Please help with assigning user to a group in AD using dbms_ldap

Question

Dear gurus of Apex and LDAP!
Please help me a bit.
I managed to create any user in AD from Apex using dbms_ldap package and set many of his attributes. But I cannot set that my user belongs to specific group, let's say MY_GROUP. I guess the name of attribute for group is 'member' or 'memberOf', so I tried them both in the same way as I've done for other attributes:
v_vals(1) := 'MY_GROUP';
DBMS_LDAP.populate_mod_array(v_array, DBMS_LDAP.MOD_ADD, 'member', v_vals);
I've got LDAP client/server error: CONSTRAINT violation. 000020B5: AtrErr: DSID-031516FC, #1: 0: 000020B5:
DSID-031516FC, problem 1005 (CONSTRAINT_ATT_TYPE), DATA 0, Att 1f (MEMBER)
v_vals(1) := 'MY_GROUP';
DBMS_LDAP.populate_mod_array(v_array, DBMS_LDAP.MOD_ADD, 'memberOf', v_vals);
I've got LDAP client/server error: DSA IS unwilling TO perform. 0000209A: SvcErr: DSID-031A0929, problem 5003 (WILL_NOT_PERFORM), DATA 0
After that I've tried to extend group name to string, which is shown in LDAP browser for attribute 'memberOf' (when I've added it manualy):
v_vals(1) := 'CN=MY_GROUP,OU=GROUPS,OU=Allianz,DC=allianz,DC=com';
DBMS_LDAP.populate_mod_array(v_array, DBMS_LDAP.MOD_ADD, 'member', v_vals);
I've got LDAP client/server error: OBJECT CLASS violation. 0000207D: UpdErr: DSID-03150913, problem 6002 (OBJ_CLASS_VIOLATION), DATA 0
v_vals(1) := 'CN=MY_GROUP,OU=GROUPS,OU=Allianz,DC=allianz,DC=com';
DBMS_LDAP.populate_mod_array(v_array, DBMS_LDAP.MOD_ADD, 'memberOf', v_vals);
LDAP client/server error: DSA IS unwilling TO perform. 0000209A: SvcErr: DSID-031A0929, problem 5003 (WILL_NOT_PERFORM), DATA 0
I've also tried some other variants (without 'CN=' and without 'OU=GROUPS,OU=Allianz'), but still no success.
Search of this forum and even google didn't help either :(
Please, help me to find the correct syntax for it or tell me if it's not possible.
Thanx in advance,
Vladimir

Answer 1

Vladimir ,
firstly the attributes member and memberOf are special attributes in AD having a set of predefined values. Hence an error will be thrown if you try to assign them values like 'MY_GROUP'. There are two basic solutions to this problem : Either you define an OU in your AD which will act as your 'MY_GROUP'. This is a quick fix solution and is not robust at all. The other solution is to add your own property in the tree , something like 'roleCode', you can then assign it any value you want.
But the problem now is, AD does not allow addition of new attributes in the structure. You have to use ADAM in for this and you can specify a common linking mechanism between AD and ADAM now such as email address can act as the link between both the directories.
Hope this helps
Shantanu