go/pdihelpdesk

Maybe you are looking for

  • Murphy's Law strikes again - Delayed rollout and lost activation info.

    It's my own fault for not making a copy of the activation page when we first got greenlighted, but delays came down the pipe and now I've got an iTunes U site with no way to authenticate. Whoops. Any suggestions to fix my horrid oversight? Thanks in

  • Quicken 07 remains after Archive and Install?

    Will the Quicken 07 application AND all my accounts remain after doing Archive and Install? I mean, will they be up and ready to use or need to be located in a folder and re-installed?

  • I have a game that I bought on one Ipad but wont work full version on my 2nd I pad, anybody caould help me

    I bought a game on one Ipad, I added another I pad tried to sinc it with the other, all was good until I tried to play one game on the snd I pad and after the second level was asked tp buy the full version that I have on the other Ipad... can somebod

  • Set UP Wizard

    Set up Wizard is running, but after I select my language, I get the blue spinning cicle and the message "Activating" until the battery dies. Why won't my phone active?

  • Back to my mack

    I have just installed an airport extreme in my office. I can not access my office network through my mobile me account. I get a notice that my back to my mac account is not working because my router does not support NAT port mapping protocol or UPnP.