OID can not display some users - java.lang.ArrayIndexOutOfBoundsException:0

Question

We have set up AD to OID synchronization for users and groups using Import connector, and it worked fine. The users in OID can log into applications protected by OAM. But recently I found that some users that could be displayed in OID before can not be displayed now. If I click on the DN in Oracle Directory Manager, a error window pops up. It is a long error message, and the first a few lines are as follows :
0
java.lang.ArrayIndexOutOfBoundsException:0
at oracle.ldap.admin.AttrOptions.<init>(entry.jave:3151)
at Oracle.ldap.admin.Entry.getProp(entry.java:457)
I don't see any error message in the integration profile or log files. I am testing things on an account that is having this trouble, and the strange thing is that it can not log into application protected by OAM any more, but it can log into OAM console.
We use OID 10.1.2.3 on Windows, and OAM 10.1.4.0.1.
I searched in Metalink but didn't find anything helpful. Any help is appreciated. Thanks for your time.
Hailie

Answer 1

Pramod,
Thank you for your reply. Please see below my answers to your questions:
-> Do you see any pattern in the users (DN) that are unable to be displayed/login?
Yes I do see some pattern. There is one change on the problem user's dn - the "\" after the last name is gone.
Before: cn=smith\, john, cn=users,dc=abc,dc=com
Now: cn=smith, john, cn=users,dc=abc,dc=com
However I check in Active directory "\" is presented. In OID if I right click on cn=smith, john and try to delete it, I got a error message "LDAP: error code 34 - Error in DN Normalization". Is that caused by the missing of "\"?
-> Does ldapsearch on these users (with all attributes) show something (special chars, etc)?
ldapsearch on cn=cn=smith, john,cn=users,dc=abc,dc=com returns no objects:
$ldapsearch -L -D "cn=orcladmin" -w "*****" -h host -p 389 -b "cn=smith, john,cn=users,dc=abc,dc=com" -s sub "objectclass=*"
ldap_search: No such object
ldap_search: matched: cn=Users, dc=abc,dc=com
Ldap search on cn=smith\, john,cn=users,dc=abc,dc=com:
$ldapsearch -L -D "cn=orcladmin" -w "*****" -h host -p 389 -b "cn=smith\, john,cn=users,dc=abc,dc=com" -s sub "objectclass=*"
dn: cn="smith, john",cn=users,dc=abc,dc=com
uid: [email protected]
employeenumber: 916963
cn: smith, john
registeredaddress: 512
krbprincipalname: [email protected]
orclsamaccountname: ABC.COM$JSmith
sn: johnsmith
displayname: John
orclobjectguid: lJO0N+8H4UW/30yHukSfsw==
orclobjectsid: AQUAAAAAAAUVAAAAohxTYWIV3XFeP55cYjwAAA==
orcluserprincipalname: [email protected]
objectclass: oblixorgperson
objectclass: inetorgperson
objectclass: orcluserv2
objectclass: person
objectclass: orcladuser
objectclass: organizationalPerson
objectclass: top
obver: 10.1.4.0
-> Do you see the same behavior when you use any generic LDAP browser (Ex: Apache Directory Studio) instead of ODM?
I don't have Apache Directory Studio installed yet. I will try that later.
-> Does the changelog for the particular synch (for the affected users) show something?
Here is what I found in ActiveChgImp.aud
(weeks ago)
97426524 : Success : MODIFY : cn=smith\, john,cn=users,dc=abc,dc=com
(Recently change - The back slach after smith was gone, and "" showed up)
97469970 : Success : MODIFY : cn="smith, john",cn=users,dc=abc,dc=com
-> If login to OAM is possible, can the user modify his/her profile, and does it save the changes? If it does, can you try logging in to apps?
This user can log into OAM identity system, but when I click on "My profile" under "User manager", I got a error message "You do not have sufficient access rights".
If I log into identity system as orcladmin, I was able to modify it and save the changes. But in OID the user is still not displayed. Same error message. When I tried to add it as administrator, I could search on it, add it, but when I press "done", it didn't show up on the admin list. The users that can be displayed in OID can be added to admin list without a problem.
Thanks,
Hailie