Verification of prerequisites for Active Directory preparation failed

We currently have Windows Server 2003 SBS, SP2, Domain Controller. Would like to add Windows Server 2012, Standard, 64-bit as a backup domain controller.
"Verification of prerequisites for Active Directory preparation failed. Unable to perform Exchange schema conflict check for domain sxxxx.local.
Exception: The RPC server is unavailable.
Adprep could not retrieve data from the server name.xxxxx.local through Windows Managment Instrumentation (WMI).
[User Action]
Check the log file ADPrep.log in the C:\Windows\debug\adprep\logs\20130417103902-test directory for possible cause of failure."
What the log says is really:
"Adprep encountered a Win32 error. Error code: 0x6ba Error messa The RPC server is unavailable."
Can anyone has similar experience shred some lights to troubleshoot this? Have reviewed
other links that have similar probems but that doesn't help. 
Many Thanks!

Of course I CANNOT remove Symnatec as Meinolf suggests. That would be out of my mind!! I tried to stop all their services though which doesn't help. I know this has nothing to do with Symantec. Here comes another test, the final one:
Test 8
This article is really good as it concludes very thoroughly about the problems about "800706BA - RPC Server Is Unavailable" and other WMI query issues:
http://goo dot gl/l2iha
I started looking at he ISA 2004 on our SBS 2003.
Tried to disable the RPF Filter:
a. Open Microsoft Internet Security and Acceleration Server 2004
b. Go to Configuration > Add-in and location RPC Filter on the right side, right-click on it and select Properties, uncheck 'Enable this filter'
c. Hit Apply....
d. Now I go back to Windows 7 and test the WMI query.
The result: it WORKS! 
e. Next, I tried that on the Windows Server 2012 like so:
c:>wmic /node:sbs2003servername computersystem list brief /format:list
It also works!
f. Next also on Windows Server 2012, I continued on what was left over.  I did the "Rerun prerequisites check " and no surprise - "All prerequisite checks passed successfully. Click 'Install' to begin installation"!
Well that concludes the problem of installing Windows Server 2012 (standard) as a backup domain controller to a Windows SBS 2003 domain controller and the  troubleshooting process that finally led to a solution that solves my problem. Thanks for all
the discussions over the web. Every bit counts!
Well if this helps you in some way, give me some points to buy beer! I am going to have a drink with Bill, Cheers! 

Similar Messages

  • Windows 2012 Verification of prerequisites for Domain Controller promotion failed

    Windows 2012 Verification of prerequisites for Domain Controller promotion failed and gave the below error(In computer management local group and user option is not there as suggested by a solution!)
    "Verification of prerequisites for Domain Controller promotion failed. The local Administrator account becomes the domain Administrator account when you create a new domain. The new domain cannot be created because the local Administrator account password
    does not meet requirements.
    Currently, the local Administrator password is blank, which might lead to security issues. We recommend that you press Ctrl+Alt+Delete, use the net user command-line tool, or use Local Users and Groups to set a strong password for the local Administrator
    account before you create the new domain."

    OK, the reason you see this error is because when you set up and configured your Windows R2 environment you may have logged into the OS with an account other than Administrator. So, if you created your log in account named Bob, this is throwing off the Server.
    So, hit Ctrl-Alt-Delete, and look who you are logged in as, and then change the account you are logging in as and use the local Administrator account. What you may find is that the default Admin account password has not been set.
    Check that out and see if that is what you are experiencing.
    Best wishes

  • BO XI 3.1 : Active Directory Authentication failed to get the Active Directory groups

    Dear all 
            In our environment, there are 2 domain (domain A and B); it works well all the time. Today, all the user belong to domain A are not logi n; for user in domain B, all of them can log in but BO server response is very slowly. and there is error message popup when opening Webi report for domain B user. Below are the error message: 
           " Active Directory Authentication failed to get the Active Directory groups for the account with ID:XXXX; pls make sure this account is valid and belongs to an accessible domain"
          Anyone has encountered similar issue?
       BO version: BO XI 3.1 SP5
       Authenticate: Windows AD
    Thanks and Regards

    Please get in touch with your AD team and verify if there are any changes applied to the domain controller and there are no network issues.
    Also since this is a multi domain, make sure you have 2 way transitive forest trust as mentioned in SAP Note : 1323391 and FQDN for Directory servers are maintained in registry as per 1199995
    http://service.sap.com/sap/support/notes/1323391
    http://service.sap.com/sap/support/notes/1199995
    -Ambarish-

  • Active Directory domain failed

    Hello Team,
    When i joined to our active directory, everytime bui gives same error messages:
    The attempt to join the Active Directory domain failed either because the clocks of the appliance and the domain controller are skewed or the administrative user
    does not have the appropriate permissions to create a computer account in Active Directory.
    It is recommended that NTP be used to keep clocks synchronized when using Active Directory.
    Storage Appliance: 7310 One Controller, No firewall for ntp server also which connect directly NTP Domain server. Actually my believe is that no time sync issue.
    Firmware version is latest patch.
    What is your idea about this issue?
    i did many times this action plan: but result is same
    ActiveDirectoryTasks
    B)Joining a Domain
    1.Configure an ActiveDirectory site in the CIFS context. (optional)
    2.Configure a preferred domain controller in the CIFS context. (optional)
    3.Enable NTP, or ensure that the clocks of the appliance and domain controller are synchronized
    to within five minutes.
    4.Ensure that your DNS infrastructure correctly delegates to the ActiveDirectory domain, or add
    your domain contoller's IP address as an additional name server in the DNS context.
    5.Configure the ActiveDirectory domain, administrative user, and administrative password.
    6.Apply/commit the configuration.
    A)Joining aWorkgroup
    Configure theworkgroup name.
    Apply/commit the configuration.
    1. First of all LAN Compatibility Mode 4 works fine with Win 2003 (AD Server)
    2. While trying to join the AD, using a non ADMIN username and passsword will not help
    Try using a username/pass which has Administrative Privileges (specifically having the rights for Account Creation in
    the AD Server) on the AD server.
    (I was trying by a different username/pass but it was not joing the storage to AD. It joined when i tried a user having
    the privileges to create Machine Accounts in AD)
    3. For Clock Sync, the tolerance limit is upto 5 Minutes..So you can take care that the difference does not go beyond
    5 minutes.
    Thanks
    Can
    Gantek Tech.

    Your first post to these OTN forums.
    You posted your inquiry to a HARDWARE forum.
    Your issue seems to be a Microsoft OS issue and you just happen to have your OS volumes on a model 7310 appliance.
    I suggest you go find a forum somewhere that is hosted for Microsoft AD issues.
    If you happen to need the documentation for that piece of storage hardware, there are currently three PDF's available:
    http://docs.oracle.com/cd/E19935-01/index.html
    They are the Installation Guide, the hardware Administration Guide, and the Service Manual.
    There are no current Oracle-published documents for that box as related to Active Directory.

  • "Active Directory operation failed on DC " when assigning Send As permissions on a distribution group

    I'm trying to give a mailbox user Send As right for a distribution group. But the cmdlet comes back with this:
    Get-DistributionGroup MyGroup | Add-ADPermission -user albert -ExtendedRights Send-As
    Active Directory operation failed on <DC fqdn>. This error is not retriable. Additional information: Access is denied.
    Active directory response: 00000005: SecErr: DSID-03151E07, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0
        + CategoryInfo          : WriteError: (0:Int32) [Add-ADPermission], ADOperationException
        + FullyQualifiedErrorId : FE24751F,Microsoft.Exchange.Management.RecipientTasks.AddADPermission
    What could be the problem, considering the items below :
    - inheritance is not broken to the level of the distribution group object
    - the account used to run the cmdlet is a member of the Organization Management group
    - creating a new distribution group in the same OU and running the command works as expected; checking the permission for this group against MyGroup (using Get-DistributionGroup testgroup | Get-ADPermission | Sort-Object User,AccessRights | ft user,accessrights,extendedrights,properties)
    shows no differences.
    - adding the permission using ADUC results in the user being able to Send As the group, however I'm trying to find out the root cause of the Powershell cmdlet execution problem
    - there is no Deny permission on the group's ACL
    - the group didn't have the "Hide Membership" feature of Exchange 2003 applied, so there shouldn't be any non-canonical ACL issues

    Anyone ever come up with a solution to this?  I get something similar when Activesync tries to create objects on user containers.
    Exchange ActiveSync doesn't have sufficient permissions to create the "CN=Test User,OU=Domain Users,DC=domain,DC=com" container under Active Directory user "Active Directory operation failed on DELL7S09.domain.com. This error is not retriable.
    Additional information: Access is denied.
    Active directory response: 00000005: SecErr: DSID-03151E07, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0
    Make sure the user has inherited permission granted to domain\Exchange Servers to allow List, Create child, Delete child of object type "msExchActiveSyncDevices" and doesn't have any deny permissions that block such operations.
    Details:%3
    So...I get this after I introduced a MS Exchange 2010 SP3 RU8 server into my environment.  You can find LOTS of people suggesting the same fix but I've not found anything that deviates from those fixes:  check the "inherit permissions",
    and give full permis to msExchActiveSync devices for the Exchange Servers security group, blah blah.
    I got to this point by following a Migrate to Exch2010 paper by MS.  I have no Win2k servers, my old Exchange server is Win2003r2SP2 with Exch2003SP2 fully patched.  The Exch server is also a DC.  I installed a new 2012r2 server and then patched
    it.  Installed Exch2010SP3Ru8 and all seems well.  
    The old Exch2003 server is still in production.  My iPhone army connects remotely for mail, and all works great.  I created a new Test User in AD, gave it a mailbox on the 2003 server, and waited a bit.  It eventually shows up in the Server
    Manager on the new 2010 Exch Server.  I send it a bunch of emails, connect to it with an outook client on a Win7 machine, all works.  I go to the SM on the 2010 box and migrate the mailbox to the new server.  It works.  I can connect with
    outlook, send receive mail to other users in the org.  I then try to connect with my iPhone and I get the message in Event Viewer over and over.
    Went so far as to Promo the new 2012 server to a DC.  seems to be fine.  Now am wondering if I Demote the old Exch2003 server will it help...or cause a new crop of issues....

  • Query on DNS setup for Active Directory for a new data center

    I have third party DNS appliances providing DNS Service for Active Directory (Windows 2008 R2) and there are also secondary DNS servers, which are MS DNS server with a secondary zone configured, for redundancy. I have to setup a new data center
    and move servers/services to this data center. In this scenario, can I install a new Microsoft DNS server with a secondary zone and use this as the primary DNS Server for all the member servers at this new location ? I am aware that this new DNS server will
    not be able to make any updates to the secondary zone and for that purpose, is there anyway to redirect such requests to the DNS appliances in my current data center across the WAN ? I am trying to avoid purchasing a new DNS appliance for the new data center
    and want to know what are the alternatives I have.
     

    im not entirely sure by your setup, as normally you would use AD integrated zones for DNS in an AD environment - although there are other options as you have already setup.
    the fact the zone is a secondary zone in DNS server terms doesn't mean you can't point your clients to it as their primary dns server. They will quite happily resolve names using a secondary server.
    so as long as your dns devices are correctly setup to support the additional secondary zone I see no reason why you couldn't do this.
    Regards,
    Denis Cooper
    MCITP EA - MCT
    Help keep the forums tidy, if this has helped please mark it as an answer
    My Blog
    LinkedIn:

  • MOBILE ACCOUNTS ARE BROKEN!!!  At least for Active directory.

    Thanks ben6073 for posting your link to the solution. It worked for me as well.
    I did a clean install of SL, joined the machine to the AD domain using Directory Utility. Restarted and when the other user option finally came up in the login screen it would just shake after entering my credentials. As if I was using the wrong password. I then logged in with the local admin account and using the Directory Utility disabled the mobile account option. I then restarted and was able to log in using my credentials.
    MOBILE ACCOUNTS ARE BROKEN!!! At least for Active directory.
    Thanks ben6073 for the link to a fix. And thank you Rich for the post on google.
    http://groups.google.com/group/macenterprise/browse_thread/thread/2c2502b08bb84c 7a?pli=1
    G

    Greg Plassmeyer1 wrote:
    Thanks ben6073 for posting your link to the solution. It worked for me as well.
    MOBILE ACCOUNTS ARE BROKEN!!! At least for Active directory.
    I had this problem this morning. It went away after I rebooted and ran applejack in "auto pilot" mode. The machine is a macbook pro running Snow Leopard. The account is a mobile account tied to a windows active directory server. Applejack is available from http://applejack.sourceforge.net/. The auto pilot mode cleans out the system caches is /Library and /System/Library - perhaps this is what provides the fix? Just a guess.

  • Connector for Active Directory Password Sync

    Friends,
    We have some questions about the Connector for Active Directory Password Sync:
    1. There is a need to extend the AD schema when using this connector.
    2. If I have 10 domain controllers and are not synchronized, the documentation tells us to install the dll in each domain controller. Is there any way to do this if necessary, to install this dll in a single domain controller?
    Thanks for your help.
    regards

    Definitely:
    For your Point-1 Look for the Preinstallation section in the AD Password Sync Connector Guide which talks nothing about extending AD schema which supports the validity of the statement.
    For your Point-2 Look for Metalink Article-432727.1 which confirms that the connector has to be installed on all the DC's
    Thanks
    SRS

  • Active Directory Replication failed

    Hi all,
    I'm deploying lync server 2010 in virtual server.
    My Domain controller is a physical server.
    Windows update restart is done when almost 90% of deployment is completed.
    During enabling users in Lync Server control panel
    I have got an issue after server restart, is active directory replication failed.
    Regards,
    Arun.

    The problem is more related with Domain Controller.
    Please check the event log on Domain Controller.
    You can also refer to the following link to troubleshoot Active Directory Replication Problems:
    http://technet.microsoft.com/en-us/library/cc738415(v=ws.10).aspx
    Lisa Zheng
    TechNet Community Support

  • Setting disk quota on Mac server for Active Directory users

    I'm having trouble setting disk quotas for Active Directory users with home folders on our Mac server.
    I've enabled disk quotas on the disk I'm putting home folders on, and I can set disk quotas for local users on the server just fine. But it doesn't seem to work for Active Directory users. I've tried setting disk quotas via Workgroup Manager and via the command line using edquota. But when I use the repquota command there is no quota entry for the AD user. I've run quotacheck and that didn't help either.
    I also understand there's a setquota command but there's no man page on how that works.
    Has anyone got disk quota for AD users working.
    Better still has someone got a shell or perl script for setting quotas they could post.
    Thanks
    - Cameron

    sorry.. I am soooooo stupid... I have to activate "File Sharing" as well.. for the user everything was already pre-activated, not for the AD users, I just saw the Time Machine checkbox grayed out ...

  • JBO-27011: Attribute set with value Y for Active in VscAdfUsers failed

    Hi All,
    I got the following exception when I committed the change of "Active" property in the User Management page.
    But when I change other properties, it works fine.
    And I didn't make any validators for the attribute "Active", why did I get such error?
    Any suggestions?
    Thanks!
    11/02/24 13:59:52 [13074] oracle.jbo.TxnValException: JBO-27023: Failed to validate all rows in a transaction.
         at oracle.jbo.server.DBTransactionImpl.validate(DBTransactionImpl.java:4051)
         at oracle.adf.model.bc4j.DCJboDataControl.validate(DCJboDataControl.java:1018)
         at oracle.adf.model.binding.DCBindingContainer.validateInputValues(DCBindingContainer.java:2918)
         at oracle.adf.model.binding.DCBindingContainer.validate(DCBindingContainer.java:2893)
         at oracle.adf.controller.v2.lifecycle.PageLifecycleImpl.validateModelUpdates(PageLifecycleImpl.java:284)
         at oracle.adf.controller.v2.lifecycle.Lifecycle$4.execute(Lifecycle.java:263)
         at oracle.adf.controller.v2.lifecycle.Lifecycle.executePhase(Lifecycle.java:116)
         at oracle.adf.controller.faces.lifecycle.ADFPhaseListener.mav$executePhase(ADFPhaseListener.java:29)
         at oracle.adf.controller.faces.lifecycle.ADFPhaseListener$3.after(ADFPhaseListener.java:350)
         at oracle.adf.controller.faces.lifecycle.ADFPhaseListener.afterPhase(ADFPhaseListener.java:90)
         at com.sun.faces.lifecycle.LifecycleImpl.phase(LifecycleImpl.java:254)
         at com.sun.faces.lifecycle.LifecycleImpl.execute(LifecycleImpl.java:110)
         at javax.faces.webapp.FacesServlet.service(FacesServlet.java:213)
         at com.evermind.server.http.ResourceFilterChain.doFilter(ResourceFilterChain.java:65)
         at oracle.vscadf.userinterface.util.AppSessionExpiry.doFilter(AppSessionExpiry.java:92)
         at com.evermind.server.http.EvermindFilterChain.doFilter(EvermindFilterChain.java:15)
         at oracle.adfinternal.view.faces.webapp.AdfFacesFilterImpl._invokeDoFilter(AdfFacesFilterImpl.java:228)
         at oracle.adfinternal.view.faces.webapp.AdfFacesFilterImpl._doFilterImpl(AdfFacesFilterImpl.java:197)
         at oracle.adfinternal.view.faces.webapp.AdfFacesFilterImpl.doFilter(AdfFacesFilterImpl.java:123)
         at oracle.adf.view.faces.webapp.AdfFacesFilter.doFilter(AdfFacesFilter.java:103)
         at com.evermind.server.http.EvermindFilterChain.doFilter(EvermindFilterChain.java:17)
         at oracle.adf.model.servlet.ADFBindingFilter.doFilter(ADFBindingFilter.java:162)
         at com.evermind.server.http.ServletRequestDispatcher.invoke(ServletRequestDispatcher.java:621)
         at com.evermind.server.http.ServletRequestDispatcher.forwardInternal(ServletRequestDispatcher.java:370)
         at com.evermind.server.http.HttpRequestHandler.doProcessRequest(HttpRequestHandler.java:871)
         at com.evermind.server.http.HttpRequestHandler.processRequest(HttpRequestHandler.java:453)
         at com.evermind.server.http.HttpRequestHandler.serveOneRequest(HttpRequestHandler.java:221)
         at com.evermind.server.http.HttpRequestHandler.run(HttpRequestHandler.java:122)
         at com.evermind.server.http.HttpRequestHandler.run(HttpRequestHandler.java:111)
         at oracle.oc4j.network.ServerSocketReadHandler$SafeRunnable.run(ServerSocketReadHandler.java:260)
         at oracle.oc4j.network.ServerSocketAcceptHandler.procClientSocket(ServerSocketAcceptHandler.java:239)
         at oracle.oc4j.network.ServerSocketAcceptHandler.access$700(ServerSocketAcceptHandler.java:34)
         at oracle.oc4j.network.ServerSocketAcceptHandler$AcceptHandlerHorse.run(ServerSocketAcceptHandler.java:880)
         at com.evermind.util.ReleasableResourcePooledExecutor$MyWorker.run(ReleasableResourcePooledExecutor.java:298)
         at java.lang.Thread.run(Thread.java:595)
    ## Detail 0 ##
    oracle.jbo.RowValException: JBO-27024: Failed to validate a row with key oracle.jbo.Key[1521 ] of type VscAdfUsers
         at oracle.jbo.server.EntityImpl.validate(EntityImpl.java:1600)
         at oracle.jbo.server.DBTransactionImpl.validate(DBTransactionImpl.java:4031)
         at oracle.adf.model.bc4j.DCJboDataControl.validate(DCJboDataControl.java:1018)
         at oracle.adf.model.binding.DCBindingContainer.validateInputValues(DCBindingContainer.java:2918)
         at oracle.adf.model.binding.DCBindingContainer.validate(DCBindingContainer.java:2893)
         at oracle.adf.controller.v2.lifecycle.PageLifecycleImpl.validateModelUpdates(PageLifecycleImpl.java:284)
         at oracle.adf.controller.v2.lifecycle.Lifecycle$4.execute(Lifecycle.java:263)
         at oracle.adf.controller.v2.lifecycle.Lifecycle.executePhase(Lifecycle.java:116)
         at oracle.adf.controller.faces.lifecycle.ADFPhaseListener.mav$executePhase(ADFPhaseListener.java:29)
         at oracle.adf.controller.faces.lifecycle.ADFPhaseListener$3.after(ADFPhaseListener.java:350)
         at oracle.adf.controller.faces.lifecycle.ADFPhaseListener.afterPhase(ADFPhaseListener.java:90)
         at com.sun.faces.lifecycle.LifecycleImpl.phase(LifecycleImpl.java:254)
         at com.sun.faces.lifecycle.LifecycleImpl.execute(LifecycleImpl.java:110)
         at javax.faces.webapp.FacesServlet.service(FacesServlet.java:213)
         at com.evermind.server.http.ResourceFilterChain.doFilter(ResourceFilterChain.java:65)
         at oracle.vscadf.userinterface.util.AppSessionExpiry.doFilter(AppSessionExpiry.java:92)
         at com.evermind.server.http.EvermindFilterChain.doFilter(EvermindFilterChain.java:15)
         at oracle.adfinternal.view.faces.webapp.AdfFacesFilterImpl._invokeDoFilter(AdfFacesFilterImpl.java:228)
         at oracle.adfinternal.view.faces.webapp.AdfFacesFilterImpl._doFilterImpl(AdfFacesFilterImpl.java:197)
         at oracle.adfinternal.view.faces.webapp.AdfFacesFilterImpl.doFilter(AdfFacesFilterImpl.java:123)
         at oracle.adf.view.faces.webapp.AdfFacesFilter.doFilter(AdfFacesFilter.java:103)
         at com.evermind.server.http.EvermindFilterChain.doFilter(EvermindFilterChain.java:17)
         at oracle.adf.model.servlet.ADFBindingFilter.doFilter(ADFBindingFilter.java:162)
         at com.evermind.server.http.ServletRequestDispatcher.invoke(ServletRequestDispatcher.java:621)
         at com.evermind.server.http.ServletRequestDispatcher.forwardInternal(ServletRequestDispatcher.java:370)
         at com.evermind.server.http.HttpRequestHandler.doProcessRequest(HttpRequestHandler.java:871)
         at com.evermind.server.http.HttpRequestHandler.processRequest(HttpRequestHandler.java:453)
         at com.evermind.server.http.HttpRequestHandler.serveOneRequest(HttpRequestHandler.java:221)
         at com.evermind.server.http.HttpRequestHandler.run(HttpRequestHandler.java:122)
         at com.evermind.server.http.HttpRequestHandler.run(HttpRequestHandler.java:111)
         at oracle.oc4j.network.ServerSocketReadHandler$SafeRunnable.run(ServerSocketReadHandler.java:260)
         at oracle.oc4j.network.ServerSocketAcceptHandler.procClientSocket(ServerSocketAcceptHandler.java:239)
         at oracle.oc4j.network.ServerSocketAcceptHandler.access$700(ServerSocketAcceptHandler.java:34)
         at oracle.oc4j.network.ServerSocketAcceptHandler$AcceptHandlerHorse.run(ServerSocketAcceptHandler.java:880)
         at com.evermind.util.ReleasableResourcePooledExecutor$MyWorker.run(ReleasableResourcePooledExecutor.java:298)
         at java.lang.Thread.run(Thread.java:595)
    ## Detail 0 ##
    oracle.jbo.AttrSetValException: JBO-27011: Attribute set with value Y for Active in VscAdfUsers failed
         at oracle.jbo.AttrValException.<init>(AttrValException.java:110)
         at oracle.jbo.AttrSetValException.<init>(AttrSetValException.java:96)
         at oracle.jbo.rules.RulesBeanUtils.raiseException(RulesBeanUtils.java:213)
         at oracle.jbo.rules.JboAbstractValidator.raiseException(JboAbstractValidator.java:136)
         at oracle.jbo.rules.JboAbstractValidator.validate(JboAbstractValidator.java:112)
         at oracle.jbo.rules.RulesBeanUtils.validateObject(RulesBeanUtils.java:387)
         at oracle.jbo.rules.RulesBeanUtils.validate(RulesBeanUtils.java:361)
         at oracle.jbo.server.AttributeDefImpl.set(AttributeDefImpl.java:1883)
         at oracle.jbo.server.EntityImpl.setAttributeInternal(EntityImpl.java:1083)
         at oracle.vscadf.datamodel.entities.VscAdfUsersImpl.setActive(VscAdfUsersImpl.java:213)
         at oracle.vscadf.datamodel.entities.VscAdfUsersImpl.setAttrInvokeAccessor(VscAdfUsersImpl.java:365)
         at oracle.jbo.server.EntityImpl.setAttribute(EntityImpl.java:996)
         at oracle.jbo.server.EntityImpl.readAttrsFromXML(EntityImpl.java:6859)
         at oracle.jbo.server.Serializer.activateEntity(Serializer.java:646)
         at oracle.jbo.server.Serializer.activateTxn(Serializer.java:540)
         at oracle.jbo.server.Serializer.activate(Serializer.java:268)
         at oracle.jbo.server.DBSerializer.activateRootAM(DBSerializer.java:330)
         at oracle.jbo.server.ApplicationModuleImpl.activateState(ApplicationModuleImpl.java:5549)
         at oracle.jbo.server.ApplicationPoolMessageHandler.doPoolMessage(ApplicationPoolMessageHandler.java:178)
         at oracle.jbo.server.ApplicationModuleImpl.doPoolMessage(ApplicationModuleImpl.java:7769)
         at oracle.jbo.common.ampool.ApplicationPoolImpl.sendPoolMessage(ApplicationPoolImpl.java:4074)
         at oracle.jbo.common.ampool.ApplicationPoolImpl.prepareApplicationModule(ApplicationPoolImpl.java:2161)
         at oracle.jbo.common.ampool.ApplicationPoolImpl.doCheckout(ApplicationPoolImpl.java:1961)
         at oracle.jbo.common.ampool.ApplicationPoolImpl.useApplicationModule(ApplicationPoolImpl.java:2793)
         at oracle.jbo.common.ampool.SessionCookieImpl.useApplicationModule(SessionCookieImpl.java:453)
         at oracle.jbo.common.ampool.SessionCookieImpl.useApplicationModule(SessionCookieImpl.java:424)
         at oracle.jbo.common.ampool.SessionCookieImpl.useApplicationModule(SessionCookieImpl.java:419)
         at oracle.adf.model.bc4j.DCJboDataControl.rebuildApplicationModule(DCJboDataControl.java:1543)
         at oracle.adf.model.bc4j.DCJboDataControl.beginRequest(DCJboDataControl.java:1404)
         at oracle.adf.model.BindingContext.beginRequest(BindingContext.java:683)
         at oracle.adf.model.BindingRequestHandler.invokeBeginRequest(BindingRequestHandler.java:346)
         at oracle.adf.model.BindingRequestHandler.beginRequest(BindingRequestHandler.java:166)
         at oracle.adf.model.servlet.ADFBindingFilter.doFilter(ADFBindingFilter.java:161)
         at com.evermind.server.http.ServletRequestDispatcher.invoke(ServletRequestDispatcher.java:621)
         at com.evermind.server.http.ServletRequestDispatcher.forwardInternal(ServletRequestDispatcher.java:370)
         at com.evermind.server.http.HttpRequestHandler.doProcessRequest(HttpRequestHandler.java:871)
         at com.evermind.server.http.HttpRequestHandler.processRequest(HttpRequestHandler.java:453)
         at com.evermind.server.http.HttpRequestHandler.serveOneRequest(HttpRequestHandler.java:221)
         at com.evermind.server.http.HttpRequestHandler.run(HttpRequestHandler.java:122)
         at com.evermind.server.http.HttpRequestHandler.run(HttpRequestHandler.java:111)
         at oracle.oc4j.network.ServerSocketReadHandler$SafeRunnable.run(ServerSocketReadHandler.java:260)
         at oracle.oc4j.network.ServerSocketAcceptHandler.procClientSocket(ServerSocketAcceptHandler.java:239)
         at oracle.oc4j.network.ServerSocketAcceptHandler.access$700(ServerSocketAcceptHandler.java:34)
         at oracle.oc4j.network.ServerSocketAcceptHandler$AcceptHandlerHorse.run(ServerSocketAcceptHandler.java:880)
         at com.evermind.util.ReleasableResourcePooledExecutor$MyWorker.run(ReleasableResourcePooledExecutor.java:298)
         at java.lang.Thread.run(Thread.java:595)
    11/02/24 13:59:52 CustErrorHandler:reportException:Start...
    11/02/24 13:59:52 Throw:Exception:oracle.jbo.TxnValException: JBO-27023: Failed to validate all rows in a transaction.
    11/02/24 13:59:52 [13075] * * * BindingContainer caching EXCEPTION:oracle.jbo.TxnValException
    11/02/24 13:59:52 [13076] oracle.jbo.RowValException: JBO-27024: Failed to validate a row with key oracle.jbo.Key[1521 ] of type ADFPublicService.VscAdfUsersView
         at oracle.jbo.server.EntityImpl.validate(EntityImpl.java:1600)
         at oracle.jbo.server.DBTransactionImpl.validate(DBTransactionImpl.java:4031)
         at oracle.adf.model.bc4j.DCJboDataControl.validate(DCJboDataControl.java:1018)
         at oracle.adf.model.binding.DCBindingContainer.validateInputValues(DCBindingContainer.java:2918)
         at oracle.adf.model.binding.DCBindingContainer.validate(DCBindingContainer.java:2893)
         at oracle.adf.controller.v2.lifecycle.PageLifecycleImpl.validateModelUpdates(PageLifecycleImpl.java:284)
         at oracle.adf.controller.v2.lifecycle.Lifecycle$4.execute(Lifecycle.java:263)
         at oracle.adf.controller.v2.lifecycle.Lifecycle.executePhase(Lifecycle.java:116)
         at oracle.adf.controller.faces.lifecycle.ADFPhaseListener.mav$executePhase(ADFPhaseListener.java:29)
         at oracle.adf.controller.faces.lifecycle.ADFPhaseListener$3.after(ADFPhaseListener.java:350)
         at oracle.adf.controller.faces.lifecycle.ADFPhaseListener.afterPhase(ADFPhaseListener.java:90)
         at com.sun.faces.lifecycle.LifecycleImpl.phase(LifecycleImpl.java:254)
         at com.sun.faces.lifecycle.LifecycleImpl.execute(LifecycleImpl.java:110)
         at javax.faces.webapp.FacesServlet.service(FacesServlet.java:213)
         at com.evermind.server.http.ResourceFilterChain.doFilter(ResourceFilterChain.java:65)
         at oracle.vscadf.userinterface.util.AppSessionExpiry.doFilter(AppSessionExpiry.java:92)
         at com.evermind.server.http.EvermindFilterChain.doFilter(EvermindFilterChain.java:15)
         at oracle.adfinternal.view.faces.webapp.AdfFacesFilterImpl._invokeDoFilter(AdfFacesFilterImpl.java:228)
         at oracle.adfinternal.view.faces.webapp.AdfFacesFilterImpl._doFilterImpl(AdfFacesFilterImpl.java:197)
         at oracle.adfinternal.view.faces.webapp.AdfFacesFilterImpl.doFilter(AdfFacesFilterImpl.java:123)
         at oracle.adf.view.faces.webapp.AdfFacesFilter.doFilter(AdfFacesFilter.java:103)
         at com.evermind.server.http.EvermindFilterChain.doFilter(EvermindFilterChain.java:17)
         at oracle.adf.model.servlet.ADFBindingFilter.doFilter(ADFBindingFilter.java:162)
         at com.evermind.server.http.ServletRequestDispatcher.invoke(ServletRequestDispatcher.java:621)
         at com.evermind.server.http.ServletRequestDispatcher.forwardInternal(ServletRequestDispatcher.java:370)
         at com.evermind.server.http.HttpRequestHandler.doProcessRequest(HttpRequestHandler.java:871)
         at com.evermind.server.http.HttpRequestHandler.processRequest(HttpRequestHandler.java:453)
         at com.evermind.server.http.HttpRequestHandler.serveOneRequest(HttpRequestHandler.java:221)
         at com.evermind.server.http.HttpRequestHandler.run(HttpRequestHandler.java:122)
         at com.evermind.server.http.HttpRequestHandler.run(HttpRequestHandler.java:111)
         at oracle.oc4j.network.ServerSocketReadHandler$SafeRunnable.run(ServerSocketReadHandler.java:260)
         at oracle.oc4j.network.ServerSocketAcceptHandler.procClientSocket(ServerSocketAcceptHandler.java:239)
         at oracle.oc4j.network.ServerSocketAcceptHandler.access$700(ServerSocketAcceptHandler.java:34)
         at oracle.oc4j.network.ServerSocketAcceptHandler$AcceptHandlerHorse.run(ServerSocketAcceptHandler.java:880)
         at com.evermind.util.ReleasableResourcePooledExecutor$MyWorker.run(ReleasableResourcePooledExecutor.java:298)
         at java.lang.Thread.run(Thread.java:595)
    ## Detail 0 ##
    oracle.jbo.AttrSetValException: JBO-27011: Attribute set with value Y for Active in ADFPublicService.VscAdfUsersView failed
         at oracle.jbo.AttrValException.<init>(AttrValException.java:110)
         at oracle.jbo.AttrSetValException.<init>(AttrSetValException.java:96)
         at oracle.jbo.rules.RulesBeanUtils.raiseException(RulesBeanUtils.java:213)
         at oracle.jbo.rules.JboAbstractValidator.raiseException(JboAbstractValidator.java:136)
         at oracle.jbo.rules.JboAbstractValidator.validate(JboAbstractValidator.java:112)
         at oracle.jbo.rules.RulesBeanUtils.validateObject(RulesBeanUtils.java:387)
         at oracle.jbo.rules.RulesBeanUtils.validate(RulesBeanUtils.java:361)
         at oracle.jbo.server.AttributeDefImpl.set(AttributeDefImpl.java:1883)
         at oracle.jbo.server.EntityImpl.setAttributeInternal(EntityImpl.java:1083)
         at oracle.vscadf.datamodel.entities.VscAdfUsersImpl.setActive(VscAdfUsersImpl.java:213)
         at oracle.vscadf.datamodel.entities.VscAdfUsersImpl.setAttrInvokeAccessor(VscAdfUsersImpl.java:365)
         at oracle.jbo.server.EntityImpl.setAttribute(EntityImpl.java:996)
         at oracle.jbo.server.EntityImpl.readAttrsFromXML(EntityImpl.java:6859)
         at oracle.jbo.server.Serializer.activateEntity(Serializer.java:646)
         at oracle.jbo.server.Serializer.activateTxn(Serializer.java:540)
         at oracle.jbo.server.Serializer.activate(Serializer.java:268)
         at oracle.jbo.server.DBSerializer.activateRootAM(DBSerializer.java:330)
         at oracle.jbo.server.ApplicationModuleImpl.activateState(ApplicationModuleImpl.java:5549)
         at oracle.jbo.server.ApplicationPoolMessageHandler.doPoolMessage(ApplicationPoolMessageHandler.java:178)
         at oracle.jbo.server.ApplicationModuleImpl.doPoolMessage(ApplicationModuleImpl.java:7769)
         at oracle.jbo.common.ampool.ApplicationPoolImpl.sendPoolMessage(ApplicationPoolImpl.java:4074)
         at oracle.jbo.common.ampool.ApplicationPoolImpl.prepareApplicationModule(ApplicationPoolImpl.java:2161)
         at oracle.jbo.common.ampool.ApplicationPoolImpl.doCheckout(ApplicationPoolImpl.java:1961)
         at oracle.jbo.common.ampool.ApplicationPoolImpl.useApplicationModule(ApplicationPoolImpl.java:2793)
         at oracle.jbo.common.ampool.SessionCookieImpl.useApplicationModule(SessionCookieImpl.java:453)
         at oracle.jbo.common.ampool.SessionCookieImpl.useApplicationModule(SessionCookieImpl.java:424)
         at oracle.jbo.common.ampool.SessionCookieImpl.useApplicationModule(SessionCookieImpl.java:419)
         at oracle.adf.model.bc4j.DCJboDataControl.rebuildApplicationModule(DCJboDataControl.java:1543)
         at oracle.adf.model.bc4j.DCJboDataControl.beginRequest(DCJboDataControl.java:1404)
         at oracle.adf.model.BindingContext.beginRequest(BindingContext.java:683)
         at oracle.adf.model.BindingRequestHandler.invokeBeginRequest(BindingRequestHandler.java:346)
         at oracle.adf.model.BindingRequestHandler.beginRequest(BindingRequestHandler.java:166)
         at oracle.adf.model.servlet.ADFBindingFilter.doFilter(ADFBindingFilter.java:161)
         at com.evermind.server.http.ServletRequestDispatcher.invoke(ServletRequestDispatcher.java:621)
         at com.evermind.server.http.ServletRequestDispatcher.forwardInternal(ServletRequestDispatcher.java:370)
         at com.evermind.server.http.HttpRequestHandler.doProcessRequest(HttpRequestHandler.java:871)
         at com.evermind.server.http.HttpRequestHandler.processRequest(HttpRequestHandler.java:453)
         at com.evermind.server.http.HttpRequestHandler.serveOneRequest(HttpRequestHandler.java:221)
         at com.evermind.server.http.HttpRequestHandler.run(HttpRequestHandler.java:122)
         at com.evermind.server.http.HttpRequestHandler.run(HttpRequestHandler.java:111)
         at oracle.oc4j.network.ServerSocketReadHandler$SafeRunnable.run(ServerSocketReadHandler.java:260)
         at oracle.oc4j.network.ServerSocketAcceptHandler.procClientSocket(ServerSocketAcceptHandler.java:239)
         at oracle.oc4j.network.ServerSocketAcceptHandler.access$700(ServerSocketAcceptHandler.java:34)
         at oracle.oc4j.network.ServerSocketAcceptHandler$AcceptHandlerHorse.run(ServerSocketAcceptHandler.java:880)
         at com.evermind.util.ReleasableResourcePooledExecutor$MyWorker.run(ReleasableResourcePooledExecutor.java:298)
         at java.lang.Thread.run(Thread.java:595)
    Jerry

    Looks like you try to set the attribute 'Active' to Y which the DB assumes to be not valid data.
    Check what kind of data (e.g. numbers of strings or characters) is valid to insert for the attribute 'Active' in the DB and the EO and the VO.
    Timo

  • SharePoint 2013 Workflow (SPD 2013) fails for Active Directory Group members

    Hi
    I have a SharePoint 2013 site called "Team Meetings". There are a number of lists and an InfoPath form library.
    The site's SharePoint Group "Team Meeting Members" has two Active Directory groups (All Club Managers and All Club Police) as members. Those two AD groups contain all the people that I want to have  access to the library and list, except for
    a few additional folk who I have made individual members. 
    My PROBLEM:
    I  have created a SharePoint 2013 Workflow using SPD 2013 associated with the  Form Library. Workflow is set to start on new or modified item. The first action is to write to history list, then determine the status (Submitted or Pending) of
    the form and go to different Stages depending on that status.
    The workflow works perfectly for any user who has been added directly to the SharePoint group (Team Meetings Members) BUT FAILS at the very first action for anyone who is a member of one of the AD groups. I know the Workflow is fine because I've tested it
    with numerous people who are direct members of the SharePoint Group, but whenever a person who is a member of the AD group tries it the Workflow just fails.
    Here's a print of the info from the Workflow Status page (I don't have access to server logs):
    RequestorId: 4494760f-92ff-2e8c-90d2-cc7df0e6baa4. Details: System.ApplicationException: HTTP 401 {"Transfer-Encoding":["chunked"],"X-SharePointHealthScore":["0"],"SPRequestGuid":["4494760f-92ff-2e8c-90d2-cc7df0e6baa4"],"request-id":["4494760f-92ff-2e8c-90d2-cc7df0e6baa4"],"X-FRAME-OPTIONS":["SAMEORIGIN"],"MicrosoftSharePointTeamServices":["15.0.0.4420"],"X-Content-Type-Options":["nosniff"],"X-MS-InvokeApp":["1;
    RequireReadOnly"],"Cache-Control":["max-age=0, private"],"Date":["Mon, 10 Mar 2014 01:31:42 GMT"],"Server":["Microsoft-IIS\/8.0"],"WWW-Authenticate":["NTLM"],"X-AspNet-Version":["4.0.30319"],"X-Powered-By":["ASP.NET"]}
    The HTTP response content could not be read. 'Error while copying content to a stream.'. at Microsoft.Activities.Hosting.Runtime.Subroutine.SubroutineChild.Execute(CodeActivityContext context) at System.Activities.CodeActivity.InternalExecute(ActivityInstance
    instance, ActivityExecutor executor, BookmarkManager bookmarkManager) at System.Activities.Runtime.ActivityExecutor.ExecuteActivityWorkItem.ExecuteBody(ActivityExecutor 
    Members of the SharePoint Group "Team Meetings Members" have Contribute Access to both the form library and another list that the workflow writes to as well as the Workflow History list (which in SP 2013 uses the credentials of the
    user who started the workflow, unlike 2010 which used System Account).
    All members of the Team Meetings Members group, whether they are individual members or part of one of the AD groups, have no problems opening and saving forms etc. It's just the Workflow that doesn't like them...
    I am stumped. I've spent many hours searching for a reason for this. There are about 200 people in the two AD groups so I really don't want to have to add them all individually - especially when these groups are managed in AD for a whole bunch of other reasons
    and using the AD groups means I'll basically never have to worry about modifying the SharePoint access permissions.
    Does anyone have any ideas why this is happening and what I can try to fix it?
    Mark

    Hi Lars,
    I'm afraid not so far but we are trying a few things today so I will post back with results.
    First thing we are doing is making the AD Group universal because one of our (external provider) gurus remembers seeing something about that. He also sent me a link to a post where they were talking about earlier
    versions but having similar issues and their solution was to make sure the app pool account has sufficient permissions in AD::
    http://social.msdn.microsoft.com/Forums/sharepoint/en-US/27a547da-5cc0-49d7-8056-6eb40b4c3242/failed-to-start-workflow-access-is-denied-exception-from-hresult-0x80070005-eaccessdenied
    This part of that thread looks interesting but we haven't checked it yet as were trying the universal setting first:
    "If the users participating in the workflows have been added to the SharePoint site via Active Directory groups, SharePoint has to update the user’s security token periodically by connecting to
    the domain controller. By default, the token times out every 24 hours. But if the application pool account did not have the right permissions on the domain controller to update the user’s token, user will keep getting the access denied error. The error was
    intermittent because when the user browsed to any page other than the workflow form, the token was getting updated successfully.
    You can try to fix it through granting the application pool account the appropriate permission by adding the account to the group “Windows Authorization Access Group” in Active Directory."
    I'll update when we try these ideas. If you have any luck please do the same.
    Mark
    (sorry about formatting - using my phone....)
    Mark

  • Outlook 2003 mail delivery failed for Active Directory user

    Server 2003/Exchange2003
    We are using an outside company (Integra) to handle our email and only use Exchange for shared archived email.
    When configuring active directory users the wizard automatically sets up email entries in the format: [email protected]
    When responding to a meeting invite from outlook to a local AD user, all users receive undeliverable messages for the accounts in the format [email protected] as below...
    The example below was a bounce back when I accepted the invite.  The invite shows up on my calendar just fine.
    This message was created automatically by mail delivery software.
    A message that you sent could not be delivered to one or more of its recipients. This is a permanent error. The following address(es) failed:
      [email protected]
        Unrouteable address
    ------ This is a copy of the message, including all the headers. ------
    Return-path: <[email protected]>
    Received: from wsip-70-166-120-183.ph.ph.cox.net ([70.166.120.183] helo=PK01)
        by arelay1 with esmtpa (Exim 4.72)
        (envelope-from <[email protected]>)
        id 1W8D9b-0001kB-24
        for [email protected]; Tue, 28 Jan 2014 10:12:56 -0800
    From: "Kevin Simmons" <[email protected]>
    To: "miguel saucedo" <[email protected]>
    Subject: Accepted: Miguel Chaperone School
    Date: Tue, 28 Jan 2014 11:13:05 -0700
    Message-ID: <398EA47278F54C9FA9CFFB725FD6C079@PK01>
    MIME-Version: 1.0
    Content-Type: text/calendar; method=REPLY;
        charset="utf-8"
    Content-Transfer-Encoding: 7bit
    X-Mailer: Microsoft Office Outlook 11
    Thread-Index: Ac8cSpjUhKBGTbBKQt+PScNbb6MWwAABfTJgAABJyYAAALiiEA==
    X-MimeOLE: Produced By Microsoft MimeOLE V6.3.9600.16384
    BEGIN:VCALENDAR
    PRODID:-//Microsoft Corporation//Outlook 11.0 MIMEDIR//EN VERSION:2.0 METHOD:REPLY BEGIN:VEVENT ORGANIZER:MAILTO:/o=PKArchitects/ou=First Administrative
      Group/cn=Recipients/cn=miguel
    DTSTART:20140206T070000Z
    DTEND:20140208T070000Z
    LOCATION:Flagstaff
    TRANSP:OPAQUE
    SEQUENCE:3
    UID:040000008200E00074C5B7101A82E00800000000102573EC0F1CCF010000000000000000100
     0000037C3D09157000340AA5D3F23F6A60078
    DTSTAMP:20140128T181305Z
    SUMMARY:Accepted: Miguel Chaperone School
    PRIORITY:5
    X-MICROSOFT-CDO-IMPORTANCE:1
    CLASS:PUBLIC
    ATTENDEE;PARTSTAT=ACCEPTED:MAILTO:[email protected]
    END:VEVENT
    END:VCALENDAR

    Well it looks like none of our outlook installations actually are accessing the exchange email, nor are we able to send to those email addresses even though they exist.  I have 2 email inboxes in Outlook, 1 is the Integra inbox - works fine.  The
    other is called Mailbox - UserName - populated with folder that are and always have been empty.  If I send an email to myself at [email protected]  I get the following bounce back.
    This message was created automatically by mail delivery software.
    A message that you sent could not be delivered to one or more of its recipients. This is a permanent error. The following address(es) failed:
      [email protected]
        Unrouteable address
    ------ This is a copy of the message, including all the headers. ------
    Return-path: <[email protected]>
    Received: from wsip-70-166-120-183.ph.ph.cox.net ([70.166.120.183] helo=PK01)
        by arelay2.integra.engr with esmtpa (Exim 4.72)
        (envelope-from <[email protected]>)
        id 1WBtMM-0005N1-Gr
        for [email protected]; Fri, 07 Feb 2014 13:53:18 -0800
    Reply-To: <[email protected]>
    From: "Kevin Simmons" <[email protected]>
    To: <[email protected]>
    Subject: test
    Date: Fri, 7 Feb 2014 14:53:18 -0700
    Message-ID: <F708D49EB6A64BE69891BF9C7B528529@PK01>
    MIME-Version: 1.0
    Content-Type: multipart/related;
        boundary="----=_NextPart_000_0050_01CF2414.572804A0"
    X-Mailer: Microsoft Office Outlook 11
    Thread-Index: Ac8kTwKRc8hlRKNXSlye9E4r5UyfJQ==
    X-MimeOLE: Produced By Microsoft MimeOLE V6.3.9600.16384
    This is a multi-part message in MIME format.
    ------=_NextPart_000_0050_01CF2414.572804A0
    Content-Type: multipart/alternative;
        boundary="----=_NextPart_001_0051_01CF2414.572804A0"
    ------=_NextPart_001_0051_01CF2414.572804A0
    Content-Type: text/plain;
        charset="us-ascii"
    Content-Transfer-Encoding: 7bit
    test
    Thanks!
    Kevin Simmons
    Project Manager
    4515 S McClintock Dr. Suite 206
    Tempe, Arizona 85282
    p 602 283 1620
    f 602 283 1621
    c 480 702 9687
    [email protected]
    ------=_NextPart_001_0051_01CF2414.572804A0
    Content-Type: text/html;
        charset="us-ascii"
    Content-Transfer-Encoding: quoted-printable
    <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD> <META content=3D"text/html; charset=3Dus-ascii" = http-equiv=3DContent-Type> <META name=3DGENERATOR content=3D"MSHTML 11.00.9600.16476"></HEAD> <BODY>
    <DIV><FONT size=3D2 face=3DArial><SPAN=20 class=3D831025321-07022014>test</SPAN></FONT></DIV>
    <DIV>&nbsp;</DIV><?xml:namespace prefix =3D "o" ns =3D=20 "urn:schemas-microsoft-com:office:office" /><o:SmartTagType=20 namespaceuri=3D"urn:schemas-microsoft-com:office:smarttags"=20
    name=3D"PostalCode"></o:SmartTagType><o:SmartTagType=20
    namespaceuri=3D"urn:schemas-microsoft-com:office:smarttags"=20
    name=3D"State"></o:SmartTagType><o:SmartTagType=20
    namespaceuri=3D"urn:schemas-microsoft-com:office:smarttags"=20
    name=3D"City"></o:SmartTagType><o:SmartTagType=20
    namespaceuri=3D"urn:schemas-microsoft-com:office:smarttags"=20
    name=3D"place"></o:SmartTagType><o:SmartTagType=20
    namespaceuri=3D"urn:schemas-microsoft-com:office:smarttags"=20
    name=3D"Street"></o:SmartTagType><o:SmartTagType=20
    namespaceuri=3D"urn:schemas-microsoft-com:office:smarttags"=20
    name=3D"address"></o:SmartTagType>
    <STYLE>@page Section1 {size: 8.5in 11.0in; margin: 1.0in 1.25in 1.0in = 1.25in; mso-header-margin: .5in; mso-footer-margin: .5in; =
    mso-paper-source: 0; }
    P.MsoNormal {
        FONT-SIZE: 12pt; FONT-FAMILY: "Times New Roman"; MARGIN: 0in 0in 0pt; =
    mso-style-parent: ""; mso-pagination: widow-orphan; =
    mso-fareast-font-family: "Times New Roman"
    LI.MsoNormal {
        FONT-SIZE: 12pt; FONT-FAMILY: "Times New Roman"; MARGIN: 0in 0in 0pt; =
    mso-style-parent: ""; mso-pagination: widow-orphan; =
    mso-fareast-font-family: "Times New Roman"
    DIV.MsoNormal {
        FONT-SIZE: 12pt; FONT-FAMILY: "Times New Roman"; MARGIN: 0in 0in 0pt; =
    mso-style-parent: ""; mso-pagination: widow-orphan; =
    mso-fareast-font-family: "Times New Roman"
    SPAN.GramE {
        mso-style-name: ""; mso-gram-e: yes
    DIV.Section1 {
        page: Section1
    </STYLE>
    <DIV class=3DSection1>
    <P class=3DMsoNormal align=3Dleft><SPAN=20
    style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial">Thanks!</SPAN></P> <P class=3DMsoNormal>&nbsp;</P> <P class=3DMsoNormal><SPAN style=3D"FONT-SIZE: 10pt; FONT-FAMILY: = Arial">Kevin=20 Simmons</SPAN></P> <P
    class=3DMsoNormal><SPAN style=3D"FONT-SIZE: 10pt; FONT-FAMILY: = Arial">Project=20 Manager</SPAN></P> <P class=3DMsoNormal><o:p>&nbsp;</o:p></P>
    <P class=3DMsoNormal><IMG src=3D"cid:831025321@07022014-2937" = width=3D130 height=3D130=20 v:shapes=3D"_x0000_i1025"></P> <P class=3DMsoNormal><?xml:namespace prefix =3D "st1" ns =3D=20 "urn:schemas-microsoft-com:office:smarttags"
    /><st1:Street=20 w:st=3D"on"><st1:address w:st=3D"on"><SPAN=20
    style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial">4515 S McClintock Dr. = Suite=20 206</SPAN></st1:address></st1:Street></P>
    <P class=3DMsoNormal><st1:place w:st=3D"on"><st1:City w:st=3D"on"><SPAN=20
    style=3D"FONT-SIZE: 10pt; FONT-FAMILY: = Arial">Tempe</SPAN></st1:City><SPAN=20
    style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial">, <st1:State=20 w:st=3D"on">Arizona</st1:State> <st1:PostalCode=20 w:st=3D"on">85282</st1:PostalCode></SPAN></st1:place></P>
    <P class=3DMsoNormal><SPAN class=3DGramE><SPAN=20
    style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial">p</SPAN></SPAN><SPAN=20
    style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial"> 602 283 1620</SPAN></P> <P class=3DMsoNormal><SPAN class=3DGramE><SPAN=20
    style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial">f</SPAN></SPAN><SPAN=20
    style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial"> 602 283 1621</SPAN></P> <P class=3DMsoNormal><SPAN class=3DGramE><SPAN=20
    style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial">c</SPAN></SPAN><SPAN=20
    style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial"> 480 702 9687</SPAN></P> <P class=3DMsoNormal><SPAN=20
    style=3D"FONT-SIZE: 10pt; FONT-FAMILY: = Arial">[email protected]</SPAN></P></DIV>
    <DIV>&nbsp;</DIV></BODY></HTML>
    ------=_NextPart_001_0051_01CF2414.572804A0--
    ------=_NextPart_000_0050_01CF2414.572804A0
    Content-Type: image/jpeg;
        name="image002.jpg"
    Content-Transfer-Encoding: base64
    Content-ID: <831025321@07022014-2937>
    /9j/4AAQSkZJRgABAQEAYABgAAD/2wBDAAgGBgcGBQgHBwcJCQgKDBQNDAsLDBkSEw8UHRofHh0a
    HBwgJC4nICIsIxwcKDcpLDAxNDQ0Hyc5PTgyPC4zNDL/2wBDAQkJCQwLDBgNDRgyIRwhMjIyMjIy
    MjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjL/wAARCACCAIIDASIA
    AhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQA
    AAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcYGRolJicoKSo0NTY3
    ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKTlJWWl5iZmqKjpKWm
    p6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/8QA
    p6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+HwEA
    AwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREAAgECBAQDBAcFBAQAAQJ3AAECAxEEBSEx
    BhJBUQdhcRMiMoEIFEKRobHBCSMzUvAVYnLRChYkNOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElK
    U1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6goOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3
    uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwD3
    uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk5ebn6Onq8vP09fb3++iii
    gAooooAKKKKACq97dGzg81bae4O4DZAoLfXkjirFFAHltr8ZNKtPtNteadrU00V1OhZbdCABIwA+
    +OgwPwqf/hdmg/8AQI13/wABk/8Ai68juv8AkL6t/wBhG5/9GtTKxdVp2PKqY+cJuKS0PfvB
    +Xiwe
    JdNFylnqHlyXE4WaeNVVVEjYU4bqBgdO1dZXA/Bz/knsP/X5c/8Ao1q76tkepF3SYUUUUDCiiigA
    ooooAKKy9S1yz017ZZJ4B5twIWLzKuzIJyc/T9ak/t3R/wDoK2P/AIEJ/jQBoUVjXfibTLc2yxX1
    nM006Q4W4XKhu/XtWvHIkqB43V1PdTkUAOoqhqWqRad9nDFC0s6QkFwpUMcZq6jpIu5GVh6g5oAd
    RRRQB8sXX/IX1b/sI3P/AKNamU+6/wCQvq3/AGEbn/0a1Mrkl8TPnK/8WXqz2z4Of8k9h/6/Ln/0
    a1d9XA/Bz/knsP8A1+XP/o1q76upbH0MPhQUUUEgDJOAKZQUVU0/UYNTt2uLUs0O8qshXAkx/Evq
    voe+OKG1G3GqLpysz3JjMjKi5Ea9ix7Z7euD6GgC3RRRQB5X8atNsF8N2EosbYSy6pH5jiJd
    voe+z5R8
    5OOa8g/s2x/58rf/AL9L/hXtPxs/5FXS/wDsKRf+gSV4vPMfMECZyeWK9ceg9/ft+VYVdzyce5e0
    ST6EKCHT9Rsbuy06zlmtrlJNskYEZx/C2Oo9q3L7Xtd1NDHdarNFbEki0sP9GgXPbamCfxJrHkiY
    JEC21RIoCJwB+PWtbQfDq+I9Ua0zJFaRY+0SwjdK7HlYogf4yASSeFHJ7VMXJ6IypTqztTgz
    JEC21RIoCJwB+PWtbQfDq+I9Ua0zJFaRY+nbyD
    SYHQTi3Ehdc+Y2Wx+JzV6yjht2FxplxLav2ls7hoz+amvZZfh/aaZZWRtlXSzLdQx+TaHd/F
    SYHQTi3Ehdc+Y2Wx+JzV6yjht2FxplxLav2ls7hoz+96R2
    yXb3GB9etUPFPw2sLiALa2NppusAn7NdQKVt7xv+ecqnO1j2Jzz0J6Vp7N9Gdbwc0rxm7nPa
    yXb3GB9etUPFPw2sLiALa2NppusAn7NdQKVt7xv+F8Tv
    E2hsqXzjW7MdVmwlwo/2XAw30YfjXsvhvxRpXivTftulXBdVO2WJxtkhb+669j/PtmvmaONWVsxy
    W8qMUkjPDRupwykeoIIq3pesal4a1ePV9OkC3CYVweEuE/55yD09G7GlGo07MzoYyUZclUS6/wCQ
    vq3/AGEbn/0a1MqG3vV1GS7vVjaIXF3PL5b9U3SMcH3GamrKXxM4K/8AFl6s9s+Dn/JPYf8Ar8uf
    /RrV31cD8HP+Sew/9flz/wCjWrvWZUUsxCqBkknAArqWx9DD4UDMqKWYhVAySTgAV8/eNvFv9uX0
    1hoWo6iukgss9x9sc/aieqoCeIx69+3HW98QPiA/ieSXR9HlZNEUlZ7hDg3hHVVP/PP1P8X068no
    +j6h4i1aPR9HjUzkAyysP3dtH/eb+i96zlN35YnFiMRJy9lR3J9Gi8U+INVi0bRtd1nztoMk
    +hv5P
    LtY+m5sH8l7/AEr3bRPB1pokMQTUNUuJwyyTTTXjkzuMfM4zg5wOOmOKn8K+FdO8I6OthYKW
    LtY+Zjvn
    uH5knfuzH+nQDgVuVcVZanVSpuEbSd2FFFFUanmfxvcR+EdOdui6nGT/AN8SV4zaRMkW+Ufv
    uH5knfuzH+nQDgVuVcVZanVSpuEbSd2FFFFUanmfxvcR+pPmf
    2J7fhXsnxvCS+E9MTcP+QrETg+ivXkeR6isKu55OYv30vIr3sqwQCZ/uowY/QV7r8KfDDaL4
    2J7fhXsnxvCS+E9MTcP+QrETg+Ttb2
    9jxqN6puHDDmMPg7frjbn6Adq8JvIBdi2te091DEfozgH+dfUt1fpZ3FhAqqVuZjDndjYAjN
    9jxqN6puHDDmMPg7frjbn6Adq8JvIBdi2te091DEfozgH+n/x3
    H41VJaXNcuguRyK3iD/V6d/2EIP/AEKtK5toby2kt7iMSQyLtZT3FZfiB0MenfOv/H/B3/2quajq
    K2MEcoCvvnihxuxje4XP4ZzWp6J4B4+06TR/HMsUuSbuISFz/wAtSvAf6suAfVkY96wSARgj
    K2MEcoCvvnihxuxje4XP4ZzWp6J4B4+Ir0z
    44WUZTw7qiFfMju2tmweSroT+hX9a8zyPUVz1V7x4mPhy1brqZcGbLWXt+fJuU8xP95eo/LH
    44WUZTw7qiFfMju2tmweSroT+hX9a8zyPUVz1V7x4mPhy1brqZcGbLWXt+5VqV
    Q1PC/ZJ/4orhOfZvlP8AOrryLGAzfdzgn0+tQ9Tmn7yUj234PMqfDuNmIVRd3JJJwAPNauJ+IHxA
    bxNJJo+kTFNFVik9wpwbwjqqn/nn6n+L6deStPE2oXPg1PDcG6200XE73Mit811ukYhBjomO
    bxNJJo+vr06
    daNxGWg8qNQCcBT2T0P4VrKelkejXxfLFU4PXq+xoaPo+oeItWj0fR41M5AMsrD93bR/3m/o
    daNxGWg8qNQCcBT2T0P4VrKelkejXxfLFU4PXq+xoaPo+vevo
    Twr4V07wjo62FgpZmO+e4fmSd+7Mf6dAOBXL/By50h/CLWtlAIdSt5MakGO55JT0kJ7qw6en
    Twr4V07wjo62FgpZmO+e4fmSd+I7V6
    JVwikjqw1CNKGmrfUKKKKs6QooooA8n+M+laZZ+G9PuYrC2ilk1WMPIkQDNlXzk98mvKPs0H
    JVwikjqw1CNKGmrfUKKKKs6QooooA8n+M+laZZ+/PGP
    /vkV7F8cE8zwjpyZxnU4xn0+SSvHLaYzQgtgSL8rj0Ydawq7nk5hfnTXYjljtoJ7KV4YvLS8gL5U
    Y2+Yuc+2K+k73wlpM11p8kOk6eEhnLyjyFG5fLdcdOeSp/CvmzUYRc2hgPHmELn0zX0J8N/E
    Y2+Yuc+2K+x8Q+
    EbE3T/6fDEEmB6vtO0t+YIPuPpVUnpY2y+d4OJNrvh3RY47DZpNku6+hU4gUZBbp0qzqnhLSrm2i
    S20iwV1uIXb9yo+VZFLdvQGrXiD/AFenf9hCD/0KtZ3WNGd2CqoyWJwAPWtT0Dxr4z2Ok2Nt
    S20iwV1uIXb9yo+4fs7
    SxtIJ571pG8uJVJRIznoOmWFebfZoP8AnjH/AN8iul+Imqtr3jwT5PkWdsEhQjoHOQT7sPm+jLXP
    1z1X7x4uPnerZdDM1OGER20SxIGluEUYXsDk/oKvPbxPEYtoEZPzKvAPsaoA/bdcRwcw2qEj0LNw
    D+Wf8mtSoZzTbikvmUtPFxDAi3ETJFM8ptZD0lVXKsM+qnqPQg1dr0fwp4Th8X/B1bPcsV7D
    D+Wf8mtSoZzTbikvmUtPFxDAi3ETJFM8ptZD0lVXKsM+e3Mt
    ncEf6uUStjP+yehHoa83AmjklguYWguoHMU8LdY3HUf4HuMVU421N8VQ5LTWz/MvaHrl34X1
    ncEf6uUStjP+6DWr
    NWfyxsuYFP8Ar4SeV/3h1X3HvX0npuo2ur6bb6hYzLNa3EYkjkXoQa+X67b4YeLf+Ef1caHeyY0v
    UJM27MeILg/w+yv+jfWqpz6M3wOIt+6l8j3Siiitz1QooooA81+Nn/Iq6X/2FIv/AECSvF5YzHJ5
    yHbnhj2+p9q9o+Nn/Iq6X/2FIv8A0CSvH6wq7nkZg7VF6FWaYARCQGM+YvXofoa6Pwj4ki8N
    yHbnhj2+p9q9o+6o32
    qd4dOuH3/aYvmazlxjeV/ijYAB19ge1c89tcyXFpbWMPnyz3CRxwbgu5j0AJ4H48U65VLG6NtqNo
    9hdA8xXcXlt+GeD9QTUxutUY0XOnapBaHuur+LrNbfTRevGWN3DKk1mfPimUHOV25I+jD6E1
    9hdA8xXcXlt+GeD9QTUxutUY0XOnapBaHuur+LrNbfTRevGWN3DKk1mfPimUHOV25I+R8Ye
    OLO004PcPFI8mfsukxzK0lw3ZpypwkY6kd+5P3a8UWJbbDWM89qHlUsLWdowxzwcKQM+9NMW
    OLO004PcPFI8mfsukxzK0lw3ZpypwkY6kd+5P3a8UWJbbDWM89qHlUsLWdowxzwcKQM+n2YZ
    pPIQsdzvKwLMfUk8k1o6qtodkswjy+6ncsPdNJPNcXlyJ7y5kaadxyXduuAO3YDsAKakN5qN
    pPIQsdzvKwLMfUk8k1o6qtodkswjy+1BY2
    ls8tzcvsht1+9Kff+6o6k+laug+Gtc8TOq6JpjC3Y4N7cIYoFHqCRl/oor2/wX4C0/whA0oc
    ls8tzcvsht1+9Kff+6o6k+laug+3mqT
    DE97IoDEf3UH8K+w/HNTGDbuzGjhZ1Jc9TT8z53srOWx+1W1wyPcRXMscrp0Zlcrx7cce1Wq
    DE97IoDEf3UH8K+fdf8
    hfVv+wjc/wDo1qZWct2cdf8Aiy9T2z4Of8k9h/6/Ln/0a1Y3xa8IEqfFmnREywoF1GJBzJEO
    hfVv+kgH9
    5O/qv0FbPwc/5J7D/wBflz/6Nau9ZQ6lWAKkYII4IrptdWPe5FOnyy2aPlUEMoZSCpGQR3FNliSe
    JopBlWGDXR+N/CZ8HeIPKgQ/2RfMz2Tdom6tCfp1X247Vz9c0k4ux4NWnKjPlZ7Z8MPGT+IN
    JopBlWGDXR+LbSt
    Sl3avYKA7HrcRdFl+vZvf6iu+r5bsr+80fVLXVtOYLe2jbkBOFkU/ejb2Yce3B7V9IeHdes/
    Sl3avYKA7HrcRdFl+vZvf6iu+r5bsr+Euh2
    2q2LHypl5RvvRsOGRvQg5FdEJcyPZwuI9tDXdGpRRRVnUea/Gz/kVdL/AOwpF/6BJXj9ewfGz/kV
    dL/7CkX/AKBJXj9YVdzx8x/iL0Lug/8AI4eHf+wpB/OvpW8sbTUIDBe2sFzCesc0YdT+Br5q0H/k
    cPDv/YUg/nX07V0vhOrL/wCF8ziNV+FvhO7MDW/h3T42FwjS7E8vKZ+YfLWvp/gXwppcgksvD2mx
    SDo/2dSw/EjNHh3xpovim/1Sy0u4eSbTZfKnDJtGckZX1GVPNc3qfxq8IaRqt5pt098J7SVoZdls
    SoZTg856Vodx6IAAMAYAqte2n22DyvtFxB8wO+B9jfTPpWLN478OQeEU8UPqSf2TIPklAOWb
    SoZTg856Vodx6IAAMAYAqte2n22DyvtFxB8wO+ONoX
    ruyCMexql4X+JnhvxdNc2+nTzpdW8Zle3uItjlB/EB3HT86AMG2+Dei3P2i4vbnWI55bqZyF
    ruyCMexql4X+JnhvxdNc2+vOCD
    IxB6dxg/jU//AApXw1/z/a1/4G//AFq6K08daLe+CpfFkLTnS4ldmJiw+Fbafl+oqtd/Ejw/Zm3E
    rXWZ9M/tVNsJP7jGf++valZEOnB6tIk8G+Eo/DVgIIri/Ecc85SGW43qVaRtrEY6kYP1rqq81tfj
    n4Nu7yK1ibUDLK6xqDanqTgZ5qfVPjT4R0jVrzTLlr/7RaTNDLstiwDKcHBzTLOh8SeDNO8U2k9v
    qE975cuGVUuGCxuPusq9AQea5Sw+DWgSWaG+/tSO5GVkCagxViDjcPY9cdRnFdDe/Efw5p3h
    qE975cuGVUuGCxuPusq9AQea5Sw+DWgSWaG+Oz8S
    XVzLFZXv/HvGYz5spyRgJ+H0qnY/FjwrqPh7UdZgnuPK07b9pgaEiZAzBQdvcZPUGlZEuMXuin/w
    pbwr/wA9tW/8Dnq3pXw+tvDN6i6Rdap9huWJuYvtzAq+OJPfptI+h7Gqel/Gvwjq+q2um2rX5uLm
    ZYYw1qQNzHAyc8danv8A4x+DtO1+TSJrycyRTCCa4SEmGJ84IZvY9SMiiyBRitkd9RSAhlDK
    ZYYw1qQNzHAyc8danv8A4x+DtO1+QQRk
    Ed6KZR5t8bP+RV0v/sKRf+gSV4/XsvxK0TXvENjYWEB02NDqSNC0jyZOFfG7C+npXH/8Kh8Y
    Ed6KZR5t8bP+f8/e
    hf8Afyb/AOJrKpByeh52Mw9SrNOC6HL6D/yOHh3/ALCkH86998ca8PDPgrVtW3ASQQN5We8jfKn/
    AI8RXlUPw28U6LrWjX9xcaM6xahCwWOSXJbPHVelem+JPCbeMtHtLDWbjyEhuluJY7Q5SYLn
    AI8RXlUPw28U6LrWjX9xcaM6xahCwWOSXJbPHVelem+CksM
    455qqaaVmb4SlKnT5Zb3PD/hdr+h6J458ORabePLJqdi1pqgdGUC5LF1OT15IXI9PerMniHxX4a1
    Lx/qGiaZp91pqatILuS4Qu0RJIBCgjK888GvafFHgjTPE2n21uf9BltrlLmG4to1Do6dO3TmjSfB
    Gn6Y3iHfLJdRa7O81zHKBtG4EFRjtyas6jyWDQrXSofhZpst3DqGm3N9NdSSqP3UkrbWQAHsM4wf
    f6V6pq1v4VXxfFNOLdfExsJBbDcQ7RYbPA4P8XXnrWbB8J9JXwR/wi11fXlzaxTm4tJ2KrLat/sE
    D1J6+pqTwt8MNP8ADmoXWp3Gp3+q6pPCYBd3sm5o4z2X/GgDxrSZPHQ+B90lpBpJ8M+VNvdy
    D1J6+pqTwt8MNP8ADmoXWp3Gp3+ftG3
    ed2OcZznHFdt4cAPxL8CgjI/4RJP5Gu4sfh5Y2Hw6m8GJe3LWkqSIZ2C+YN7Fj2x3qWw8B2Wn+IN
    H1dLy4aXS9MGmxowXa6D+I8daAOd8Hov/C7PHo2rgR2mOOnyVy3h0eOD4w8bf8IpForwf2vJ
    H1dLy4aXS9MGmxowXa6D+5x1D
    du3ZONu3tivV9L8J22leLta8RR3Mzz6qsQkibG1Ni4GO/wCdcjffBuC61rUdTtvFWuWDX9w1xLFa
    zBF3E57devegCldx3dx8ZPBcPiOO1NxHpMsgSIZh+0/Nu2A+gAI+grtrS28KJ48v3thbjxK9
    zBF3E57devegCldx3dx8ZPBcPiOO1NxHpMsgSIZh+qv2p
    VJ3mLIwSOn93nr0rM1L4Y6fq3hjTdKu9T1F7zTWZ7XVfN/0lGJyfm7jp+Qq14L+H2n+DZby7S7u9
    Q1O8x9ovbt90jAdB7D/PYUAYPw2Rf+E3+IXyjjVFxx04auM+y6p4e0rXLzRBpPinwJPdS3F7bsds
    0YyC4zwcqMc89M4r2DQPClt4f1fXNRguJpZNXuRcSq4GEIzwuO3PeuRv/grpF3qt1PBq+qWenXk3
    nXemQTbYZWzkjHYH9O2KAPQtLmtrjSbOazXbayQI8K4xhCoKj8sUVYhhjt4I4YUCRRqERR0UAYAo
    oAcVVsblBwcjI6GloooARlVsblBwcjI6GloooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKAP
    /9k=
    ------=_NextPart_000_0050_01CF2414.572804A0--
    beyond that - the Global Address Book does not update!

  • Authentication Plug-ins for active directory Multiple Domains(oidspad2.sh)

    hi ,
    i have use note 294791.1 from metalink to try link to active directory i have 2 one is staff and another is student
    i first ran oidspadi.sh to create plugin for staff it works then i edit the 2 script to oidspad2.pls and oidspad2.sh with the require changes inside the files then i ran it it work but now the problem is the first ad now cant work this is my changes below
    FOR oidspad2.pls
    Rem
    Rem $Header: oidspada.pls 02-aug-2004.04:45:11 saroy Exp $
    Rem
    Rem oidspads.pls
    Rem
    Rem Copyright (c) 2002, 2004, Oracle. All rights reserved.
    Rem
    Rem NAME
    Rem oidspada.pls - 9.0.4 OID Password Active Directory
    Rem External Authentication Plug-in
    Rem
    Rem
    Rem NOTES
    Rem <other useful comments, qualifications, etc.>
    Rem
    Rem MODIFIED (MM/DD/YY)
    Rem saroy 08/02/04 - Fix for bug 3807482
    Rem qdinh 01/27/04 - bug 3374115
    Rem dlin 01/08/04 - pingan perf
    Rem dlin 08/22/03 - 3111770 bug fix
    Rem dlin 08/27/03 - change the way to get name
    Rem dlin 08/13/03 - bug 2962082 fix
    Rem dlin 02/21/03 - plug-in install changes
    Rem dlin 02/13/03 - dlin_bug-2625027
    Rem dlin 02/05/03 - fix ssl & failover
    Rem dlin 01/31/03 - dlin_adextauth1
    Rem dlin 01/30/03 - Created
    Rem
    SET echo off;
    SET serveroutput off;
    SET feedback off;
    SET verify off;
    CREATE OR REPLACE PACKAGE OIDADPSW2 AS
    PROCEDURE when_bind_replace (ldapplugincontext IN ODS.plugincontext,
    result OUT INTEGER,
    dn IN VARCHAR2,
    passwd IN VARCHAR2,
    rc OUT INTEGER,
    errormsg OUT VARCHAR2
    PROCEDURE when_compare_replace (ldapplugincontext IN ODS.plugincontext,
    result OUT INTEGER,
    dn IN VARCHAR2,
    attrname IN VARCHAR2,
    attrval IN VARCHAR2,
    rc OUT INTEGER,
    errormsg OUT VARCHAR2
    AD_HANDLE DBMS_LDAP.session DEFAULT NULL;
    END OIDADPSW2;
    SHOW ERROR
    CREATE OR REPLACE PACKAGE BODY OIDADPSW2 AS
    SUBTYPE LDAP_SESSION IS RAW(32);
    SUBTYPE LDAP_MESSAGE IS RAW(32);
    SUBTYPE LDAP_BER_ELEMENT IS RAW(32);
    SUBTYPE ATTRLIST IS DBMS_LDAP.STRING_COLLECTION;
    SUBTYPE MOD_ARRAY IS RAW(32);
    SUBTYPE BERLIST IS DBMS_LDAP.BERVAL_COLLECTION;
    PROCEDURE when_bind_replace (ldapplugincontext IN ODS.plugincontext,
    result OUT INTEGER,
    dn IN VARCHAR2,
    passwd IN VARCHAR2,
    rc OUT INTEGER,
    errormsg OUT VARCHAR2
    IS
    retval pls_integer;
    lresult BOOLEAN;
    my_session DBMS_LDAP.session;
    my_session1 DBMS_LDAP.session;
    tmp_session DBMS_LDAP.session;
    adupname VARCHAR2(1024) DEFAULT NULL;
    BEGIN
    plg_debug( '=== Begin when_bind_replace()');
    DBMS_LDAP.USE_EXCEPTION := FALSE;
    result := 49;
    adupname := LDAP_PLUGIN.get_adupname(ldapplugincontext);
    IF (adupname IS NULL) THEN
    result := 1;
    plg_debug('Can not get ADUserPrincipalName');
    rc := DBMS_LDAP.SUCCESS;
    errormsg := 'Exception in when_bind_replace: Can not get ADUserPrincipalName';
    plg_debug( '=== End when_bind_replace() ===');
    RETURN;
    END IF;
    plg_debug( 'Go to AD for authentication');
    -- externally authenticate user
    IF ('&1' = 'n') THEN
         IF (OIDADPSW2.AD_HANDLE IS NULL) THEN
         my_session := DBMS_LDAP.init('&2', &3);
         OIDADPSW2.AD_HANDLE := my_session;
         ELSE
         my_session := OIDADPSW2.AD_HANDLE;
         END IF;
    plg_debug( 'ldap_session: ' || RAWTOHEX(SUBSTR(my_session,1,8)));
    retval := DBMS_LDAP.simple_bind_s(my_session, adupname, passwd);
    plg_debug( 'simple_bind_res: ' || TO_CHAR(retval));
    -- Retry logic should be invoked only
    -- when retval = LDAP_UNWILLING_TO_PERFORM || LDAP_UNAVAILABLE
    -- Should free the old session if retry logic kept failing
    -- to cause the number of outstanding sessions exceeding the
    -- limit session number
         IF (retval = 52 OR retval = 53 OR retval = 81) THEN
         retval := DBMS_LDAP.unbind_s(my_session);
         plg_debug( 'unbind_res returns ' || TO_CHAR(retval));
         my_session1 := DBMS_LDAP.init('&4', &5);
         plg_debug( 'ldap_session: ' || RAWTOHEX(SUBSTR(my_session1,1,8)));
         tmp_session := my_session1;
         retval := DBMS_LDAP.simple_bind_s(my_session1, adupname, passwd);
         plg_debug( 'simple_bind_res again: ' || TO_CHAR(retval));
         IF (retval != 52 AND retval != 53 AND retval != 81) THEN
         OIDADPSW2.AD_HANDLE := tmp_session;
         ELSE
         retval := DBMS_LDAP.unbind_s(tmp_session);
         plg_debug( 'unbind_res result ' || TO_CHAR(retval));
         END IF;
         END IF;
    ELSE
    -- SSL bind
         IF (OIDADPSW2.AD_HANDLE IS NULL) THEN
         my_session := DBMS_LDAP.init('&6', &7);
         plg_debug( 'ldap_session initialized: ' || RAWTOHEX(SUBSTR(my_session,1,8)));
         retval := DBMS_LDAP.open_ssl(my_session,
                             'file:' || '&8', '&9', 2);
         IF (retval != 0) THEN
         plg_debug( 'open_ssl failed error: ' || TO_CHAR(retval));
         retval := DBMS_LDAP.unbind_s(my_session);
         plg_debug( 'unbind_res returns ' || TO_CHAR(retval));
         result := 82;
         RETURN;
         END IF;
         plg_debug( 'open_ssl: ' || TO_CHAR(retval));
         OIDADPSW2.AD_HANDLE := my_session;
         ELSE
         my_session := OIDADPSW2.AD_HANDLE;
         END IF;
    retval := DBMS_LDAP.simple_bind_s(my_session, adupname, passwd);
    plg_debug( 'simple_bind_res: ' || TO_CHAR(retval));
    -- Retry logic should be invoked only
    -- when retval = LDAP_UNWILLING_TO_PERFORM
    -- or LDAP_UNAVAILABLE
         IF (retval = 52 OR retval = 53 OR retval = 81) THEN
         retval := DBMS_LDAP.unbind_s(my_session);
         plg_debug( 'unbind_res returns ' || TO_CHAR(retval));
         my_session1 := DBMS_LDAP.init('&10', &11);
         plg_debug( 'ldap_session: ' || RAWTOHEX(SUBSTR(my_session1,1,8)));
         tmp_session := my_session1;
         retval := DBMS_LDAP.open_ssl(my_session1,
                             'file:' || '&12', '&13', 2);
         IF (retval != 0) THEN
         plg_debug( 'retry open_ssl failed error: ' || TO_CHAR(retval));
         retval := DBMS_LDAP.unbind_s(my_session1);
         plg_debug( 'retry unbind_res returns ' || TO_CHAR(retval));
         result := 82;
         RETURN;
         END IF;
         plg_debug( 'retry open_ssl: ' || TO_CHAR(retval));
         retval := DBMS_LDAP.simple_bind_s(my_session1, adupname, passwd);
         plg_debug( 'simple_bind_res: again ' || TO_CHAR(retval));
         IF (retval != 52 AND retval != 53 AND retval != 81) THEN
         OIDADPSW2.AD_HANDLE := tmp_session;
         ELSE
         retval := DBMS_LDAP.unbind_s(tmp_session);
         plg_debug( 'unbind_res Returns ' || TO_CHAR(retval));
         END IF;
         END IF;
    END IF;
    -- for failover to connect to the secondary server
    IF ('&14' = 'y' AND retval != 0) THEN
    IF ('&15' = 'n') THEN
         IF (OIDADPSW2.AD_HANDLE IS NULL) THEN
         my_session := DBMS_LDAP.init('&16', &17);
         OIDADPSW2.AD_HANDLE := my_session;
         ELSE
         my_session := OIDADPSW2.AD_HANDLE;
         END IF;
    plg_debug( 'ldap_session initialized: ' || RAWTOHEX(SUBSTR(my_session,1,8)));
    retval := DBMS_LDAP.simple_bind_s(my_session, adupname, passwd);
    plg_debug( 'simple_bind_res: ' || TO_CHAR(retval));
         IF (retval = 52 OR retval = 53 OR retval = 81) THEN
         retval := DBMS_LDAP.unbind_s(my_session);
         plg_debug( 'unbind_res returns ' || TO_CHAR(retval));
         my_session1 := DBMS_LDAP.init('&18', &19);
         plg_debug( 'retry ldap_session: ' || RAWTOHEX(SUBSTR(my_session1,1,8)));
         tmp_session := my_session1;
         retval := DBMS_LDAP.simple_bind_s(my_session1, adupname, passwd);
         plg_debug( 'retry simple_bind_res again: ' || TO_CHAR(retval));
         IF (retval != 52 AND retval != 53 AND retval != 81) THEN
              OIDADPSW2.AD_HANDLE := tmp_session;
         ELSE
         retval := DBMS_LDAP.unbind_s(tmp_session);
              plg_debug( 'unbind_res Returns ' || TO_CHAR(retval));
         END IF;
         END IF;
    ELSE
         IF (OIDADPSW2.AD_HANDLE IS NULL) THEN
         my_session := DBMS_LDAP.init('&20', &21);
         plg_debug( 'ldap_session: ' || RAWTOHEX(SUBSTR(my_session,1,8)));
         retval := DBMS_LDAP.open_ssl(my_session,
                             'file:' || '&22', '&23', 2);
         IF (retval != 0) THEN
         plg_debug( 'open_ssl failed error: ' || TO_CHAR(retval));
         retval := DBMS_LDAP.unbind_s(my_session);
         plg_debug( 'unbind_res returns ' || TO_CHAR(retval));
         result := 82;
         RETURN;
         END IF;
         plg_debug( 'open_ssl: ' || TO_CHAR(retval));
         OIDADPSW2.AD_HANDLE := my_session;
         ELSE
         my_session := OIDADPSW2.AD_HANDLE;
         END IF;
    retval := DBMS_LDAP.simple_bind_s(my_session, adupname, passwd);
    plg_debug( 'simple_bind_res: ' || TO_CHAR(retval));
    -- Retry logic should be invoked only
    -- when retval = LDAP_UNWILLING_TO_PERFORM || LDAP_UNAVAILABLE
         IF (retval = 52 OR retval = 53 OR retval = 81) THEN
         retval := DBMS_LDAP.unbind_s(my_session);
         plg_debug( 'unbind_res returns ' || TO_CHAR(retval));
         my_session1 := DBMS_LDAP.init('&24', &25);
         plg_debug( 'retry ldap_session: ' || RAWTOHEX(SUBSTR(my_session1,1,8)));
         tmp_session := my_session1;
         retval := DBMS_LDAP.open_ssl(my_session1,
                             'file:' || '&26', '&27', 2);
         IF (retval != 0) THEN
         plg_debug( 'retry open_ssl failed error: ' || TO_CHAR(retval));
         retval := DBMS_LDAP.unbind_s(my_session);
         plg_debug( 'retry unbind_res returns ' || TO_CHAR(retval));
         result := 82;
         RETURN;
         END IF;
         plg_debug( 'retry open_ssl: ' || TO_CHAR(retval));
         retval := DBMS_LDAP.simple_bind_s(my_session1, adupname, passwd);
         plg_debug( 'simple_bind_res: again ' || TO_CHAR(retval));
         IF (retval != 52 AND retval != 53 AND retval != 81) THEN
              OIDADPSW2.AD_HANDLE := tmp_session;
         ELSE
         retval := DBMS_LDAP.unbind_s(tmp_session);
         plg_debug( 'unbind_res result ' || TO_CHAR(retval));
         END IF;
         END IF;
         END IF;
    END IF;
    IF (retval = 0) THEN
    result := 0;
    plg_debug('AD auth return TRUE');
    ELSE
         result := retval;
    plg_debug('AD auth return FALSE or ERROR');
    END IF;
    -- retval := DBMS_LDAP.unbind_s(my_session);
    -- plg_debug( 'unbind_res Returns ' || TO_CHAR(retval));
    rc := DBMS_LDAP.SUCCESS;
    errormsg := 'No error msg.';
    plg_debug( '=== End when_bind_replace() ===');
    EXCEPTION
    WHEN OTHERS THEN
    rc := DBMS_LDAP.OPERATIONS_ERROR;
         retval := DBMS_LDAP.unbind_s(OIDADPSW2.AD_HANDLE);
         OIDADPSW2.AD_HANDLE := NULL;
         plg_debug( ' exception unbind_res returns ' || TO_CHAR(retval));
    errormsg := 'Exception: when_bind_replace plugin';
    plg_debug( 'Exception in when_bind_replace(). Error code is ' ||
              TO_CHAR(sqlcode));
    plg_debug( ' ' || Sqlerrm);
    END;
    PROCEDURE when_compare_replace (ldapplugincontext IN ODS.plugincontext,
    result OUT INTEGER,
    dn IN VARCHAR2,
    attrname IN VARCHAR2,
    attrval IN VARCHAR2,
    rc OUT INTEGER,
    errormsg OUT VARCHAR2
    IS
    retval pls_integer;
    lresult BOOLEAN;
    my_session DBMS_LDAP.session;
    my_session1 DBMS_LDAP.session;
    tmp_session DBMS_LDAP.session;
    adupname VARCHAR2(1024) DEFAULT NULL;
    BEGIN
    plg_debug( '=== Begin when_compare_replace()');
    result := DBMS_LDAP.COMPARE_FALSE;
    DBMS_LDAP.USE_EXCEPTION := FALSE;
    adupname := LDAP_PLUGIN.get_adupname(ldapplugincontext);
    IF (adupname IS NULL) THEN
    result := DBMS_LDAP.COMPARE_FALSE;
    plg_debug('Can not get ADuserPrincipalName');
    rc := DBMS_LDAP.SUCCESS;
    errormsg := 'Exception in when_compare_replace: Can not get ADUserPrincipalName';
    plg_debug( '=== End when_compare_replace() ===');
    RETURN;
    END IF;
    -- externally authenticate user
    IF ('&28' = 'n') THEN
         IF (OIDADPSW2.AD_HANDLE IS NULL) THEN
         my_session := DBMS_LDAP.init('&29', &30);
         OIDADPSW2.AD_HANDLE := my_session;
         ELSE
         my_session := OIDADPSW2.AD_HANDLE;
         END IF;
    plg_debug( 'ldap_session: ' || RAWTOHEX(SUBSTR(my_session,1,8)));
    retval := DBMS_LDAP.simple_bind_s(my_session, adupname, attrval);
    plg_debug( 'simple_bind_res: ' || TO_CHAR(retval));
    -- Retry logic should be invoked only
    -- when retval = LDAP_UNWILLING_TO_PERFORM || LDAP_UNAVAILABLE
    IF (retval = 52 OR retval = 53 OR retval = 81) THEN
         retval := DBMS_LDAP.unbind_s(my_session);
    plg_debug( 'retry unbind_res returns ' || TO_CHAR(retval));
         my_session1 := DBMS_LDAP.init('&31', &32);
         plg_debug( 'ldap_session: ' || RAWTOHEX(SUBSTR(my_session1,1,8)));
         tmp_session := my_session1;
         retval := DBMS_LDAP.simple_bind_s(my_session1, adupname, attrval);
         plg_debug( 'simple_bind_res again: ' || TO_CHAR(retval));
         IF (retval != 52 AND retval != 53 AND retval != 81) THEN
         OIDADPSW2.AD_HANDLE := tmp_session;
    ELSE
         retval := DBMS_LDAP.unbind_s(tmp_session);
         plg_debug( 'unbind_res result ' || TO_CHAR(retval));
         END IF;
         END IF;
    ELSE
         IF (OIDADPSW2.AD_HANDLE IS NULL) THEN
         my_session := DBMS_LDAP.init('&33', &34);
         plg_debug( 'ldap_session: ' || RAWTOHEX(SUBSTR(my_session,1,8)));
         retval := DBMS_LDAP.open_ssl(my_session,
                             'file:' || '&35', '&36', 2);
         IF (retval != 0) THEN
         plg_debug( 'open_ssl failed error: ' || TO_CHAR(retval));
         retval := DBMS_LDAP.unbind_s(my_session);
         plg_debug( 'unbind_res returns ' || TO_CHAR(retval));
         result := 82;
         RETURN;
         END IF;
         plg_debug( 'open_ssl: ' || TO_CHAR(retval));
         OIDADPSW2.AD_HANDLE := my_session;
         ELSE
         my_session := OIDADPSW2.AD_HANDLE;
         END IF;
    retval := DBMS_LDAP.simple_bind_s(my_session, adupname, attrval);
    plg_debug( 'simple_bind_res: ' || TO_CHAR(retval));
    -- Retry logic should be invoked only
    -- when retval = LDAP_UNWILLING_TO_PERFORM || LDAP_UNAVAILABLE
    IF (retval = 52 OR retval = 53 OR retval = 81) THEN
         retval := DBMS_LDAP.unbind_s(my_session);
    plg_debug( 'retry unbind_res returns ' || TO_CHAR(retval));
         my_session1 := DBMS_LDAP.init('&37', &38);
         plg_debug( 'ldap_session: ' || RAWTOHEX(SUBSTR(my_session1,1,8)));
         tmp_session := my_session1;
         retval := DBMS_LDAP.open_ssl(my_session1,
                             'file:' || '&39', '&40', 2);
    IF (retval != 0) THEN
         plg_debug( 'open_ssl failed error: ' || TO_CHAR(retval));
         retval := DBMS_LDAP.unbind_s(my_session);
         plg_debug( 'unbind_res returns ' || TO_CHAR(retval));
         result := 82;
         RETURN;
         END IF;
         plg_debug( 'open_ssl: ' || TO_CHAR(retval));
         retval := DBMS_LDAP.simple_bind_s(my_session1, adupname, attrval);
         plg_debug( 'simple_bind_res: again ' || TO_CHAR(retval));
         IF (retval != 52 AND retval != 53 AND retval != 81) THEN
         OIDADPSW2.AD_HANDLE := tmp_session;
    ELSE
         retval := DBMS_LDAP.unbind_s(tmp_session);
         plg_debug( 'unbind_res result ' || TO_CHAR(retval));
         END IF;
         END IF;
    END IF;
    -- for failover to connect to the secondary AD
    IF ('&41' = 'y' AND retval != 0) THEN
    IF ('&42' = 'n') THEN
         IF (OIDADPSW2.AD_HANDLE IS NULL) THEN
         my_session := DBMS_LDAP.init('&43', &44);
         OIDADPSW2.AD_HANDLE := my_session;
         ELSE
         my_session := OIDADPSW2.AD_HANDLE;
         END IF;
    plg_debug( 'ldap_session: ' || RAWTOHEX(SUBSTR(my_session,1,8)));
    retval := DBMS_LDAP.simple_bind_s(my_session, adupname, attrval);
    plg_debug( 'simple_bind_res: ' || TO_CHAR(retval));
    -- Retry logic should be invoked only
    -- when retval = LDAP_UNWILLING_TO_PERFORM || LDAP_UNAVAILABLE
         IF (retval = 52 OR retval = 53 OR retval = 81) THEN
         retval := DBMS_LDAP.unbind_s(my_session);
    plg_debug( 'retry unbind_res returns ' || TO_CHAR(retval));
         my_session1 := DBMS_LDAP.init('&45', &46);
         plg_debug( 'ldap_session: ' || RAWTOHEX(SUBSTR(my_session1,1,8)));
         tmp_session := my_session1;
         retval := DBMS_LDAP.simple_bind_s(my_session1, adupname, attrval);
         plg_debug( 'simple_bind_res again: ' || TO_CHAR(retval));
         IF (retval != 52 AND retval != 53 AND retval != 81) THEN
              OIDADPSW2.AD_HANDLE := tmp_session;
    ELSE
         retval := DBMS_LDAP.unbind_s(tmp_session);
         plg_debug( 'unbind_res result ' || TO_CHAR(retval));
         END IF;
         END IF;
         ELSE
         IF (OIDADPSW2.AD_HANDLE IS NULL) THEN
         my_session := DBMS_LDAP.init('&47', &48);
         plg_debug( 'ldap_session: ' || RAWTOHEX(SUBSTR(my_session,1,8)));
         retval := DBMS_LDAP.open_ssl(my_session,
                             'file:' || '&49', '&50', 2);
         IF (retval != 0) THEN
         plg_debug( 'open_ssl failed error: ' || TO_CHAR(retval));
         retval := DBMS_LDAP.unbind_s(my_session);
         plg_debug( 'unbind_res returns ' || TO_CHAR(retval));
         result := 82;
         RETURN;
         END IF;
         plg_debug( 'open_ssl: ' || TO_CHAR(retval));
         OIDADPSW2.AD_HANDLE := my_session;
         ELSE
         my_session := OIDADPSW2.AD_HANDLE;
         END IF;
    retval := DBMS_LDAP.simple_bind_s(my_session, adupname, attrval);
    plg_debug( 'simple_bind_res: ' || TO_CHAR(retval));
    -- Retry logic should be invoked only
    -- when retval = LDAP_UNWILLING_TO_PERFORM || LDAP_UNAVAILABLE
         IF (retval = 52 OR retval = 53 OR retval = 81) THEN
         retval := DBMS_LDAP.unbind_s(my_session);
    plg_debug( 'retry unbind_res returns ' || TO_CHAR(retval));
         my_session1 := DBMS_LDAP.init('&51', &52);
         plg_debug( 'ldap_session: ' || RAWTOHEX(SUBSTR(my_session1,1,8)));
         tmp_session := my_session1;
         retval := DBMS_LDAP.open_ssl(my_session1,
                             'file:' || '&53', '&54', 2);
         IF (retval != 0) THEN
         plg_debug( 'open_ssl failed error: ' || TO_CHAR(retval));
         retval := DBMS_LDAP.unbind_s(my_session1);
         plg_debug( 'unbind_res returns ' || TO_CHAR(retval));
         result := 82;
         RETURN;
         END IF;
         plg_debug( 'open_ssl: ' || TO_CHAR(retval));
         retval := DBMS_LDAP.simple_bind_s(my_session1, adupname, attrval);
         plg_debug( 'simple_bind_res: again ' || TO_CHAR(retval));
         IF (retval != 52 AND retval != 53 AND retval != 81) THEN
              OIDADPSW2.AD_HANDLE := tmp_session;
         ELSE
         retval := DBMS_LDAP.unbind_s(tmp_session);
         plg_debug( 'unbind_res result ' || TO_CHAR(retval));
         END IF;
         END IF;
         END IF;
    END IF;
    IF (retval = 0) THEN
    result := DBMS_LDAP.COMPARE_TRUE;
    plg_debug('AD auth return TRUE');
    ELSE
    result := DBMS_LDAP.COMPARE_FALSE;
    plg_debug('AD auth return FALSE or ERROR');
    END IF;
    -- retval := DBMS_LDAP.unbind_s(my_session);
    -- plg_debug( 'unbind_res Returns ' || TO_CHAR(retval));
    rc := DBMS_LDAP.SUCCESS;
    errormsg := 'No error msg.';
    plg_debug( '=== End when_compare_replace() ===');
    EXCEPTION
    WHEN OTHERS THEN
    rc := DBMS_LDAP.OPERATIONS_ERROR;
    errormsg := 'Exception: when_compare_replace plugin';
    plg_debug( 'Exception in when_compare_replace(). Error code is ' ||
              TO_CHAR(sqlcode));
    plg_debug( ' ' || Sqlerrm);
         retval := DBMS_LDAP.unbind_s(OIDADPSW2.AD_HANDLE);
         OIDADPSW2.AD_HANDLE := NULL;
    END;
    END OIDADPSW2;
    SHOW ERRORS
    EXIT;
    -- usessl, adhost, adport, adhost, adsslport, walletloc, walletpwd
    -- isfailover, isfailoverssl, sechost, secport, sechost, secsslport
    -- secwalletloc, secwalletpwd
    -- usessl, adhost, adport, adhost, adsslport, walletloc, walletpwd
    -- isfailover, isfailoverssl, sechost, secport, sechost, secsslport
    -- secwalletloc, secwalletpwd
    FOR oidspadi.sh
    #!/bin/sh
    # $Header: oidspadi.sh 13-may-2005.13:48:51 saroy Exp $
    # oidspadi.sh
    # Copyright (c) 2002, 2005, Oracle. All rights reserved.
    # NAME
    # oidspadi.sh - AD external authentication plug-in install
    # DESCRIPTION
    # <short description of component this file declares/defines>
    # NOTES
    # <other useful comments, qualifications, etc.>
    # MODIFIED (MM/DD/YY)
    # saroy 05/13/05 - Fix for bug 4233817
    # saroy 02/18/05 - Fix for bug 4054414
    # saroy 11/02/04 - Fix for bug 3980370
    # qdinh 01/19/04 - bug 3374115
    # dlin 07/10/03 - turn off debug
    # dlin 02/21/03 - plug-in install changes
    # dlin 02/13/03 - dlin_bug-2625027
    # dlin 07/22/02 - Creation
    ADHOST="A"
    ADPORT="1"
    ADSSLPORT="1"
    WALLETLOC="A"
    WALLETPWD="A"
    WALLETPWD2="A"
    CONNECT="A"
    ODSPWD="A"
    ODSPWD2="A"
    OIDHOST="A"
    OIDPORT="1"
    ORCLADMINPWD="A"
    ORCLADMINPWD2="A"
    PRGDN="A"
    SCUSB="A"
    EP="A"
    ISSSL="n"
    ISFAILOVER="n"
    ISFAILOVERSSL="n"
    SECADHOST="A"
    SECADPORT="1"
    SECADSSLPORT="1"
    SECWALLETLOC="A"
    SECWALLETPWD="A"
    SECWALLETPWD2="A"
    clear
    echo "---------------------------------------------"
    echo " OID Active Directory Plug-in Configuration"
    echo "---------------------------------------------"
    echo " "
    echo "Please make sure Database and OID are up and running."
    echo " "
    LDAP_DIR=${ORACLE_HOME}/ldap
    LDAP_LOG=${LDAP_DIR}/log
    ## ORACLE_HOME
    if [ -z $ORACLE_HOME ] ; then
    echo " ORACLE_HOME must be set for this installation script"
    exit 0
    fi
    # gather required information
    if [ ${ADHOST} = "A" ] ; then
    printf "Please enter Active Directory host name: "
    read ADHOST
    fi
    ## active directory host name is required
    if [ "${ADHOST}" = "" ]
    then
    echo "Active Directory host name is required";
    exit 1;
    fi
    printf "Do you want to use SSL to connect to Active Directory? (y/n) "
    read ISSSL
    if [ "${ISSSL}" = "n" ]
    then
    if [ ${ADPORT} = "1" ] ; then
    printf "Please enter Active Directory port number [389]: "
    read ADPORT
    if [ "${ADPORT}" = "" ]
    then
    ADPORT="389"
    fi
    fi
    fi
    if [ "${ISSSL}" = "y" ]
    then
    if [ ${ADSSLPORT} = "1" ] ; then
    printf "Please enter Active Directory SSL port number [636]: "
    read ADSSLPORT
    if [ "${ADSSLPORT}" = "" ]
    then
    ADSSLPORT="636"
    fi
    fi
    if [ ${WALLETLOC} = "A" ] ; then
    echo " "
    printf "Please enter Oracle wallet location: "
    read WALLETLOC
    fi
    ## wallet location is required
    if [ "${WALLETLOC}" = "" ]
    then
    echo "Oracle wallet location is required";
    exit 1;
    fi
    if [ ${WALLETPWD} = "A" ] ; then
    printf "Please enter Oracle wallet password: "
    stty -echo ; read WALLETPWD ; stty echo ; echo
    fi
    if [ "${WALLETPWD}" = "" ]
    then
    echo "Oracle wallet password is required";
    exit 1;
    fi
    if [ ${WALLETPWD2} = "A" ] ; then
    printf "Please enter confirmed Oracle wallet password: "
    stty -echo ; read WALLETPWD2 ; stty echo ; echo
    fi
    if [ "${WALLETPWD}" != "${WALLETPWD2}" ]
    then
    echo "The input passwords are not matched";
    exit 1;
    fi
    fi
    if [ ${CONNECT} = "A" ] ; then
    echo " "
    printf "Please enter DB connect string: "
    read CONNECT
    fi
    if [ ${ODSPWD} = "A" ] ; then
    printf "Please enter ODS password: "
    stty -echo ; read ODSPWD ; stty echo ; echo
    fi
    ## password is required
    if [ "${ODSPWD}" = "" ]
    then
    echo "ODS password is required";
    exit 1;
    fi
    if [ ${ODSPWD2} = "A" ] ; then
    printf "Please enter confirmed ODS password: "
    stty -echo ; read ODSPWD2 ; stty echo ; echo
    fi
    if [ "${ODSPWD}" != "${ODSPWD2}" ]
    then
    echo "The input passwords are not matched";
    exit 1;
    fi
    if [ "${CONNECT}" = "" ]
    then
    CMDNAME="$ORACLE_HOME/bin/sqlplus -s ods/${ODSPWD} "
    else
    CMDNAME="$ORACLE_HOME/bin/sqlplus -s ods/${ODSPWD}@${CONNECT} "
    fi
    # Check if ODS password and connect string is correct
    ${ORACLE_HOME}/bin/sqlplus -L ods/${ODSPWD}@${CONNECT} << END 1>/dev/null 2>/dev/null
    exit;
    END
    if [ $? -ne 0 ]; then
    echo "Incorrect connect string or ODS password specified"
    exit 1;
    fi
    if [ ${OIDHOST} = "A" ] ; then
    echo " "
    printf "Please enter OID host name: "
    read OIDHOST
    fi
    ## oid host is required
    if [ "${OIDHOST}" = "" ]
    then
    echo "OID host name is required";
    exit 1;
    fi
    if [ ${OIDPORT} = "1" ] ; then
    printf "Please enter OID port number [389]: "
    read OIDPORT
    if [ "${OIDPORT}" = "" ]
    then
    OIDPORT="389"
    fi
    fi
    # Check if OID host and port is correct
    ${ORACLE_HOME}/bin/ldapbind -h ${OIDHOST} -p ${OIDPORT} 1>/dev/null 2>/dev/null
    if [ $? -ne 0 ]; then
    echo "Incorrect OID host or port specified"
    exit 1;
    fi
    if [ ${ORCLADMINPWD} = "A" ] ; then
    printf "Please enter orcladmin password: "
    stty -echo ; read ORCLADMINPWD ; stty echo ; echo
    fi
    if [ "${ORCLADMINPWD}" = "" ]
    then
    echo "orcladmin password is required";
    exit 1;
    fi
    if [ ${ORCLADMINPWD2} = "A" ] ; then
    printf "Please enter confirmed orcladmin password: "
    stty -echo ; read ORCLADMINPWD2 ; stty echo ; echo
    fi
    if [ "${ORCLADMINPWD}" != "${ORCLADMINPWD2}" ]
    then
    echo "The input passwords are not matched";
    exit 1;
    fi
    # Check if orcladmin password is correct
    ${ORACLE_HOME}/bin/ldapbind -h ${OIDHOST} -p ${OIDPORT} -D 'cn=orcladmin' -w ${ORCLADMINPWD} 1>/dev/null 2>/dev/null
    if [ $? -ne 0 ]; then
    echo "Incorrect orcladmin password specified"
    exit 1;
    fi
    echo " "
    if [ ${SCUSB} = "A" ] ; then
    printf "Please enter the subscriber common user search base [orclcommonusersearchbase]: "
    read SCUSB
    if [ "${SCUSB}" = "" ]
    then
    SCUSB=`${ORACLE_HOME}/bin/ldapsearch -h ${OIDHOST} -p ${OIDPORT} -D 'cn=orcladmin' -w ${ORCLADMINPWD} -s base -b 'cn=common,cn=products,cn=oraclecontext' -L 'objectclass=*' orclcommonusersearchbase | head -2 | grep -v 'dn:' | awk '{printf $2}'`
    fi
    fi
    if [ ${PRGDN} = "A" ] ; then
    printf "Please enter the Plug-in Request Group DN: "
    read PRGDN
    fi
    if [ ${EP} = "A" ] ; then
    printf "Please enter the exception entry property [(!(objectclass=orcladuser))]: "
    read EP
    if [ "${EP}" = "" ]
    then
    EP='(!(objectclass=orcladuser))'
    fi
    fi
    echo " "
    printf "Do you want to setup the backup Active Directory for failover? (y/n) "
    read ISFAILOVER
    if [ "${ISFAILOVER}" = "y" ]
    then
    if [ ${SECADHOST} = "A" ] ; then
    printf "Please enter the backup Active Directory host name: "
    read SECADHOST
    if [ "${SECADHOST}" = "" ]
    then
    echo "Backup Active Directory host name is required";
    exit 1;
    fi
    fi
    printf "Do you want to use SSL to connect to the backup Active Directory? (y/n) "
    read ISFAILOVERSSL
    if [ "${ISFAILOVERSSL}" = "n" ]
    then
    if [ ${SECADPORT} = "1" ] ; then
    printf "Please enter the backup Active Directory port number [389]: "
    read SECADPORT
    if [ "${SECADPORT}" = "" ]
    then
    SECADPORT="389"
    fi
    fi
    fi
    if [ "${ISFAILOVERSSL}" = "y" ]
    then
    if [ ${SECADSSLPORT} = "1" ] ; then
    printf "Please enter the backup Active Directory SSL port number [636]: "
    read SECADSSLPORT
    if [ "${SECADSSLPORT}" = "" ]
    then
    SECADSSLPORT="636"
    fi
    fi
    if [ ${SECWALLETLOC} = "A" ] ; then
    echo " "
    printf "Please enter Oracle wallet location: "
    read SECWALLETLOC
    fi
    ## wallet location is required
    if [ "${SECWALLETLOC}" = "" ]
    then
    echo "Oracle wallet location is required";
    exit 1;
    fi
    if [ ${SECWALLETPWD} = "A" ] ; then
    printf "Please enter Oracle wallet password: "
    stty -echo ; read SECWALLETPWD ; stty echo ; echo
    fi
    if [ "${SECWALLETPWD}" = "" ]
    then
    echo "Oracle wallet password is required";
    exit 1;
    fi
    if [ ${SECWALLETPWD2} = "A" ] ; then
    printf "Please enter confirmed Oracle wallet password: "
    stty -echo ; read SECWALLETPWD2 ; stty echo ; echo
    fi
         if [ "${SECWALLETPWD}" != "${SECWALLETPWD2}" ]
         then
         echo "The input passwords are not matched";
         exit 1;
         fi
    fi
    fi
    # install the plug-in PL/SQL packages
    echo " "
    echo "Installing Plug-in Packages ..."
    echo " "
    # install plug-in debug tool
    cp $ORACLE_HOME/ldap/admin/oidspdsu.pls $LDAP_LOG
    chmod +w $LDAP_LOG/oidspdsu.pls
    echo "EXIT;" >> $LDAP_LOG/oidspdsu.pls
    ${CMDNAME} @$LDAP_LOG/oidspdsu.pls
    rm $LDAP_LOG/oidspdsu.pls
    ${CMDNAME} @$ORACLE_HOME/ldap/admin/oidspdof.pls
    # install plug-in packages
    ${CMDNAME} @$ORACLE_HOME/ldap/admin/oidspad2.pls ${ISSSL} ${ADHOST} ${ADPORT} ${ADHOST} ${ADPORT} ${ADHOST} ${ADSSLPORT} ${WALLETLOC} ${WALLETPWD} ${ADHOST} ${ADSSLPORT} ${WALLETLOC} ${WALLETPWD} ${ISFAILOVER} ${ISFAILOVERSSL} ${SECADHOST} ${SECADPORT} ${SECADHOST} ${SECADPORT} ${SECADHOST} ${SECADSSLPORT} ${SECWALLETLOC} ${SECWALLETPWD} ${SECADHOST} ${SECADSSLPORT} ${SECWALLETLOC} ${SECWALLETPWD} ${ISSSL} ${ADHOST} ${ADPORT} ${ADHOST} ${ADPORT} ${ADHOST} ${ADSSLPORT} ${WALLETLOC} ${WALLETPWD} ${ADHOST} ${ADSSLPORT} ${WALLETLOC} ${WALLETPWD} ${ISFAILOVER} ${ISFAILOVERSSL} ${SECADHOST} ${SECADPORT} ${SECADHOST} ${SECADPORT} ${SECADHOST} ${SECADSSLPORT} ${SECWALLETLOC} ${SECWALLETPWD} ${SECADHOST} ${SECADSSLPORT} ${SECWALLETLOC} ${SECWALLETPWD} 2>&1 ; stty echo ; echo
    #stty -echo; eval ${CMDNAME} @$ORACLE_HOME/ldap/admin/oidspad2.pls ${ISSSL} ${ADHOST} ${ADPORT} ${ADHOST} ${ADPORT} ${ADHOST} ${ADSSLPORT} ${WALLETLOC} ${WALLETPWD} ${ADHOST} ${ADSSLPORT} ${WALLETLOC} ${WALLETPWD} ${ISFAILOVER} ${ISFAILOVERSSL} ${SECADHOST} ${SECADPORT} ${SECADHOST} ${SECADPORT} ${SECADHOST} ${SECADSSLPORT} ${SECWALLETLOC} ${SECWALLETPWD} ${SECADHOST} ${SECADSSLPORT} ${SECWALLETLOC} ${SECWALLETPWD} ${ISSSL} ${ADHOST} ${ADPORT} ${ADHOST} ${ADPORT} ${ADHOST} ${ADSSLPORT} ${WALLETLOC} ${WALLETPWD} ${ADHOST} ${ADSSLPORT} ${WALLETLOC} ${WALLETPWD} ${ISFAILOVER} ${ISFAILOVERSSL} ${SECADHOST} ${SECADPORT} ${SECADHOST} ${SECADPORT} ${SECADHOST} ${SECADSSLPORT} ${SECWALLETLOC} ${SECWALLETPWD} ${SECADHOST} ${SECADSSLPORT} ${SECWALLETLOC} ${SECWALLETPWD} 2>&1 ; stty echo ; echo
    # usessl, adhost, adport, adhost, adsslport, walletloc, walletpwd
    # isfailover, isfailoverssl, sechost, secport, sechost, secsslport
    # secwalletloc, secwalletpwd
    # usessl, adhost, adport, adhost, adsslport, walletloc, walletpwd
    # isfailover, isfailoverssl, sechost, secport, sechost, secsslport
    # secwalletloc, secwalletpwd
    # register the plug-ins
    echo " "
    echo "Registering Plug-ins ..."
    echo " "
    $ORACLE_HOME/bin/ldapadd -h ${OIDHOST} -p ${OIDPORT} -D cn=orcladmin -w ${ORCLADMINPWD} << EOF
    dn: cn=adwhencompare2,cn=plugin,cn=subconfigsubentry
    objectclass:orclPluginConfig
    objectclass:top
    orclpluginname:OIDADPSW2
    orclplugintype:operational
    orclplugintiming:when
    orclpluginldapoperation:ldapcompare
    orclpluginenable:1
    orclpluginversion:1.0.1
    orclPluginIsReplace:1
    cn:adwhencompare2
    orclpluginsubscriberdnlist:${SCUSB}
    orclpluginattributelist:userpassword
    orclpluginrequestgroup:${PRGDN}
    orclpluginentryproperties:${EP}
    dn: cn=adwhenbind2,cn=plugin,cn=subconfigsubentry
    objectclass:orclPluginConfig
    objectclass:top
    orclpluginname:OIDADPSW2
    orclplugintype:operational
    orclplugintiming:when
    orclpluginldapoperation:ldapbind
    orclpluginenable:1
    orclpluginversion:1.0.1
    orclPluginIsReplace:1
    cn:adwhenbind2
    orclpluginsubscriberdnlist:${SCUSB}
    orclpluginrequestgroup:${PRGDN}
    orclpluginentryproperties:${EP}
    EOF
    cat <<DONE
    Done.
    DONE

    Hi,
    This is a problem that is not made clear in the note. What is probably happening here is that both plugins are being fired when a user logs in. OID will only read the value returned from the final plugin to fire. This can be a problem if the user authenticates correctly against the first plug-in but fails on the second. This is entirely legitimate as this note tells you to configure this way but the OID only observes the final result. The note doesn't tell us this.
    Here's an example:
    We've two OID User users in different containers: cn=Al is in container cn=usersA,dc=oracle,dc=com and cn=BOB is in container cn=usersB,dc=oracle,dc=com.
    We have two plugins: pluginA and PluginB. Installed in that order.
    When Al logs in the two plugins fire. pluginA finds Al and returns a true, but then pluginB fires and returns a false undoing the good result. OID only accepts the final answer and so rejects the user. When Bob logins in both plugins fire again but it's the second plugin that returns the answer again. This is true and bob gets in.
    There's a couple of ways around this and one of the more effective ways is to associate the plugin with the dn. So in our example, we associate the pluginA to fire only for the dn cn=usersA,dc=oracle,dc=com and pluginB only to fire when a user is in cn=usersB,dc=oracle,dc=com. This gets around the problem of mulitple plugins firing and giving conflicting answers as the appropriate plugin only fires once.
    I've used this solution in a realtime environment when connecting and provisioning multiple ADs into one OID and found it to be extremely effective.
    Another solution is to associate the plugins with groups.
    Both of these options may be configured easily by modifying the plugin properties in ODM. Don't forget to restart OID after you've made the changes.
    HTH!
    Phil.
    If

  • SMB access for Active Directory users

    Hi there,
    My server is an OD Master bound to AD for authentication and my institution's Kerberos realm.
    When I try to share files from the server via SMB and connect as an Active Directory user I get the following error in the logs:
    [2009/06/11 12:02:27, 1, pid=5308] /SourceCache/samba/samba-187.8/samba/source/libads/kerberosverify.c:ads_verifyticket(428)
    adsverifyticket: smbkrb5_parse_name(myserver$) failed (Configuration file does not specify default realm)
    [2009/06/11 12:02:27, 1, pid=5308] /SourceCache/samba/samba-187.8/samba/source/smbd/sesssetup.c:replyspnegokerberos(340)
    Failed to verify incoming ticket with error NTSTATUS_LOGONFAILURE!
    I've read something vague about having to Kerberize the SMB service seperately so I'm not sure if that's the problem.
    My smb.conf file is as follows:
    ; Configuration file for the Samba software suite.
    ; ============================================================================
    ; For the format of this file and comprehensive descriptions of all the
    ; configuration option, please refer to the man page for smb.conf(5).
    ; The following configuration should suit most systems for basic usage and
    ; initial testing. It gives all clients access to their home directories and
    ; allows access to all printers specified in /etc/printcap.
    ; BEGIN required configuration
    ; Parameters inside the required configuration block should not be altered.
    ; They may be changed at any time by upgrades or other automated processes.
    ; Site-specific customizations will only be preserved if they are done
    ; outside this block. If you choose to make customizations, it is your
    ; own responsibility to verify that they work correctly with the supported
    ; configuration tools.
    [global]
    debug pid = yes
    log level = 1
    server string = Mac OS X
    printcap name = cups
    printing = cups
    encrypt passwords = yes
    use spnego = yes
    passdb backend = odsam
    idmap domains = default
    idmap config default: default = yes
    idmap config default: backend = odsam
    idmap alloc backend = odsam
    idmap negative cache time = 5
    map to guest = Bad User
    guest account = nobody
    unix charset = UTF-8-MAC
    display charset = UTF-8-MAC
    dos charset = 437
    vfs objects = darwinacl,darwin_streams
    ; Don't become a master browser unless absolutely necessary.
    os level = 2
    domain master = no
    ; For performance reasons, set the transmit buffer size
    ; to the maximum and enable sendfile support.
    max xmit = 131072
    use sendfile = yes
    ; The darwin_streams module gives us named streams support.
    stream support = yes
    ea support = yes
    ; Enable locking coherency with AFP.
    darwin_streams:brlm = yes
    ; Core files are invariably disabled system-wide, but attempting to
    ; dump core will trigger a crash report, so we still want to try.
    enable core files = yes
    ; Configure usershares for use by the synchronize-shares tool.
    usershare max shares = 1000
    usershare path = /var/samba/shares
    usershare owner only = no
    usershare allow guests = yes
    usershare allow full config = yes
    ; Filter inaccessible shares from the browse list.
    com.apple:filter shares by access = yes
    ; Check in with PAM to enforce SACL access policy.
    obey pam restrictions = yes
    ; Don't be trying to enforce ACLs in userspace.
    acl check permissions = no
    ; Make sure that we resolve unqualified names as NetBIOS before DNS.
    name resolve order = lmhosts wins bcast host
    ; Pull in system-wide preference settings. These are managed by
    ; synchronize-preferences tool.
    include = /var/db/smb.conf
    [printers]
    comment = All Printers
    path = /tmp
    printable = yes
    guest ok = no
    create mode = 0700
    writeable = no
    browseable = no
    ; Site-specific parameters can be added below this comment.
    ; END required configuration.
    Any help would be much appreciated!!
    Thanks.

    I am now having the same problem - a Windows server trying to access a file share on the Mac Server is presented with the same error message in the log files:
    [2009/06/29 21:34:56, 2, pid=485] /SourceCache/samba/samba-187.8/samba/source/smbd/sesssetup.c:setupnew_vcsession(1260)
    setupnew_vcsession: New VC == 0, if NT4.x compatible we would close all old resources.
    [2009/06/29 21:34:56, 1, pid=485] /SourceCache/samba/samba-187.8/samba/source/libads/kerberosverify.c:ads_verifyticket(428)
    adsverifyticket: smbkrb5_parsename(vifile$) failed (Configuration file does not specify default realm)
    [2009/06/29 21:34:56, 1, pid=485] /SourceCache/samba/samba-187.8/samba/source/smbd/sesssetup.c:replyspnegokerberos(340)
    Failed to verify incoming ticket with error NTSTATUS_LOGONFAILURE!
    Workgroup manager can read from Active Directory - seems to be jiving correctly - my server (SMB) is in Domain Member mode...
    When I try to access system from \\UNC command, I am presented with username/password prompt and nothing works.
    Not feeling the Mac OS X love tonight.
    Bill
    System is bound to active directory - green light in Directory Utility

Maybe you are looking for

  • How can I produce two outputs of the same project

    Dear Sir, My aim is to produce two outputs of the same master project, HTML help and Webhelp each one will be used differently in my compnay. Producing two outputs is fine but the problem was that external links are done differently for HTML help and

  • Can connect w/ PPPoE... but not route

    Ok.. I've been working on this off an on for over a month and I have reached my end, I think. Problem: I have a Linksys WRT54GL v1.1. My ISP (through cable, not DSL) requires a PPPoE connection. I can get the Router to successfully connect to the ISP

  • MBP 15-inch, Late 2008 - Windows 7 black screen

    Specs first: MacBook Pro 15-inch, Late 2008 OS X 10.8.3 (12D78) Boot ROM Version:          MBP51.007E.B06 Want to install: Windows 7 x64 Ultimate (disc) I needed to format my windows partition because whenever I wanted to boot with bootcamp the scree

  • Unicode in ABAP-Mapping (u00E9 becomes u00C3u00A9)

    Hello all, I implemented this guide to create a flatfile from an IDoc. It works fine, but some characters are not mapped correctly: an "é" for example becomes "é" and an "ú" becomes "ú". Is this a Unicode problem or something? If yes, how can I use

  • Alignment problem in Email Attachment

    Hi, I am sending error reports of BDC thru email as attachment in Notepad format. The records are not aligning properly coming as a paragraph, I need to display the errors in separate rows. Is there any way that i can align all error records to come