Structure of our Active Directory

Hi All,
We have following active directory structure in our organization. I am not sure, if this is a flat or deep hierarchy.
We have domain(forest)as xyz.com. we have a group created SAP under OU=Applications,DC=xyz,DC=com. All our users accessing Portal will be member of the group SAP. So our Grouppath is OU=SAP,OU=Applications,DC=xyz,DC=com
About User accounts, we have our users scattered in the forest xyz.com. For testing purpose, we are taking few users from account group Dallas. The structure is OU=Dallas-SAP,OU=Dallas-Contractors,OU=Dallas,DC=xyz,DC=com.
These users will be member of group SAP. Since users can be a member of any group (for example SAP group), i presume they represent flat hierarchy structure.
groups and user accounts are stored in tree structure as mentioned above, so they represent deep hierarchy structure.
So i am confused, what should be our Data source configuration? Is it flat or deep or mixed?
FYI : An admin user is created in SAP group.
Any help is highly appreciated.
Thanks & Regards,
Gowri

Similar Messages

Lion Server not reading Active Directory Groups reliably

I am trying to upgrade one of our XServes from Snow Leopard Server to Lion Server and am running into a strange issue with our Active Directory based users and Groups.
The current Snow Leopard Server serving files from a XSan volume is running fine, though we find a very long Lag time for Windows users to connect. Once a few users have connected the lag seems to go away, but it is still not nearly as fast as Mac users connecting or Windows connecting to a PC server.
So I have connected a second Xserve to the SAN and performed a clean install of Lion Server. Initially while it would find my Active Directory Groups it would not import any of the users, so obvioulsly no one could connect. In a last ditch effort I installed the beta of 10.7.4, which seemed to resolve the issue for a small group of test users. However as I expanded the test I found that some users would get a message that the were no resources available to them, or they didn't have the correct permissions. This is very strange as everyone is in the same group so should have the same permissions. As a test I took one of the user accounts and created a new share and gave him R/W permission to that share and suddenly all of the shares that he should have had permission to in the first place popped up.
The only thing that I can think of is that we have such a large Active Directory structure that the authentication is timing out or reaching some user limit and stops looking. (we have over 50,000 users and thousands of groups spread through multiple OUs in the AD structure)
The new Server.app in Lion looks nice, but it does not seem to have nearly the robustness of the previous Server Admin tools. For instance, I never needed or wanted to setup a "Golden Triangle" but with Lion it is required. Perviously I could search for AD users or groups and drag them from the search window to the share to assign permission, now even though I've imported the groups and users it needs to search the entire directory when assigning permissions - why can't it see the groups that are already there? Why can I run a dscl search and find a user or group instantly, but the Server.app hangs for 5 minutes and shows 0 results?
Has anyone found a way to make Lion Server work in an enterprise environment?

Yesterday morning I bound a 10.7.4 server to our AD, and in the afternoon I eventually saw all the AD users, groups, etc show in Workgroup Manager. Now, with dscl, I can see all the AD user and group records, and with Workgroup Manager, I can search the groups, users, and computers, but with the Server.app, when trying to create new group of the type "Imported group from another directory", the searches returned nothing. Directory Utility can show all the AD information also. Our AD has thousands of user record, and so it is reasonable that it may take some time for the Mac server to get all the info. But from the add users or groups interface, I just could not get any search results. What could be wrong then?

Create admin folders based on OU organizational unit active directory

We have thousands of users to import from our active directory. In my proof of concepts, the active directory integration service 6.3 running on ALUI 6.1 MP1 imports all the users to the same folder - the folder where my remote authentication source object is.<br>
Can the active directory integration service create folders based on the many OU's (organizational units) we have? We'd like our portal admin folder structure to mirror our active directory organizational unit structure, but we don't want to have to recreate it manually for the obvious deployment and ongoing maintenance reasons. Is that possible?

You asked: Can the active directory integration service create folders based on the many OU's (organizational units) we have?
As far as I understand there is not a way to dynamically generate Admin Hierarchy folders based upon this job.
Obviously where there is a will there is a way, and if you have a crew of strong developers you could probably write something custom that would do this for you (maybe), but here are 2 other approaches to consider:
1) use 1 AD Auth source and split the users into multiple folders based upon group association in the "Default Profiles" section under main settings. The problem with this is that if users change groups in AD they will not be resorted in your admin hierarchy.
2) use multiple AD Auth sources, each with an appropriate query filter. I could be wrong, but the downfall to this approach is that the users that change OU's would be entirely deleted and recreated.
Edited by geoffgarcia at 04/24/2008 8:11 AM

SharePoint Foundation Active Directory Problem

Hey,
I have a problem with the Active Directory connection to SharePoint Foundation.
My Situation looks like this:
I'm working on a kind of project controlling plattform. Each of our customers has its own site. Also each customer has an account in our Active Directory. For the administrative part, we have a list which contains some infos of the customer, the url to its
site and the contact person.
I wrote an import-script which creates a site and a new item in the list. To put the contact person in the list-item, I use a code-snippet like this:
try
user = web.EnsureUser(loginName);
catch (Exception ex)
throw new Exception("LoginName " + loginName + " not found");
Now the problem is, that the try/catch block fails too often which means: SharePoint doesn't know the loginNames of some of our customers.
Why does SharePoint not know maybe 1/5 of all our customers? All of them have an account in our active directory, none of them ever logged in the SharePoint (at the time they even doesn't know, that they have a SharePoint site for this project).
I searched the internet for the problem but all I found where questions related to the synchronization of ad-properties to SharePoint Foundation. But I don't want to sync the phone-number or something like that - I want SharePoint only to know all the loginNames
of our customers, not only 1/5 of them.
How do I achive this, what am I doing wrong?
Thank you!

web.EnsureUser has nothing to do with the UPS at all. This has nothing to do with synchronisation (it does have a role but it's a maintenance one and nothing to do with authentication.
The simplest answer is that the login names are being entered wrongly. Having said that there are a few areas you can look at to try to identify the problem:
Does it fail repeatedly for the same username? Can you add that user to the site manually using a people picker control and if so will the script work afterwards? Are there any trends in the user accounts that SharePoint cannot find?

How do I get info from Active Directory and use it in my web-applications?

I borrowed a nice piece of code for JNDI hits against Active Directory from this website: http://www.sbfsbo.com/mike/JndiTutorial/
I have altered it and am trying to use it to retrieve info from our Active Directory Server.
I altered it to point to my domain, and I want to retrieve a person's full name(CN), e-mail address and their work location.
I've looked at lots of examples, I've tried lots of things, but I'm really missing something. I'm new to Java, new to JNDI, new to LDAP, new to AD and new to Tomcat. Any help would be so appreciated.
Thanks,
To show you the code, and the error message, I've changed the actual names I used for connection.
What am I not coding right? I get an error message like this:
javax.naming.NameNotFoundException[LDAP error code 32 - 0000208D: nameErr DSID:03101c9 problem 2001 (no Object), data 0,best match of DC=mycomp, DC=isd, remaining name dc=mycomp, dc=isd
[code]
import java.util.Hashtable;
import java.util.Enumeration;
import javax.naming.*;
import javax.naming.directory.*;
public class JNDISearch2 {
// initial context implementation
public static String INITCTX = "com.sun.jndi.ldap.LdapCtxFactory";
public static String MY_HOST = "ldap://99.999.9.9:389/dc=mycomp,dc=isd";
public static String MGR_DN = "CN=connectionID,OU=CO,dc=mycomp,dc=isd";
public static String MGR_PW = "connectionPassword";
public static String MY_SEARCHBASE = "dc=mycomp,dc=isd";
public static String MY_FILTER =
"(&(objectClass=user)(sAMAccountName=usersignonname))";
// Specify which attributes we are looking for
public static String MY_ATTRS[] =
{ "cn", "telephoneNumber", "postalAddress", "mail" };
public static void main(String args[]) {
try { //----------------------------------------------------------
// Binding
// Hashtable for environmental information
Hashtable env = new Hashtable();
// Specify which class to use for our JNDI Provider
env.put(Context.INITIAL_CONTEXT_FACTORY, INITCTX);
// Specify the host and port to use for directory service
env.put(Context.PROVIDER_URL, MY_HOST);
// Security Information
env.put(Context.SECURITY_AUTHENTICATION, "simple");
env.put(Context.SECURITY_PRINCIPAL, MGR_DN);
env.put(Context.SECURITY_CREDENTIALS, MGR_PW);
// Get a reference toa directory context
DirContext ctx = new InitialDirContext(env);
// Begin search
// Specify the scope of the search
SearchControls constraints = new SearchControls();
constraints.setSearchScope(SearchControls.SUBTREE_SCOPE);
// Perform the actual search
// We give it a searchbase, a filter and the constraints
// containing the scope of the search
NamingEnumeration results = ctx.search(MY_SEARCHBASE, MY_FILTER, constraints);
// Now step through the search results
while (results != null && results.hasMore()) {
SearchResult sr = (SearchResult) results.next();
String dn = sr.getName() + ", " + MY_SEARCHBASE;
System.out.println("Distinguished Name is " + dn);
// Code for displaying attribute list
Attributes ar = ctx.getAttributes(dn, MY_ATTRS);
if (ar == null)
// Has no attributes
System.out.println("Entry " + dn);
System.out.println(" has none of the specified attributes\n");
else // Has some attributes
// Determine the attributes in this record.
for (int i = 0; i < MY_ATTRS.length; i++) {
Attribute attr = ar.get(MY_ATTRS);
if (attr != null) {
System.out.println(MY_ATTRS[i] + ":");
// Gather all values for the specified attribute.
for (Enumeration vals = attr.getAll(); vals.hasMoreElements();) {
System.out.println("\t" + vals.nextElement());
// System.out.println ("\n");
// End search
} // end try
catch (Exception e) {
e.printStackTrace();
System.exit(1);
My JNDIRealm in Tomcat which actually does the initial authentication looks like this:(again, for security purposes, I've changed the access names and passwords, etc.)
<Realm className="org.apache.catalina.realm.JNDIRealm" debug="99"
connectionURL="ldap://99.999.9.9:389"
connectionName="CN=connectionId,OU=CO,dc=mycomp,dc=isd"
connectionPassword="connectionPassword"
referrals="follow"
userBase="dc=mycomp,dc=isd"
userSearch="(&(sAMAccountName={0})(objectClass=user))"
userSubtree="true"
roleBase="dc=mycomp, dc=isd"
roleSearch="(uniqueMember={0})"
rolename="cn"
/>
I'd be so grateful for any help.
Any suggestions about using the data from Active directory in web-application.
Thanks.
R.Vaughn

By this time you probably have already solved this, but I think the problem is that the Search Base is relative to the attachment point specified with the PROVIDER_URL. Since you already specified "DC=mycomp,DC=isd" in that location, you merely want to set the search base to "". The error message is trying to tell you that it could only find half of the "DC=mycomp, DC=isd, DC=mycomp, DC=isd" that you specified for the search base.
Hope that helps someone.
Ken Gartner
Quadrasis, Inc (We Unify Security, www -dot- quadrasis -dot- com)

Query Active Directory + Problem with thumbnailPhoto

Hi<o:p></o:p>
I have a problem and I don’t know if it is my SQL Query, so here goes
<o:p></o:p>
I have a view on my SQL server that Queries our Active Directory. I can see that there is data in the table.<o:p></o:p>
But when I try to use the Image in some C# code I get an error on 60% of the images with the exception header missing or corrupted.
My view is built with this Query:
select
* from
openquery
ADSI,'SELECT sAMAccountName, mail, title, displayName, telephoneNumber, mobile, sn, givenName, department, thumbnailPhoto
FROM ''LDAP:[REMOVED]''
WHERE objectCategory = ''Person''
Do you have any idea where the problem is? The photos shows up fine in Outlook, SharePoint, lync etc. I’m pretty sure that the C# code works correctly. Hope you can help.
Regards
If only I had time to learn everything I wanted ...

Hi Latheesh
I've tried with this script:
SELECT ISNULL(ROW_NUMBER() OVER ( ORDER BY department ), -999) 'id' ,
CONVERT(NVARCHAR(25), givenName) AS Fornavn ,
CONVERT (NVARCHAR(50), sn) AS Efternavn ,
CONVERT(CHAR(5), UPPER(SUBSTRING(mail, CHARINDEX(mail, N'@'),
CHARINDEX(N'@', mail)))) AS 'initialer' ,
CONVERT(NVARCHAR(255), mail) AS Mail ,
CONVERT(NVARCHAR(75), title) AS Stilling ,
CONVERT(NVARCHAR(120), department) AS Afdeling ,
CONVERT(NVARCHAR(13), telephoneNumber) AS Fastnet ,
CONVERT(NVARCHAR(13), mobile) AS Mobil ,
CASE WHEN userAccountControl = 2 THEN 'Account is Disabled'
WHEN userAccountControl = 16 THEN 'Account Locked Out'
WHEN userAccountControl = 17
THEN CONVERT (VARCHAR(48), 'Entered Bad Password')
WHEN userAccountControl = 32
THEN CONVERT (VARCHAR(48), 'No Password is Required')
WHEN userAccountControl = 64
THEN CONVERT (VARCHAR(48), 'Password CANNOT Change')
WHEN userAccountControl = 512 THEN 'Normal'
WHEN userAccountControl = 514 THEN 'Disabled Account'
WHEN userAccountControl = 544
THEN 'Account Enabled - Require user to change password at first logon'
WHEN userAccountControl = 8192
THEN 'Server Trusted Account for Delegation'
WHEN userAccountControl = 524288
THEN 'Trusted Account for Delegation'
WHEN userAccountControl = 590336
THEN 'Enabled, User Cannot Change Password, Password Never Expires'
WHEN userAccountControl = 65536
THEN CONVERT (VARCHAR(48), 'Account will Never Expire')
WHEN userAccountControl = 66048
THEN 'Enabled and Does NOT expire Paswword'
WHEN userAccountControl = 66050
THEN 'Normal Account, Password will not expire and Currently Disabled'
WHEN userAccountControl = 66064
THEN 'Account Enabled, Password does not expire, currently Locked out'
WHEN userAccountControl = 8388608
THEN CONVERT (VARCHAR(48), 'Password has Expired')
ELSE CONVERT (VARCHAR(248), userAccountControl)
END AS 'Disabled' ,
CONVERT(NVARCHAR(75), givenName + ' ' + sn) AS 'DisplayName' ,
CONVERT (VARBINARY(MAX), thumbnailPhoto) AS 'Photo'
INTO ##adTemptable
FROM openquery
ADSI,'SELECT sAMAccountName, mail, title, displayName, telephoneNumber, mobile, sn, givenName, department, thumbnailPhoto,userAccountControl
FROM ''[REMOVED]''
WHERE objectCategory = ''Person''
WHERE department IS NOT NULL
But i still gets the same error on MANY rows
OLE DB provider 'ADsDSOObject' for linked server 'ADSI' returned truncated data for column '[ADsDSOObject].thumbnailPhoto'. The actual data length is 6846 and truncated data length is 4000.
OLE DB provider 'ADsDSOObject' for linked server 'ADSI' returned truncated data for column '[ADsDSOObject].thumbnailPhoto'. The actual data length is 7006 and truncated data length is 4000.
OLE DB provider 'ADsDSOObject' for linked server 'ADSI' returned truncated data for column '[ADsDSOObject].thumbnailPhoto'. The actual data length is 6496 and truncated data length is 4000.
If only I had time to learn everything I wanted ...

Active Directory - Authentication Problem

Hi Guys,
I'm seeing something really weird in my Environment.
For example, we have two users as example below in our Active Directory:
jonesp - Paul Jones
jonesph - Phillip Jones
These users can't login into any Mac connected in Active Directory, on PCs the login goes fine.
But when I renamed the login jonesp to jonespa, both users can login in the Macs.
Anyone have this issue too? There is a KB telling about this behavior?
This happens on Macs running 10.7.* and 10.8.*.
Thanks

Sorry CT,
The problem isn't with Active Directory, this only happens on Macs.
The problem doesn't happens with Windows and Linux, only on Macs.
Anyway thanks for your help.
Regards

Setting up Wiki Calendars in iCal with Active Directory Accounts

I'm Having a little trouble wrapping my head around our Wiki Calendar Solution,
Id like to find a way to get the 10.6 Wiki Server Calendar's in iCal Client - using our active directory authentication.
I have a test 10.6 Server bound to our Active Directory with Wiki's up and running and am able to log in with AD account's and view and manage the Wiki Calendar - I can see how to subscribe to the calendar's - But I need full integration with iCal and maybe even Outlook - subscribing only provides read access.
anyone have any idea how his can be accomplished in and active directory setting - my searches have lead me to OD solutions and thats not going to work.

I don't know how much I'll be able to help, but I do have AD accounts using wiki services. Can you verify a few things:
1. The AD group is listed in the "Wiki Creators" box in Server Admin, yes?
2. If you open Terminal and run "sudo serveradmin settings teams:enableClearTextAuth", does it return "teams:enableClearTextAuth = yes"?
3. If you open System Preferences -> Accounts and then edit the directory servers, does the AD domain show as working normally?
Also, have you worked to isolate the problem? Have you tried creating an OD user to test against the wiki? Are the logs showing anything?

Using iChat Server with Windows clients in an integrated Active Directory/Open Directory environment

A co-worker (Super Brent) and I were working on using iChat as an internal IM server after having used Openfire for a couple days. The reason for switching was basically that we had a Mac Mini Server that was available so we decided to take this on.
First problem: Knowing whether or not Kerberos was needed for AD/OD integration. We spent a ton of time on this, not knowing a huge amount about AD and with our server administrator on courses, we just kept poking at it and removed Kerberos.
For the AD/OD integration, we first bound the Mac Mini to our Active Directory server. We shut off LDAPv3 support as we only wanted to use the AD functionality. Additionally, we ensured that the search policy in Directory Utility only used Active Directory. Then we created an Open Directory master in the Open Directory service. We enabled a self-signed certificate and trusted it locally. After creating the iChat service, ensure that you use the self-signed SSL Certificate and set authentication to Standard. (no kerberos).
Second problem: Once this was complete, we started to test clients out. We were unable to successfully login using our AD credentials using Spark IM and Pandium IM. After trying nearly 100 different variations of server configs, we decided to try a new client. I installed Miranda IM on my Windows XP machine and tried a few different setups. It turned out that the magic potion was to make sure that the "resource" field was set to "Home" and use SSL for encryption. This resource setting was the deal breaker for the other IM clients as many of them such as Spark and Pandium do not have this as a login option.
We ended up using Pidgin IM as the Windows client of choice as it did have the resource variable and it's interface was the best suited for our environment and users.
I hope this helps someone out there as we spent days looking all over the internet trying to figure this out.
Cheers,
Frenchy and Super Brent

Hi,
iChat Server is not something that I know a great deal about.
I tend to point people to the OS X Server Communities and to look out for posts by Tim Harris.
Thanks for taking the time to post this.
9:58 PM Friday; February 10, 2012
Please, if posting Logs, do not post any Log info after the line "Binary Images for iChat"
 iMac 2.5Ghz 5i 2011 (Lion 10.7.3)
 G4/1GhzDual MDD (Leopard 10.5.8)
 MacBookPro 2Gb (Snow Leopard 10.6.8)
 Mac OS X (10.6.8),
"Limit the Logs to the Bits above Binary Images."  No, Seriously

Single Signon and Integration with Active Directory

Hi,
We have a requirement to integrate Active Directory with SAP and implement Single Signon solution. Our Active Directory is running on Windows 2003 and we are having systems 4.7 , ECC6.0 which run on Linux OS in our landscape.
Can anyone of you help me by answering following questions
1. Is there any need of any third party solution(tool) to integrate Active Directory and SAP and activate single signon?
2.Is there any difference in integration from SAP 4.7 and ECC6.0 of SAP on Linux OS with Active Directory ?
3. If possible please share any documents or links on above issue.
Suitable answers will be rewarded with points. Thanks in advance for your help
Regards
Murali

> Thank you very much for providing me the link. But the document on link seem to be in German. Can you please let me know how to get English version of this document.
I'm sorry, you'd have to ask Realtech for that document in English.
Basically you can follow
http://osdir.com/ml/encryption.kerberos.general/2004-11/msg00007.html
Markus

No longer have appropriate privileges to "Active Directory" servers with Lion

Hi:
Our University maintains protected disk storage space that we can access from any computer in the hospital. This is an incredibly convenient and secure method for moving information in our enterprise.
Our enterprise is somewhat Mac-averse, but under Leopard and Snow Leopard we were able to access these folders from our office Macs (all public computers are PCs). With the upgrade to Lion we now only have read access to files on these folders, whereas with Leopard and Snow Leopard we had full, i.e., read and write, access to files on these folders.
Here’s what we do:
Go to University VPN access webpage.
Click “Start” next to “Network Connect” under “Client Application Sessions”
Answer “Trust” to “Do you want to accept this certificate from the web site ‘myvpnmyuniversity.edu’ for the purpose of exchanging encrypted information? Publisher authenticity can not be verified’
Menu Command: Go>Connect to Server>cifs//name
Dialog: “Enter your name and password for the server “name”
Navigate to my folder on the university’s system.
Here’s what’s changed: in the past, using Leopard and Snow Leopard, those of us with Macs in the department now had the folder mounted on our desktops with full access. With the upgrade to Lion we only have read access: Get Info under Sharing and Permissions says “You can only read”.
This has happened to many of us, so it’s not just an issue on my computer or network.
Our local computer help guy, who is incredibly nice but not Mac knowledgeable, says “It is something that MAC has done that is preventing you to access our Active Directory servers”. He is aware that this is something unique to Lion, since it worked on Leopard and Snow Leopard.
His bosses, who know more, are, enuf said, not Mac “friendly”.
Read and write access continue to work just fine when accessing from the many PCs running XP throughout the enterprise.
Hence we’re looking for some help here. Is there something we end users can do differently, or is there something we can share with our local friendly but not Mac knowledgeable computer help guy that he can do, to get us write access?
Thank you!
OS 10.7.4

More info from one of our IT guys:
"I know that there have been several different people looking into this. Found several people complaining about it, but no answers. You can sometimes get connection and be able to copy a file or save it once or twice, but usually it tells you that you can only read it."
For me at least, it's been consistent, i.e., never any write access, just read.

Joining 10.8.5 with existing account to Active Directory domain

Hi-
I have a MacBook Pro that I am using as a test computer to figure out how to introduce the growing population of Mac's into our Active Directory environment in our small company. This comptuer is running OSX 10.8.5
There is a test account in AD that I will be using to connect to the windows domain. I am able to get the Laptop binded to AD, and have no problem authenticating, and seeing all the network resources required.
Here is the part that has me stumped:
Is there any way to take my existing "local" account that was configured when I began using my MBP without Active Directory and continue to use it, but logon to the laptop using my Active Directory account?
Perhaps copy all the settings and preferences from the local account ontop of the AD account on the laptop?
I have been using this laptop as my personal machine for many months and have quite a few customizations made to my deskop preferences, icon layouts, etc. This will be same case with all of the users that will soon be authenticating on the domain. We need this for centralized management of network shares, password policies, and number of other security features.
There is some limited information on the web, but nothing that I have tried really works, here's some of what i found and the difficulty that resulted.
http://community.spiceworks.com/how_to/show/37886-convert-mac-local-user-into-ac tive-directory-network-user
- The script mentioned in step 3 was not able to copy local account to the destination folder.
http://robotcloud.screenstepslive.com/s/2459/m/5322/l/112415-convert-local-accou nts-to-network-mobile-accounts
- The sudo mv /Users/USERNAME /Users/DIRUSERNAME command was not able to make the "DIRUSERNAME" directory, and did not have any effect if this directory already existed due to a prior logon.
I'm just looking for some help making it so that my users can retain their desktop layouts that they are used to, but logon to the domain using AD credentials.
Seems simple, but is pretty difficult to get done.
Thanks in advance for any help....
-Aaron

This might help:
http://www.afp548.com/article.php?story=20060517222656622&query=radius

Active Directory Not Syncing Correctly in ES2

Hello,
We had our Active Directory 2003 synced up using Adobe Livecycle ES. There would be around 30,000 users that would be synced and this would take around 3 - 4 1/2 minutes to run. This worked perfectly for us for the past half of a year or so.
Last week we upgraded to ES2 and moved all of our processes over. We removed ES and did a fresh install of ES2. Everything seems to be working fine now except the Active Directory isn't syncing properly. When we run the sync, different numbers of users will be fetched. Sometimes it's around three thousand, sometimes seven thousand, sometimes ten thousand, but it never seems to get through them all. In the server log it does say that the directory synchronization completed successfully though even though the number fetched is changing. We made sure the settings are exactly the same as they were before, and we even tried a few different settings, but it still doesn't get all the users. For testing purposes, we tried changing the search filter to pick specific people that aren't showing up during the normal sync and it will show up fine, so I'm wondering if there is something stopping it from going all the way through?
We also have another enterprise domain connected which has around 2,000 users on it and have not had this problem with it.
Here are some of the sync statistics from the past few syncs: (The active directory name has been stripped for security purposes). If you need any more information please feel free to ask. We would like to have this resolved as soon as possible.
2010-05-30 21:02:51,366 INFO [com.adobe.idp.um.businesslogic.synch.DomainSynchronizer]
========== Synch Statistics for ============
Total User Fetched - 5633
Total Group Fetched - 0
Total Members Fetched - 0
Total time taken is 110 sec
[100.00%] [100.00%]Domain Synchronizer(2 runs) : Total 110,375 ms, Max 110359 ms, Min 16 ms, Avg 55187 ms
--[99.99%] [99.99%]User and group phase(1 runs) : Total 110,359 ms, Max 110359 ms, Min 110359 ms, Avg 110359 ms
----[95.78%] [95.80%]Users synch from (6 runs) : Total 105,719 ms, Max 19141 ms, Min 14281 ms, Avg 17619 ms
------[1.18%] [1.23%]Provider (31 runs) : Total 1,298 ms, Max 109 ms, Min 31 ms, Avg 41 ms
--[0.01%] [0.01%]Memberhsip phase(1 runs) : Total 16 ms, Max 16 ms, Min 16 ms, Avg 16 ms
-------Persistence Statistics-------
Users ->
added = 8
removed = 2568
updated = 5625
unchanged = 0
renamed = 0
failed = 0
UniqueId changed = 0
Groups ->
added = 0
removed = 0
updated = 0
unchanged = 0
failed = 0
UniqueId changed = 0
Emails ->
added = 8515
removed = 106
unchanged (In changed Principals) = 16784
Group Members ->
added = 0
removed = 0
unchanged = 0
unknown = 0
failed = 0
-------Batch Statistics-------
Successful User Batches = 113
Failed User Batches = 0
Successful Group Batches = 0
Failed Group Batches = 0
Successful Member Batches = 0
Failed Member Batches = 0
======================================
2010-06-02 21:03:43,692 INFO [com.adobe.idp.um.businesslogic.synch.DomainSynchronizer]
========== Synch Statistics for ============
Total User Fetched - 7140
Total Group Fetched - 0
Total Members Fetched - 0
Total time taken is 165 sec
[100.00%] [100.00%]Domain Synchronizer(2 runs) : Total 164,781 ms, Max 164750 ms, Min 31 ms, Avg 82390 ms
--[99.98%] [99.98%]User and group phase(1 runs) : Total 164,750 ms, Max 164750 ms, Min 164750 ms, Avg 164750 ms
----[96.78%] [96.79%]Users synch from (8 runs) : Total 159,469 ms, Max 26719 ms, Min 3500 ms, Avg 19933 ms
------[1.01%] [1.05%]Provider (42 runs) : Total 1,667 ms, Max 109 ms, Min 15 ms, Avg 39 ms
--[0.02%] [0.02%]Memberhsip phase(1 runs) : Total 31 ms, Max 31 ms, Min 31 ms, Avg 31 ms
-------Persistence Statistics-------
Users ->
added = 8
removed = 5
updated = 7132
unchanged = 0
renamed = 1
failed = 0
UniqueId changed = 0
Groups ->
added = 0
removed = 0
updated = 0
unchanged = 0
failed = 0
UniqueId changed = 0
Emails ->
added = 3340
removed = 105
unchanged (In changed Principals) = 33761
Group Members ->
added = 0
removed = 0
unchanged = 0
unknown = 0
failed = 0
-------Batch Statistics-------
Successful User Batches = 142
Failed User Batches = 1
Successful Group Batches = 0
Failed Group Batches = 0
Successful Member Batches = 0
Failed Member Batches = 0
======================================
2010-06-03 08:56:43,286 INFO [com.adobe.idp.um.businesslogic.synch.DomainSynchronizer]
========== Synch Statistics for ============
Total User Fetched - 2960
Total Group Fetched - 0
Total Members Fetched - 0
Total time taken is 68 sec
[100.00%] [100.00%]Domain Synchronizer(2 runs) : Total 67,984 ms, Max 67921 ms, Min 63 ms, Avg 33992 ms
--[99.91%] [99.91%]User and group phase(1 runs) : Total 67,921 ms, Max 67921 ms, Min 67921 ms, Avg 67921 ms
----[96.37%] [96.46%]Users synch from (3 runs) : Total 65,516 ms, Max 23016 ms, Min 19766 ms, Avg 21838 ms
------[4.00%] [4.15%]Provider (17 runs) : Total 2,719 ms, Max 844 ms, Min 31 ms, Avg 159 ms
--[0.09%] [0.09%]Memberhsip phase(1 runs) : Total 63 ms, Max 63 ms, Min 63 ms, Avg 63 ms
-------Persistence Statistics-------
Users ->
added = 2
removed = 6632
updated = 2958
unchanged = 0
renamed = 0
failed = 0
UniqueId changed = 0
Groups ->
added = 0
removed = 0
updated = 0
unchanged = 0
failed = 0
UniqueId changed = 0
Emails ->
added = 3
removed = 1
unchanged (In changed Principals) = 10035
Group Members ->
added = 0
removed = 0
unchanged = 0
unknown = 0
failed = 0
-------Batch Statistics-------
Successful User Batches = 60
Failed User Batches = 0
Successful Group Batches = 0
Failed Group Batches = 0
Successful Member Batches = 0
Failed Member Batches = 0
======================================

We do have quite a few that are missing an attribute, specifically:
2010-06-06 21:05:47,579 WARN [com.adobe.idp.um.businesslogic.synch.LdapHelper] Record [xxxx] is missing required attribute [objectSID] for canonicalName i.e uniqueIdentifier field
This is something that was on our old system as well:
2010-05-25 03:02:35,559 INFO [com.adobe.idp.um.provider.directoryservices.LDAPDirectoryPrincipalProviderImpl] UserM:: [Thread Hashcode: 3010887] This record is missing a required attribute and cannot be used. Specifically CanonicalName is null. Common Name: xxxx
We have many users in our active directory with just email accounts so that users are able to search for a name and find the email address in outlook. I have checked through these and they look fine (though there are fewer entries in ES2 since there are fewer users being fetched).
As for the locked users, here is what we received:
2010-06-06 21:05:47,579 INFO [com.adobe.idp.um.businesslogic.synch.LdapPrincipalProvider] Found [1257] locked users while synching. These users were ignored
This sounds about right for the amount of users that were fetched.
If you have any more questions or ideas, please let us know. We would like to have this resolved as soon as possible. Thanks.

Active Directory Report

Hi,
I need to make a report that reads from my company's active directory and shows all active directory groups and their users... in addition i need it to be able to update automatically when someone adds a user in our active directory, anyone know a query that would allow this to happen?
- Daniel

So are you saying your requirement is that you must access the Active Directory via Oracle? If so, have you considered DBMS_LDAP?
Without knowing any other requirements wouldn't it be easier for the System/Network administrator to generate this report?
Edited by: Centinul on Jan 9, 2009 9:32 AM
I am guessing this is similar if not a duplicate thread to the one you created the other day: Re: LDAP

Getting Active Directory Users in UCM User Admin - Users Tab

Hello All
We have integrated WLS with our Active Directory. And we are getting all the active directory users under Security Realms >myrealm >Users and Groups tab in WLS Console.
We are also able to login to webcenter spaces and Content server using those userid and credentials. But our problem is in UCM under Admin Applets - User Admin - Users tab all the active directory users are not listed. So we are not able to assign particular roles to the users.
When a particular Active Directory user logins in UCM (First Time) after that the admisistrator (weblogic) is able to get that user under Admin Applets - User Admin - Users tab. And also it comes as an External user so we are not able to assign role.
So basically UCM requires a login to get all the users listed in users tab.
Our requirement is we want all the Active Directory users to get listed in UCM without the condition that the users has to login in content server once.
Thanks

Hi Navin ,
First and foremost the requirement that you have posted is not possible and the reason for that is :
Users are created on AD which is outside the realm of UCM hence there is no way that the users created on AD will be shown up under Users tab without they login atleast once . UCM does not know which all users are part of the realm until and unless the AD users login in atleast once .
Secondly external users cannot be assigned roles from UCM because when the Auth type is set to External UCM sees it as external entity hence not giving it any way to relate roles / groups from UCM . As a workaround you can change the AuthType for the External users to Global from User Admin applet after the users login for the first time . This will enable you to assign roles / groups for the AD users .
Hope this helps .
Thanks
Srinath

Structure of our Active Directory

Similar Messages

Maybe you are looking for