Solaris 8/9 with LDAP

I setup iplanet directory server in the Solaris 9. Solaris 9 client can get user account, automount data from LDAP, but , Solaris 8 can't get automount data,
If cd /test4 , error message : permittion denied.
How to fix it , or to get more information about it.
as following is solaris 8 setting :
Solaris 8 profile:
dn: cn=sun8,ou=profile,dc=test,dc=com,dc=tw
cn: sun8
ObjectClass: top
ObjectClass: SolarisNamingProfile
SolarisBindDN: cn=proxyagent,ou=profile,dc=test,dc=com,dc=tw
SolarisBindPassword: {NS1}c58916dc7d61179f7f
SolarisLDAPServers: 172.20.100.103
SolarisSearchBaseDN: dc=test,dc=com,dc=tw
SolarisAuthMethod: NS_LDAP_AUTH_SIMPLE
SolarisTransportSecurity: NS_LDAP_SEC_NONE
SolarisSearchReferral: NS_LDAP_FOLLOWREF
SolarisSearchScope: NS_LDAP_SCOPE_ONELEVEL
SolarisSearchTimeLimit: 30
SolarisCacheTTL: 43200
Solaris 9 profile :
dn: cn=sun9v1,ou=profile,dc=test,dc=com,dc=tw
ObjectClass: top
ObjectClass: DUAConfigProfile
defaultServerList: 172.20.100.103
defaultSearchBase: dc=test,dc=com,dc=tw
authenticationMethod: simple
defaultSearchScope: one
searchTimeLimit: 30
cn: sun9v1
credentialLevel: proxy
attributeMap: automount:automountInformation=nisMapEntry
attributeMap: automount:automountKey=cn
attributeMap: automount:automountMapName=nisMapName
objectClassMap: automount:automount=nisObject
objectClassMap: automount:automountMap=nisMap
AutoMount Entry:
cn=/net,nisMapName=auto_master,dc=test,dc=com,dc=tw
objectClass=nisObject
objectClass=top
cn=/net
nisMapEntry=-hosts -nosuid,nobrowse
nisMapName=auto_master
cn=/home,nisMapName=auto_master,dc=test,dc=com,dc=tw
objectClass=nisObject
objectClass=top
cn=/home
nisMapEntry=auto_home -nobrowse
nisMapName=auto_master
cn=/xfn,nisMapName=auto_master,dc=test,dc=com,dc=tw
objectClass=nisObject
objectClass=top
cn=/xfn
nisMapEntry=-xfn
nisMapName=auto_master
cn=/-,nisMapName=auto_master,dc=test,dc=com,dc=tw
objectClass=nisObject
objectClass=top
cn=/-
nisMapEntry=auto_direct
nisMapName=auto_master
cn=/test4,nismapname=auto_direct,dc=test,dc=com,dc=tw
objectClass=nisObject
objectClass=top
cn=/test4
nismapentry=sun1:/export/test
nismapname=auto_direct

I just checked my schema and I've also converted 'NisMapEntry' to lower case.
So when you do an 'ldaplist -l auto_home name' you get:
dn: cn=name,nismapname=auto_home,o=org
objectClass: top
objectClass: nisobject
nismapname: auto_home
nismapentry: server:/export/home/&
cn: name
You can see where it's failing by running automountd in debug mode:
/usr/lib/autofs/automountd -v -TT &
# cd /home/name
t1 LOOKUP REQUEST: Wed Sep 4 14:37:53 2002
t1 name=name[] map=auto_home opts= path=/home direct=0
t1 PUSH /etc/auto_home
t1 getmapent_ldap called
t1 getmapent_ldap: key=[ name ]
t1 ldap_match called
t1 ldap_match: key =[ name ]
t1 ldap_match: ldapkey =[ name ]
t1 ldap_match: searchfilter =[ (&(objectClass=nisObject)(nisMapName=auto_home)(cn=name)) ]
t1 ldap_match: Requesting list for (&(objectClass=nisObject)(nisMapName=auto_home)(cn=name))
t1 ldap_match: __ns_ldap_list OK
t1 getmapent_ldap: exiting ...
t1 POP /etc/auto_home
t1 mapline: server:/export/home/&
t1 do_lookup1: action=2 wildcard=FALSE error=0
t1 LOOKUP REPLY : status=0
t6 MOUNT REQUEST: Wed Sep 4 14:37:53 2002
t6 name=name[] map=auto_home opts= path=/home direct=0
t6 PUSH /etc/auto_home
t6 getmapent_ldap called
t6 getmapent_ldap: key=[ name ]
t6 ldap_match called
t6 ldap_match: key =[ name ]
t6 ldap_match: ldapkey =[ name ]
t6 ldap_match: searchfilter =[ (&(objectClass=nisObject)(nisMapName=auto_home)(cn=name)) ]
t6 ldap_match: Requesting list for (&(objectClass=nisObject)(nisMapName=auto_home)(cn=name))
t6 ldap_match: __ns_ldap_list OK
t6 getmapent_ldap: exiting ...
t6 POP /etc/auto_home
t6 mapline: server:/export/home/&
t6 do_mount1:
t6 (nfs,nfs) /home/name
server:/export/home/name penalty=0
t6 nfsmount: standard mount on /home/name :
t6 server:/export/home/name
t6 ping: server timeout=15 request vers=3 min=2
t6 pingnfs OK: nfs version=3
t6 nfsmount: Get mount version: request vers=3 min=3
t6 nfsmount: mount version=3
t6 mount server:/export/home/name /home/name ()
t6 mount server:/export/home/name dev=44c0006 rdev=0 OK
t6 MOUNT REPLY : status=0, AUTOFS_DONE

Similar Messages

  • Sudo with LDAP NetGroups Solaris 10

    Hi All,
    Can some  one describe me the steps to configure sudoers to work with LDAP NetGroups Solaris 10 ?
    I am using  "sudo  1.7.2p6 " right now.
    I am able to authenticate using  the Netgroups , but not able to using sudo.
    Thanks,
    DD

    I have recently tested sudo 1.6.8p8 to be working with flat files /etc/sudoers or LDAP sudo maps, together with netgroup and automount, on a Solaris Native LDAP Client against DS5.2 server.
    I assume you use Solaris8/9 Native LDAP Client, and assume netgroup LDAP maps have been working without sudo.
    I read your other post about sudo and ldap, I think you did not configure and build "sudo" with "--with-pam", right?
    Can you provide the following details?
    1) First 10 lines of "sudo -V", i.e. "sudo -V | head".
    2) How do you configure "sudo" on the LDAP Client? i.e. ./configure options.
    3) Did you use an old gcc version eg: Solaris9 built-in gcc 3.1, to compile sudo?
    4) Content of /var/ldap/ldap_client_file.
    5) Content of /etc/ldap.conf, you should have this file.
    6) Sample ldif showing some sudoRole entries in LDAP
    7) Can you perform these commands?
    ldaplist -l sudoers
    ldaplist -l sudoers root
    ldaplist -l sudoers some_sudoRole
    8) Content of /etc/pam.conf
    9) Any other relevant details, like err in /var/adm/messages.
    Gary

  • Issue with LDAP login authentication in CMC console

    We have a existing issues with Business Objects BOE XIR2 SP2 and LDAP authentication with the BOE CMC Console.
    We use websphere as the application server and it is installed on the same machine (Solaris) as BOE.
    We have this issue on both our production and our recently rebuilt development environment to duplicate the issue.
    Both environment have configured LDAP over SSL and we can login to BOE Infoview Reports with LDAP and we can map groups and users if we login to CMC but we can not login to CMC with secLDAP.
    The specific error still being shown is "Security plugin error: Failed to set parameters on plugin".
    Both environments (DEV and PROD) are fresh installs of BOE XIR2 SP2.
    Any ideas are much appreciated
    Thankyou

    The CMC in XIR2 used com components for the SSL (rather than java like infoview) and I'm betting the WAS deployment is not finding them. Is WAS on a seperate server or is BOE installed there as well?
    I'm not familiar with any regular fixes for an issue like this. If no other replies I'd recommend opening a case with either deployment(WAS on "nix") or authentication(WAS on windows) to see if they can trace down the problem.
    Regards,
    Tim

  • Untrusted server cert chain - while connecting with ldap

    Hi All,
    I am getting the following error while running a standalone java program in windows 2000+jdk1.3 environment to connect with LDAP.
    javax.naming.CommunicationException: hostname:636 [Root exception is ja
    vax.net.ssl.SSLException: untrusted server cert chain]
    javax.naming.CommunicationException: hostname:636. Root exception is j
    avax.net.ssl.SSLException: untrusted server cert chain
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA12275)
    at com.sun.net.ssl.internal.ssl.ClientHandshaker.a(DashoA12275)
    at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(DashoA12
    275)
    at com.sun.net.ssl.internal.ssl.Handshaker.process_record(DashoA12275)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA12275)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA12275)
    at com.sun.net.ssl.internal.ssl.AppOutputStream.write(DashoA12275)
    at java.io.OutputStream.write(Unknown Source)
    at com.sun.jndi.ldap.Connection.<init>(Unknown Source)
    at com.sun.jndi.ldap.LdapClient.<init>(Unknown Source)
    at com.sun.jndi.ldap.LdapCtx.connect(Unknown Source)
    at com.sun.jndi.ldap.LdapCtx.<init>(Unknown Source)
    at com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(Unknown Source)
    at javax.naming.spi.NamingManager.getInitialContext(Unknown Source)
    at javax.naming.InitialContext.getDefaultInitCtx(Unknown Source)
    at javax.naming.InitialContext.init(Unknown Source)
    at javax.naming.InitialContext.<init>(Unknown Source)
    at javax.naming.directory.InitialDirContext.<init>(Unknown Source)
    at Test2.getProxyDirContext(Test2.java:66)
    at Test2.main(Test2.java:40)
    Any help would be appreciated
    Thanks in Advance
    Somu

    This got resolved when in the code the following
    System.setProperty("javax.net.ssl.tmrustStore", CertFileName);
    where cert file name is the filename with complete path.the file is a CA certificate of the LDAP server
    in X509 format

  • Problem with LDAP in BEA Portal

    Problem with LDAP in BEA Portal
    I have a list of 50 user which should be cerated in portal staging(devlopment) machine and should be transfered to
    production machine using LDAP
    Steps which i followed to create Users
    1.Create User Profile with 2 parameters branch and Role
    2.I have list user in the Xls file with Username,password ,branch and Role
    3.Write a java File which will read the Xls File
    4.The users are created in the staging machine for the portal
    Steps which i followed in LDAP to tranfer the created User form Devlopment to Production
    1.Export the created user from Devlopment (which was moved as .DAT in my local directory)
    2.import the user from local direcory to production machine
    The Users are imported in the production machine with username and password but the role and branch values are empty
    We need a solution for importing the user with role and branch corresponding to each user.
    Thanks in Adv
    Suresh

    In Portal 8.1, user name and password in stored in LDAP where as user profile values are stored in database. That is the reason you are not able to see the user profile values.
    Check once again whether you can see these values through admin tool. In case,it is not(after confirmation again),you might have to use APIs to do this for you incase you dont want to manage through Admin Tool.
    Thanks,
    Prashanth Bhat.

  • Error in authentication with ldap server with certificate

    Hi,
    i have a problem in authentication with ldap server with certificate.
    here i am using java API to authenticate.
    Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: timestamp check failed.
    I issued the new certificate which is having the up to 5 years valid time.
    is java will authenticate up to one year only?
    Can any body help on this issue...
    Regards
    Ranga

    sorry i am gettting ythe same error
    javax.naming.CommunicationException: simple bind failed: servername:636 exception is javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: timestamp check failed]
    here when i am using the old certificate and changing the system date means i can get the authentication.
    can you tell where we can concentrate and solve the issue..
    where is the issue
    1. need to check with the ldap server only
    2. problem in java code only.
    thanks in advance

  • Problem with users in portal - login conflict with LDAP.

    Hi.
    Let me describe our problem:
    We've a EP5 portal with LDAP conected to a central LDAP server, users access with the same user and password to all the different systems.
    The problem happens to users who have theyr passwords expired. We already set to 0 the password expiration days to avoid future problems but that didn't applied to the already expired ones.
    This affected users cannot change the password due to problems with the connection rights to LDAP server.
    We're trying to find the place there it's set that the user is in some kind of "password expired" status, directly in a database table if neccesary, to change the status manually, as system does not allow os to set it by user administration in portal.
    Any suggestions would be appreciated.

    Restoring expired Portal passwords
    Solved

  • EDSPermissionError(-14120) problems with LDAP, SSL and Directory Utility

    Hello everyone,
    Apologies for the repost but I think I may have made a mistake by posting this originally in the Installation, Setup and Migration forum instead of the Open Directory forum. At least I think that may be why I didn't receive any responses.
    Anyway, I've been trying to get my head around Open Directory and SSL as they are implemented in Mac OS X Server 10.5 Leopard, and have been having a few issues. I would like to set up a secure internal infrastructure based around a local Certificate Authority that signs certificates for other internal services like LDAP, email, websites, etc.
    I only have one Mac OS X Server and it is kind of a small office so I have gone against best practice and simply made it a CA (through Keychain Utility). I then generated a self-signed SSL certificate through Server Admin, and used the "Generate CSR" option to create a Certificate Signing Request. This went fine, but I did have some problems signing it with the CA, because the server documentation suggested that once I signed it it would pop open a Mail message containing the ASCII version of the signed certificate - it did not, and it took me a loooong time to realize that I could simply export the copy of the signed certificate it put in my local Keychain on the server as a PEM file and paste this back into the "Add Signed or Renewed Certificate from Certificate Authority" dialog box in Server Admin. Hopefully this can be fixed in a forthcoming patch, but I thought I would mention it here in case anyone else is stuck on this issue.
    Once I did this I was able to use this certificate in the web server on the same machine and sure enough I was able to connect to it with with clients who had installed the CA certificate in their system Keychains without getting any error messages - very cool.
    However, I haven't had quite as much luck getting it going with LDAP/Open Directory. I installed the certificate there as well, but have run into a number of problems. At first I could not get clients (also running 10.5.2) to talk to the server at all over SSL, receiving an error in Directory Utility that the server did not support SSL. I eventually discovered that the problem seemed to lie in the fact that the OpenLDAP implementation on Leopard is not tied in with the system Keychain, necessitating some command-line voodoo to install a copy of the CA cert in a local directory and point /etc/openldap/ldap.conf at it, as documented here: http://www.afp548.com/article.php?story=20071203011158936
    This allowed me to do an ldapsearch command over SSL, and seemingly turn SSL on on clients that were previously bound to the directory, and additionally allowed me to run Directory Utility on new clients and put in the server name with the SSL box checked and begin to go through the process of binding. Once this seemed to work, I turned off all plaintext LDAP communication and locked down the service by checking the "Enable authenticated directory binding," "Require authenticated binding," "Disable clear text passwords," and "Encrypt all packets" options in Server Admin. However, I am now running into a new problem, specifically that I cannot successfully bind a local account to a directory account over SSL.
    Here's what happens:
    1) I run Directory Utility, (or it auto-runs) and add a server, typing in the DNS name and clicking the SSL box.
    2) I get asked to authenticate, and type in user credentials, including computer name (incidentally, should this be a FQDN or just a hostname?)
    3) Provided I put admin credentials in here and not user-level credentials, I get taken to the "Do you want to set up Mail, VPN, etc.?" box that normally appears when you autodiscover or connect to an Open Directory server.
    4) I click through, and am asked for a username and password on the server, as well as the password for my local account.
    5) When I put this information in, I get a popup with the dreaded "eDSPermissionError(-14120)" and it fails.
    Checking the logs in Server Admin reveals nothing special, and while I have seen a couple other threads on this error and various other binding problems:
    http://discussions.apple.com/thread.jspa?messageID=5967023
    http://discussions.apple.com/message.jspa?messageID=5982070
    these have not solved the problem. In the Open Directory user name field I am putting the short username. I have tried putting [email protected] and the user's longname but this fails by saying the account does not exist. For some reason it does seem to work if I bind it to the initial admin account I created, but no other user accounts.
    If I turn all the encryption stuff off I am able to join just fine, so I am suspecting that the error may lie in some other "under the hood" piece of software that doesn't get the CA trust settings from the Keychain or the ldap.conf file, but I'm stymied as to which piece of software this might be. Does anyone have any clues on what I might be able to do here?
    Thanks,
    Andrew

    Hard to tell what is happening without looking at the application
    source, knowing what OS & hardware you're using etc. You might want to
    try running with different JVM versions to see if it's actually the VM
    that is the problem. If you have a support contract with BEA you could
    ask support to help you diagnose this.
    Regards,
    /Helena
    Ayub Khan wrote:
    I have an application running on Weblogic 8.1 ( with JRockit as the JVM). This
    application in turns talks to an iPlanet Directory server via LDAP/SSL. The problem
    seems to happen on loading the machine..the performance progressively gets worse
    and after a couple of seconds, all the threads stop responding. I checked the
    heap, cpu and the idle threads in the execute queue and there is nothing there
    to trigger alarms...there are quite a few idle threads still and the heap and
    the cpu utilization seem OK. On doing a thread dump, Is see that all the other
    threads seem to be in a state where they are waiting for data from LDAP and it
    is basically read only data that they are waiting on.
    Does anyone know what it is going on and help point me in the right direction.
    -Ayub

  • LDAP/AD Role group user login issue in sharepoint 2010 FBA with LDAP

    Hi.
    I created sharepoint 2010 site with LDAP FBA.If I add the AD user as form based user and try to login to my site its working very well but if I add a AD Group in to my site and try to login with one of the AD user of this group its say "Access
    Denied".
    In my project we want add AD group in sharepoin Groups not a individual AD users.
    Can anyone help me with this please its urgant?

    I added both LDAP membership and LDAP Role provider.And I can also find groups in people picker in my Central Admin and FBA Web app site colleciton.  
    <add name="ADMembers"
    type="Microsoft.Office.Server.Security.LDAPMembershipProvider, Microsoft.Office.Server, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71E9BCE111E9429C"
    server="company.com"
    port="389"
    useSSL="false"
    userNameAttribute="sAMAccountName"
    userContainer="DC=company,DC=com"
    userObjectClass="person"
    userFilter="(|(ObjectCategory=group)(ObjectClass=person))"
    userDNAttribute="distinguishedName"
    scope="Subtree"
    enableSearchMethods="true"
    otherRequiredUserAttributes="sn,givenname,cn"
    />
    <add name="ADRoles"
    type="Microsoft.Office.Server.Security.LdapRoleProvider, Microsoft.Office.Server, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c"
    server="Company.com"
    port="389"
    useSSL="false"
    groupContainer="DC=Company,DC=com"
    groupNameAttribute="cn"
    groupNameAlternateSearchAttribute="samAccountName"
    groupMemberAttribute="member"
    userNameAttribute="sAMAccountName"
    dnAttribute="distinguishedName"
    groupFilter="(ObjectClass=group)"
    userFilter="(ObjectClass=person)"
    scope="Subtree" />

  • Automatic upload of roles from ECC to portal (UME with LDAP)

    Hi experts,
    This thread reopen the question asked on the following message : automatic upload of roles from BI to portal
    However, it concerns this time "UME with LDAP".
    Problematic :
    SAP Library 04s tells us that is not yet possible to automate role replication (or role assigment replication) from ABAP Based back-end to Netweaver Portal. Only manual process for initial upload is possible.
    Source = http://help.sap.com/saphelp_nw04s/helpdata/en/41/5e4d40ecf00272e10000000a155106/frameset.htm
    Questions :
    1 - Did anyone ever try to implement such an automatic tool ?
    2 - What if I'm not able to write on the Active Directory ? I am still able, at least, to automate role assignment replication from ABAP Based back-end to Netweaver Portal (ie. UME with LDAP) ? Directly from SAP R/3 to EP through UME, without passing through Active Directory since the group field is not maintained in AD.
    Many thanks for your inputs
    Alexis MARTIN

    Hello,
    As I did not read the previous thread I don't know what exactly you are trying to achieve, but I can tell you about what we have done - as far as it is not too late yet.
    We use the portal with integration to a BI system. In the ABAP stack we have lots of roles with menu items for hundreds of reports. We want the users to see these roles in the portal.
    First we have used the role migration tool of the portal to upload these roles. There is a Java API for executing role uploads from code. You need to create a webservice in the java stack to call this api, and can call the webservice from ABAP.
    However it is just a question of time and role size until this will not work at all. Standard role migration is more or less crap, stability is a problem. It also creates a lot of logs in the PCD and thus fills the database with trash. (After a few OSS messages there is now a program for deleting logs + you can turn of logging.) Also upload of larger roles takes up to an hour, and you alwasy have the problem that your portal roles are not up to date during the day.
    When I got completely fed up, I have implemented an own navigation connector. When you log on to the portal it will connect to the ABAP stack via RFC, load the role, and generate the portal menu from it. It uses caching, but on every logon it checks whether the role has been updated in ABAP since the last time it was loaded. It is up to date, faster then PCD navigation, and you need absoluetely no periodical synching at all. I cant even understand why this is not offered by SAP per standard!
    Drawback is that it will of course only work for the menu items, and only menu items with an "URL-type" are supported. I'm prettry sure however that it would be possible to implement a few other types as well.
    Let me know if you are interested in the solution, I can give you a few additional details: oliverDOTsvisztATwienerbergerDOTcom
    Oliver

  • Install OCS 10.1.2 Infra DB failed with LDAP: error code 16 on Workspaces

    during install OCS Infrastructure DB OCS have error:
    ... processed key-value: logfile=/oracle/product/dbocs/workspaces/logs/cw_config_backend.log
    ... processed key-value: action=setup_backend
    ... processed key-value: oh=/oracle/product/dbocs
    ... processed key-value: oid=oid.domain
    ... processed key-value: oid_port=389
    ... processed key-value: oid_user_dn=cn=orcladmin
    ... processed key-value: oid_passwd=xxxxxx
    ... processed key-value: db_sn=ocs.domain
    ... processed key-value: dba_user=sys
    ... processed key-value: dba_passwd=xxxxxx
    ... processed key-value: cw_db_passwd=xxxxxx
    Attempting to set logfile to: /oracle/product/dbocs/workspaces/logs/cw_config_backend.log
    Processed oh=/oracle/product/dbocs
    BACKEND installation ...
    ... Trying to lookup database dn
    ... Obtain OID connection
    ...... Can not obtain OID ssl port.
    ...... OID port = "389"
    ...... Trying to establish a non-ssl connection. OID host "oid.domain", OID port "389", OID user dn "cn=orcladmin".
    ... OID connection created.
    ...... You must specify either db_dn or db_sn.
    ...... ldap search filter "(&(objectclass=orcldbserver)(orcldbglobalname=ocs.domain))"
    ...... Succesfully located database dn "cn=ocs,cn=OracleContext".
    ...... Database dn = "cn=ocs,cn=OracleContext"
    ... Validating existence and version of CW schema: "CWSYS" in database: "cn=ocs,cn=OracleContext".
    ... Obtain JDBC connect string
    ... JDBC connect string = "(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=ocsoas.domain)(PORT=1521))(CONNECT_DATA=(SERVICE_NAME=ocs.domain)))"
    ...derived: "jdbc_str=(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=ocsoas.domain)(PORT=1521))(CONNECT_DATA=(SERVICE_NAME=ocs.domain)))".
    Opening JDBC connection: "jdbc:oracle:thin:sys/xxxxxx@(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=ocsoas.domain)(PORT=1521))(CONNECT_DATA=(SERVICE_NAME=ocs.domain)))"
    Opening JDBC connection: "jdbc:oracle:thin:sys/xxxxxx@(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=ocsoas.domain)(PORT=1521))(CONNECT_DATA=(SERVICE_NAME=ocs.domain)))"
    Unlocking schema and setting passwd: "CWSYS/xxxxxx".
    Opening JDBC connection: "jdbc:oracle:thin:sys/xxxxxx@(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=ocsoas.domain)(PORT=1521))(CONNECT_DATA=(SERVICE_NAME=ocs.domain)))"
    ... Checking Workspaces container.
    ... Container "cn=CollaborativeWorkspaces,cn=Products,cn=OracleContext" already exist.
    ... Finish checking Workspaces container.
    ... Trying to create backend application entity in OID
    ...... Database dn = "cn=ocs,cn=OracleContext"
    ...... Backend entity name = "ocs"
    ...... Backend entity dn = "orclApplicationCommonName=ocs,cn=Database Instances,cn=CollaborativeWorkspaces,cn=Products,cn=OracleContext"
    ... Backend entries already exist. Cleanup old entries.
    deregisterProvisioningListener ...
    app dn = orclApplicationCommonName=ocs,cn=Database Instances,cn=CollaborativeWorkspaces,cn=Products,cn=OracleContext
    subscriber = dc=domain,dc=com
    ... Trying to remove entity "orclApplicationCommonName=ocs,cn=Database Instances,cn=CollaborativeWorkspaces,cn=Products,cn=OracleContext".
    ... Deleting "orclApplicationCommonName=ocs,cn=Database Instances,cn=CollaborativeWorkspaces,cn=Products,cn=OracleContext"
    Adding Workspaces application entity to: cn=Service Registry Viewers,cn=Groups,cn=OracleContext
    Adding Workspaces application entity to: cn=Service Registry Admins,cn=Groups,cn=OracleContext
    ... Insufficient privilege to create application entity "orclApplicationCommonName=ocs,cn=Database Instances,cn=CollaborativeWorkspaces,cn=Products,cn=OracleContext". Please check the user DN and password.
    javax.naming.directory.NoSuchAttributeException: [LDAP: error code 16 - One or more values for attribute uniquemember does not exist]; remaining name 'cn=Service Registry Admins,cn=Groups,cn=OracleContext'
    at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3009)
    at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2934)
    at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2740)
    at com.sun.jndi.ldap.LdapCtx.c_modifyAttributes(LdapCtx.java:1373)
    at com.sun.jndi.toolkit.ctx.ComponentDirContext.p_modifyAttributes(ComponentDirContext.java:235)
    at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.modifyAttributes(PartialCompositeDirContext.java:147)
    at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.modifyAttributes(PartialCompositeDirContext.java:136)
    at javax.naming.directory.InitialDirContext.modifyAttributes(InitialDirContext.java:136)
    at oracle.workspaces.share.util.oid.OIDShareUtil.setEntryAttribute(OIDShareUtil.java:471)
    at oracle.workspaces.share.util.oid.OIDShareUtil.addMemberToGroup(OIDShareUtil.java:420)
    at oracle.workspaces.share.util.oid.OIDShareUtil.addMemberToGroupIgnoreDuplicateMember(OIDShareUtil.java:435)
    at oracle.workspaces.install.CwConfigOID.createBackendEntity(CwConfigOID.java:1205)
    at oracle.workspaces.install.CwConfigOID.registerBackend(CwConfigOID.java:449)
    at oracle.workspaces.install.CwConfig.regBackend(CwConfig.java:320)
    at oracle.workspaces.install.CwConfig.run(CwConfig.java:609)
    at oracle.workspaces.install.CwConfig.main(CwConfig.java:790)
    oracle.workspaces.install.CwCAException: Error while executing action: "setup_backend"
    Caused by: javax.naming.directory.NoSuchAttributeException: [LDAP: error code 16 - One or more values for attribute uniquemember does not exist]
    at oracle.workspaces.install.CwConfig.run(CwConfig.java:639)
    at oracle.workspaces.install.CwConfig.main(CwConfig.java:790)
    Caused by: javax.naming.directory.NoSuchAttributeException: [LDAP: error code 16 - One or more values for attribute uniquemember does not exist]; remaining name 'cn=Service Registry Admins,cn=Groups,cn=OracleContext'
    at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3009)
    at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2934)
    at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2740)
    at com.sun.jndi.ldap.LdapCtx.c_modifyAttributes(LdapCtx.java:1373)
    at com.sun.jndi.toolkit.ctx.ComponentDirContext.p_modifyAttributes(ComponentDirContext.java:235)
    at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.modifyAttributes(PartialCompositeDirContext.java:147)
    at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.modifyAttributes(PartialCompositeDirContext.java:136)
    at javax.naming.directory.InitialDirContext.modifyAttributes(InitialDirContext.java:136)
    at oracle.workspaces.share.util.oid.OIDShareUtil.setEntryAttribute(OIDShareUtil.java:471)
    at oracle.workspaces.share.util.oid.OIDShareUtil.addMemberToGroup(OIDShareUtil.java:420)
    at oracle.workspaces.share.util.oid.OIDShareUtil.addMemberToGroupIgnoreDuplicateMember(OIDShareUtil.java:435)
    at oracle.workspaces.install.CwConfigOID.createBackendEntity(CwConfigOID.java:1205)
    at oracle.workspaces.install.CwConfigOID.registerBackend(CwConfigOID.java:449)
    at oracle.workspaces.install.CwConfig.regBackend(CwConfig.java:320)
    at oracle.workspaces.install.CwConfig.run(CwConfig.java:609)
    ... 1 more
    javax.naming.directory.NoSuchAttributeException: [LDAP: error code 16 - One or more values for attribute uniquemember does not exist]; remaining name 'cn=Service Registry Admins,cn=Groups,cn=OracleContext'
    at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3009)
    at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2934)
    at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2740)
    at com.sun.jndi.ldap.LdapCtx.c_modifyAttributes(LdapCtx.java:1373)
    at com.sun.jndi.toolkit.ctx.ComponentDirContext.p_modifyAttributes(ComponentDirContext.java:235)
    at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.modifyAttributes(PartialCompositeDirContext.java:147)
    at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.modifyAttributes(PartialCompositeDirContext.java:136)
    at javax.naming.directory.InitialDirContext.modifyAttributes(InitialDirContext.java:136)
    at oracle.workspaces.share.util.oid.OIDShareUtil.setEntryAttribute(OIDShareUtil.java:471)
    at oracle.workspaces.share.util.oid.OIDShareUtil.addMemberToGroup(OIDShareUtil.java:420)
    at oracle.workspaces.share.util.oid.OIDShareUtil.addMemberToGroupIgnoreDuplicateMember(OIDShareUtil.java:435)
    at oracle.workspaces.install.CwConfigOID.createBackendEntity(CwConfigOID.java:1205)
    at oracle.workspaces.install.CwConfigOID.registerBackend(CwConfigOID.java:449)
    at oracle.workspaces.install.CwConfig.regBackend(CwConfig.java:320)
    at oracle.workspaces.install.CwConfig.run(CwConfig.java:609)
    at oracle.workspaces.install.CwConfig.main(CwConfig.java:790)
    What should i do?
    help.
    Thanks

    closed
    Re: Install OCS 10.1.2 Infra DB failed with LDAP: error code 16 on Workspac

  • External Authentication with LDAP

    Has anyone integrated external authentication of Essbase with LDAP? I've searched discussion groups, websites with no luck, and of course, Essbase documentation doesn't help either. Any additional documentation will help.Thanks in advance!

    Thanks for the info. Is this sample code part of the default implementation that comes installed with the product (essldap.dll)? Or is this something completely different.Also, has anyone done anything similar in visual basic? We have a shortage of v c++ skills around here.Thanks again!

  • RSA authentication with LDAP group mapping

    Greetings,
    I'm trying to set up RSA authentication with LDAP group mapping with ACS Release 4.2(1) Build 15 Patch 3.
    The problem I'm having is that my users are in multiple OU's on our AD tree.  When I only put our base DN in for User Directory Subtree on ACS, it fails with a "External DB reports about an error condition" error.  If I add an OU in front of it, then it will work fine.
    As far as I know, you can only use one LDAP configuration with RSA.
    Any thoughts on this?

    @Tarik
    I believe your suggestion is the only way i'm going to get this to work. I ran across a similar method just this week that I have been working on.
    I was hoping for dynamic mapping with the original method, but I haven't found any way to make it happen.  I have resorted to creating a Radius profile on the RSA appliance for each access group I need.  Using the Class attribute, I then pass the desired Group name to the ACS, i.e. OU=Admins, and that seems to work.
    Thankfully, I have a small group of users that I am attempting to map.  I will only map those who need elevated priviliges to narrow down how many profiles I will have to manually create.  Likewise, our Account Admin will have to determine who gets assigned a particular access group.
    I would still prefer to do this dynamically.
    Scott

  • Can Oracle Database 11.2.0.3 authenticate with ldap (ODSEE 11g)??

    Dear Experts,
    I wanted to know if the Oracle DB 11.2.0.3 can authenticate with LDAP ODSEE 11g. I got to know that in order to authenticate to LDAP oracle DB needs to connect to Oracle Virtual Directory (OVD). Is this the correct statement. Any inputs will be appriciate it. thanks in advance.
    Ibbi
    Edited by: Ibbi2200 on Apr 29, 2013 11:30 AM

    Yes i have looked into these Docs, It seems like Oracle DB does not connect directly with ODSEE 11g. It seems like you have to have OID (LDAP) not ODSEE (LDAP) for DB connection, and if you need to use ODSEEE, you have to use OVD to connect DB....Which is weird as OID is also an LDAP...and ODSEE is also an Oracle Ldap....
    this is the error i get when i tried connecting DB to ODSEE.
    "Error
    Unable to connect to Oracle Internet Directory.
    I am not using OID, we have ODSEE. Is there any pointers or workaround to connect ODSEE to DB? I am just trying to avoid OVD in the middle. Any help will be appriciated.
    Thanks
    ibbi

  • Install NetConnect in Global Zone of Solaris 10 x86 with 5 local zone fail

    Problem:
    Install NetConnect in Global Zone of Solaris 10 x86 with 5 local zone failed
    But I didn't have any issue with the same pkg in Solaris 9
    Steps taken:
    # groupadd netcon
    # useradd -d /export/home/netcon -g netcon -m netcon
    # vi /etc/shadow
    change LK to NP
    # ./UninstallNetConnect.003.002.001.sh
    # ./InstallNetConnect.003.002.001.sh
    Enter the user account to use: netcon
    Enter group: netcon
    Installing Sun(SM) Net Connect Proxy Core as <SUNWsrspx>
    ## Installing part 1 of 1.
    /etc/opt/SUNWsrspx/CustomerCert.pem
    /etc/opt/SUNWsrspx/SRSCACert.pem
    /etc/opt/SUNWsrspx/binaries
    /etc/opt/SUNWsrspx/srsproxyconfig.cfg
    /opt/SUNWsrspx/bin/srsexec
    /opt/SUNWsrspx/bin/srsinstall
    /opt/SUNWsrspx/bin/srsinstallmode
    /opt/SUNWsrspx/bin/srsproxy
    /opt/SUNWsrspx/bin/srspxrun
    /opt/SUNWsrspx/bin/srspxstat
    /opt/SUNWsrspx/bin/srspxtrace
    /opt/SUNWsrspx/bin/srsuser
    /opt/SUNWsrspx/bin/srsxfer
    /opt/SUNWsrspx/lib/srsimapi.jar
    /usr/lib/libsrsimapi.so.1
    [ verifying class <none> ]
    ## Executing postinstall script.
    copying initial install customer cert into place
    copying initial install srs cert into place
    copying initial install proxy config file into place
    removing any existing uninstallscript before copying the correct one
    copying uninstall script into place
    /var/sadm/pkg/SUNWsrspx/install/postinstall: /opt/SUNWsrspx/bin/srspxrun: cannot execute
    proxy queue initialization failed
    pkgadd: ERROR: postinstall script did not complete successfully
    Installation of <SUNWsrspx> failed.
    ERROR: pkgadd failed for: SUNWsrspx
    Please correct this situation and rerun the installation.
    Exiting installation.
    # cat /var/adm/messages
    Oct 7 00:00:01 planet root: [ID 702911 daemon.error] ERROR: proxy queue initialization failed
    Any clue, or it will only possible in Global zone that didn't have any local zone
    thanks in advance

    Problem:
    Install NetConnect in Global Zone of Solaris 10 x86
    with 5 local zone failed
    But I didn't have any issue with the same pkg in
    Solaris 9
    Steps taken:
    # groupadd netcon
    # useradd -d /export/home/netcon -g netcon -m netcon
    # vi /etc/shadow
    change LK to NP
    # ./UninstallNetConnect.003.002.001.sh
    # ./InstallNetConnect.003.002.001.sh
    Enter the user account to use: netcon
    Enter group: netcon
    Installing Sun(SM) Net Connect Proxy Core as
    <SUNWsrspx>
    ## Installing part 1 of 1.
    /etc/opt/SUNWsrspx/CustomerCert.pem
    /etc/opt/SUNWsrspx/SRSCACert.pem
    /etc/opt/SUNWsrspx/binaries
    /etc/opt/SUNWsrspx/srsproxyconfig.cfg
    /opt/SUNWsrspx/bin/srsexec
    /opt/SUNWsrspx/bin/srsinstall
    /opt/SUNWsrspx/bin/srsinstallmode
    /opt/SUNWsrspx/bin/srsproxy
    /opt/SUNWsrspx/bin/srspxrun
    /opt/SUNWsrspx/bin/srspxstat
    /opt/SUNWsrspx/bin/srspxtrace
    /opt/SUNWsrspx/bin/srsuser
    /opt/SUNWsrspx/bin/srsxfer
    /opt/SUNWsrspx/lib/srsimapi.jar
    /usr/lib/libsrsimapi.so.1
    [ verifying class <none> ]
    ## Executing postinstall script.
    copying initial install customer cert into place
    copying initial install srs cert into place
    copying initial install proxy config file into place
    removing any existing uninstallscript before copying
    the correct one
    copying uninstall script into place
    /var/sadm/pkg/SUNWsrspx/install/postinstall:
    /opt/SUNWsrspx/bin/srspxrun: cannot execute
    proxy queue initialization failed
    pkgadd: ERROR: postinstall script did not complete
    successfully
    Installation of <SUNWsrspx> failed.
    ERROR: pkgadd failed for: SUNWsrspx
    Please correct this situation and rerun the
    installation.
    Exiting installation.
    # cat /var/adm/messages
    Oct 7 00:00:01 planet root: [ID 702911 daemon.error]
    ERROR: proxy queue initialization failed
    Any clue, or it will only possible in Global zone
    that didn't have any local zone
    thanks in advance
    [I believe that it does not work in x86, watches with pkginfo - l SUNWsrspx, in the platform.
    Willy Suarez
    Sopport UNIX
    Colombia/code]                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       

Maybe you are looking for