Webcenter dicussion forum - Ldap Group Integration issue

Hi All,
I am trying to implement LDAP Group integration in our jive forums 5.1.0 installed in an Oracle IAS 10.1.3.2 server.
I have followed the steps mentioned in the LDAP documentation and setup the following system properties:
ldap.groupNameField cn
ldap.groupMemberField uniquemember
ldap.groupDescriptionField description
ldap.groupSearchFilter (cn={0})
I just restarted the server after setting up these , but the forums instance is not coming up in the server. Throwing the following error:
08/01/21 14:52:33.550 jiveforums: http://CompressingFilter/1.4.4 CompressingFilter has initialized
08/01/21 15:23:04.597 jiveforums: Servlet error
java.io.IOException: An established connection was aborted by the software in your host machine
at sun.nio.ch.SocketDispatcher.write0(Native Method)
at sun.nio.ch.SocketDispatcher.write(SocketDispatcher.java:33)
at sun.nio.ch.IOUtil.writeFromNativeBuffer(IOUtil.java:104)
at sun.nio.ch.IOUtil.write(IOUtil.java:75)
at sun.nio.ch.SocketChannelImpl.write(SocketChannelImpl.java:302)
at java.nio.channels.Channels.write(Channels.java:60)
at java.nio.channels.Channels.access$000(Channels.java:47)
at java.nio.channels.Channels$1.write(Channels.java:134)
at com.evermind.server.http.AJPOutputStream.endRequest(AJPOutputStream.java:117)
at com.evermind.server.http.AJPRequestHandler.run(AJPRequestHandler.java:309)
at com.evermind.server.http.AJPRequestHandler.run(AJPRequestHandler.java:190)
at oracle.oc4j.network.ServerSocketReadHandler$SafeRunnable.run(ServerSocketReadHandler.java:260)
at com.evermind.util.ReleasableResourcePooledExecutor$MyWorker.run(ReleasableResourcePooledExecutor.java:303)
at java.lang.Thread.run(Thread.java:595)
08/01/21 15:25:59.956 jiveforums: Exception thrown during contextDestroyed
java.lang.ExceptionInInitializerError
at com.jivesoftware.forum.database.DbForumFactory.getAttachmentManager(DbForumFactory.java:798)
at com.jivesoftware.forum.database.DbForumFactory.destroy(DbForumFactory.java:410)
at com.jivesoftware.forum.database.DbForumFactory.shutdown(DbForumFactory.java:381)
at com.jivesoftware.forum.util.ForumsLifeCycleListener.contextDestroyed(ForumsLifeCycleListener.java:88)
at com.evermind.server.http.HttpApplication.destroyContextListeners(HttpApplication.java:5877)
at com.evermind.server.http.HttpApplication.destroy(HttpApplication.java:5843)
at com.evermind.server.http.HttpSite.destroy(HttpSite.java:877)
at com.evermind.server.http.HttpServer.destroy(HttpServer.java:548)
at com.evermind.server.ApplicationServer.destroy(ApplicationServer.java:2030)
at com.evermind.server.ApplicationServerShutdownHandler.run(ApplicationServerShutdownHandler.java:93)
at java.lang.Thread.run(Thread.java:595)
Caused by: java.lang.IllegalStateException: Timer already cancelled.
at java.util.Timer.sched(Timer.java:354)
at java.util.Timer.scheduleAtFixedRate(Timer.java:296)
at com.jivesoftware.util.TaskEngine.scheduleTask(TaskEngine.java:218)
at com.jivesoftware.util.TaskEngine.scheduleTask(TaskEngine.java:202)
at com.jivesoftware.forum.database.DbAttachmentManager.<init>(DbAttachmentManager.java:160)
at com.jivesoftware.forum.database.DbAttachmentManager.<clinit>(DbAttachmentManager.java:48)
Can anyone please throw a light?
Thanks and regards,
ABhijit

Hi Guneet,
We are using jive 5.5.9 instead of 5.1.0 that comes with webcenter.
Also we are just trying to validate the JIve's authorization scheme so didn't integrate the Java SSO part. Jive forum is just a standalone OC4J instance in the IAS server and we are using the LDAP configuration in the User,Groups Authentication page instead or default which is required for Java SSO.
Thanks,
ABhijit

Similar Messages

Webcenter dicussion forum - Ldap Group Integration with JSSO

Hi,
We want to implement LDAP Group integration for the authorization purposes in
webcenter Jive Disucussions deployed in our IAS 10.1.3.2 application server.
Though jive provides support for the same, yet the JIve documentation says
that we need to implement the JIve's LDAP User authentication steps in order
to leverage LDAP Groups integration. In case of Webcenter if we use Java SSO
for the authentication purpose, we need opt for the 'Default' in the Jive
Admin's authentication page instead of LDAP settings. Opting for 'Default'
scheme doesn't allow us to configure the LDAP group settings. We are not able
find any documentation for LDAP Group Integration along with Java SSO. Could
provide us the steps required for the same? Or has anyone tried the same?
Thanks and Regards,
ABhijit

Hi Abhijit,
You can ignore 'Default', and implement your own user authentication mechanism, which can include LDAP group settings. You will have to follow:
- OC4J security documentation for using Java SSO in your own implementation (I think this is the right link - confirm the version numbers - http://download.oracle.com/docs/cd/B32110_01/web.1013/b28957/javasso.htm#BABEJFDI)
- Jive documentation for implementing user authentication
Navneet.

OIM OES Integration to use LDAP groups for policy making

Hi ,
I am trying to make policy for the OIM application using OES. i want to use my LDAP groups as principals to control the access in OIM. How it can be achieved
Thanks
Edited by: user10660448 on May 21, 2013 1:35 AM

Note that you can use the internal LDAP that comes with WebLogic, for your users and groups if you want.
When you have multiple domains, you have a problem with this set-up as the internal LDAP is coupled to
a specific domain. This means that users you created in one domain are not visible in the other. When using
a separate LDAP that contains the users. You can configure in each domain an authenticator that points
to the LDAP. In this way you can share to user accross multiple domains.
When you are planning to use one domain you can stick with the internal LDAP if you want.
An example set-up (that uses access manager not identity manager) can be found here: http://middlewaremagic.com/weblogic/?p=7819,
which might help you in how to proceed.

Can an email address be a member of an LDAP group even if it isn't associated with an object in the Directory Server?

Can an email address be a member of an LDAP group even if it isn't
associated with an object in the Directory Server?
<P>
General members of a group are the members defined in the
Directory Server. They are full-fledged members of the group who
may have a set of permissions associated with their membership,
a title, or other attributes. Mail-specific users are users who
are not full-fledged members of the group, but who receive mail
sent to the group. Mail-specific users need not be identified as
a user in the Directory Server--an email address is sufficient.
An example of this is a group of salespeople, all of whom are in
the group "North American Sales Team." They have access to a
sales-tracking database, on-line quota information, and
competitive information. The mail-specific users of this group
are the admins who support the members of the sales team, who need
to get the mail that goes out to the group, but don't need access
to the applications and information that the salespeople do.

Hey EllyK,
Welcome to the BlackBerry Support Community Forums.
Thanks for the question.
I would suggest performing this workaround and then try to login to BlackBerry Link:
Open BlackBerry World on the BlackBerry smartphone and sign in using the BlackBerry ID.
Connect the BlackBerry 10 smartphone to the computer.
Open BlackBerry Link
Sign in using the BlackBerry ID.
Let me know if the issue still persists.
Cheers.
-ViciousFerret
Come follow your BlackBerry Technical Team on Twitter! @BlackBerryHelp
Be sure to click Like! for those who have helped you.
Click Accept as Solution for posts that have solved your issue(s)!

Portal Roles added to the LDAP group is not showing up for users

Hello expert,
I have implemented SSO for Enterprise Portal and MS LDAP. It is working fine but when I assigned roles to the LDAP group instead of UME group, they are not taking effect when I refresh the browser. My service account that I set up in the keytab file is a read only account for the LDAP. Is there some permission issue that I have to do to be able to add Portal roles or groups to LDAP groups?

Hi,
By default the LDAP integration configuration file is readonly.
In this case, is not possible to modify data in LDAP.
You must to connect in read-write mode; and I think that, furthermore, you need to configure SSL between Portal and LDAP in order to use read-write mode.
regards,

Retrieve nested LDAP groups independent from the network env. (five different approaches)

Hi all,
I want to retrieve a list of nested LDAP groups per user from the Active Directory. I have been searching google for half a day now, but I'm still not sure what approach to use. I have the following requirements:
* The script/program must run in different network environments (I can't be sure if there is a global catelog or AD DS or AD LDS, etc). I will write my own program.
* The membership info will be used in combination with directory ACL's and must be as complete as possible (global groups, universal groups, local groups, perhaps different domains). Distribution groups are not really necessary, because they are not used in
the directory ACL's.
* It would be nice to support other LDAP implementations than Active Directory using the same code, but that not a hard requirement. I could use another approach to support a different LDAP.
Now I have figured out five possible approaches (info comes from different sites, please correct me if I'm wrong):
1) tokengroups attribute:
- The attribute contains Univeral groups of the forest, global groups from the local domain, domain local groups from the local domain (assuming native mode) and local groups from the local machine.
- Returns a list of SIDs which will have to be translated to group names
- The tokenGroups attribute exists on both AD DS and AD LDS
- For AD DS, the tokenGroups attribute is not present if no GC server is available to evaluate the transitive reverse memberships.
- quote from site "Now that I have had a chance to test it though I can definitely say that tokenGroups WILL get the Universal groups from the other domains even if is NOT a GC. I just did it in my test lab."
- Token Groups cannot be retrieved if no Global Catalog is present to retrieve the transitive reverse memberships.
2) tokenGroupsGlobalAndUniversal
- A subset of the tokenGroups attribute. Only the global and universal group SIDs are included.
- If you want consistent results, read tokenGroupsGlobalAndUniversal that will return the same result no matter which DC you are connected to. However, it will not include local groups.
- other source says "tokenGroups will give you all the security groups this user belongs to, including nested groups and domain users, users, etc tokenGroupsGlobalAndUniversal will include everything from tokenGroups AND distribution groups". Not
sure if this is correct, I think it doesn't contain local groups.
- The tokenGroupsGlobalAndUniversal attribute exists on AD DS but not on AD LDS.
3) LDAP_MATCHING_RULE_IN_CHAIN / 1.2.840.113556.1.4.1941
- Use a recursive search query which returns all nested groups for user at once.
- Returns all groups except for the primary group
- It's a fast approach, see performance test from Richard Mueller:
http://social.technet.microsoft.com/Forums/fr-FR/f238d2b0-a1d7-48e8-8a60-542e7ccfa2e8/recursive-retrieval-of-all-ad-group-memberships-of-a-user?forum=ITCG
- It only works on Active Directory, not for other LDAP implementations
4) Recursive retrieval of the memberOf attribute
- Retrieves all groups except the primary group. (also local groups from other domains??)
- works for all LDAP implementations
- executes a lot of queries to the LDAP, especially if you want to scan all users/groups (perhaps limited on OU, but still)
5) Store memberOf attribute in local database and calculate the nested groups using recursive queries to the local database
- No heavy load to the LDAP
- Needs space to store the user/group info locally (embedded Derby database perhaps)
- Performs fast since the queries are executed locally
- Works for all LDAP implementations
My thoughts on these different approaches:
* appreach 1) I understand that the tokengroups attribute is not present if no GC server is available. In how many network environments is this the case? This option won't work because I want to support different network environments.
* approach 2) The tokenGroupsGlobalAndUniversal attribute exists on AD DS but not on AD LDS. Same here, in how many network environments is this the case? I don't think I can rely on this approach.
* approach 3) Seems to be a good option. How will it perform compared to approach 5 (local recursive queries)? Won't work for other LDAP implementations
* approach 4) I don't think I want to execute that many queries to the LDAP. I can limit the scan on OU, but still companies can have thousands of users and groups.
* approach 5) Perhaps the best approach. I want to store user/group info locally for fast filtering / reporting (only group DNs, user names, databse id's and membership info as id-id pairs). I only need the memberOf attribute of users and groups, recursive
loops are done locally. It will work for all LDAP implementations.
What do you guys think? I'm not a network admin, but a programmer, so I'm no expert in network setups and when to use AD DS or AD LDS. The thing is I want to use this code at different customers without knowing their network setup (except for the domain name(s),
LDAP host/port and bind user to connect to LDAP).
Thanks a lot!
Paul

I want to write a tool that can answer questions like "what users from group ABC have delete permission in all the (sub)directories of server MyDataServer?". This results in a list of directories and users and includes nested group membership. So it's about
effective permissions. That's why I want all information in a SQL database so I can answer these questions with a single query in milliseconds. Otherwise, in order to answer these questions, I would have to get all members from group ABC and determine the
nested groups for all these members (which can be thousands) for every report. Using a SQL database I can retrieve this information once a night for all the members.
But I guess I will use the LDAP_MATCHING_RULE_IN_CHAIN syntax which gives me all nested groups for a member and should work for all AD installations from W2K3 SP2 and higher. When I want to support other LDAPs I will use another method for that specific
LDAP.
Again - note that this question has nothing to do with LDAP or AD. It just asks what group has permissions on what resources.
I really think you would do well to spend time understanding the NTFS and its security along with how we sue security in Windows. By assuming this has something to do with AD you are making it a bigger issue than needed. AD is a repository for
accounts and trusts and manages authentication and security group membership. All file security is managed by the OS that hosts the files and not by AD. Users are not normally granted access to resources through direct inclusion in the DACL but
are given access through membership in one or more groups. Loading AD into a SQLL database will not help you.
¯\_(ツ)_/¯

Reports 6i and WeBDB 2.2 Integration Issues

1. I have installed reports6i andintegrated with WebDB 2.2 by running the fo
llo
wingScripts:
oracle_home\report60\server\security\rwwwvins.sql webdb and
\oracle_home\report60\server\security\rwenable.sql
as described in the webdb& reports6i integration issues document in oracle r
epo
rts6i beta site.
Afterinstalling, when i logged to webdb as webdb user, i was able to see sev
er
access and rdf access options in webdb 2.2
However, when i log as an userwhere i have created forms components i am una
ble
to access the abovecomponents. (there is no documentation on what privileg
es
needs to be providedto the user., however i had given grants to following ro
les
withRW_ADMINISTRATOR, RW_POWER_USER, RW_DEVELOPER AND RW_BASIC_USer
null

Hi Matt,
You didn't mention but do you also wish to install the database(8i) on the same machine ?
I am also trying to install all these products(+8i and designer 6i) on the same box but I am concerned more about the min. resources needed before I get started.(I put up a question about it on the 6i Forum, but nobody has answered yet !)
The correct install order should be Forms/Reports 6i then Forms/Reports 6i Server and then WebDb 2.2.
Forms /reports server needs a http listener and installs en configures the WebDb listener for the job.(you are prompted for this during tho have the install process).This is handy if you are intending to use WebDb anyway. When you install Webdb it detects the already installed WebDb listener and does not reinstall.
You do have the SYS password on the database you will use to stored the WDK and WebDb schema.
About installing the demo.....
I dont' think there are any special issues.I have never done it.
If you are intending to install an 8i database on the same box there are some important things to consider with respect to the install order and what products in which Oracle home must be installed.
1.Forms/Reports first in the default_oracle
home.
2.Then Oracle 8i in a 2nd oracle home call
it ora81 for example.
3.Then WebDb in the non oracle 8i home !!
This is just a quick summary.
If you run into any problems let me know
Good Luck.
Dave.

FI-SD integration issue Error in account determination: table T030K key NECA EXD Message no. FF709

Dear expert.
Thank you for adding me at your professinal network Linkedin. I am getting some issue related to FI-SD integration.
IT's coming while releasing billing document in Tcode VF02.
Error in account determination: table T030K key XXXX EXD
Message no. FF709
I look into Tcode VKOA- Acct determination for Cust Grp Mat Grp for sales organization for EXD, OB40 - EXD AcctKey, V/08- checked procedure Zneac.
And also maintained the taxcode in Vk11.
But i am not able to understand the issue.
Please reply with valuable suggestion.
Thanks in advance.
Regards Mani.
manibhushanchoubey8 at the rate gmail dot com

Hi
Please check below links
Error in account determination:T030K
Msg no.FF709 Error in account determination: table T030K key INT VS1 I0
Note: Please search in the forum before posting the issue
Thanks
Dasaradha

Grouping Display Issue

Post Author: alex.belt
CA Forum: General
I'm fairly new to Crystal Reports, but after searching around the less than helpful help documentation, the net and this forum, I haven't found an answer to my issue. I have a report with multiple groups. Using the Report Options, I've select the Show All Headers On Drill Down. My problem is this: CR's default behavior after selecting one of the groups is to display only the header for that group, plus the grouped information below it, removing the other group headers at the level I just came from. Although I am looking at another group's data, I would still like the other group headers to display as well, like Lotus Notes does with its categories. It's hard to put into words, so I'll illustrate below.What I want to see when I click Group 1: Group 1 Group 1.1 Group 1.2 ...Group 2Group 3...Am I overlooking a setting somewhere that will do this? I am currently using CR XI on Win XP Pro.Thanks in advance,Alex

Post Author: alex.belt
CA Forum: General
No, the issue is this: if I choose to expand group 1, it shows me the header for group1, plus the entries contained under group one, but any other groups at the same level as group 1 are removed from display, they are no longer available for selection. I still want to see the group headers for group 1's siblings even if I expand group 1 to see the entries underneath it.

Mapping LDAP Groups to SAP Roles

Hi there,
i am trying to build up a synchron usermanagement with a LDAP-Server between EP, Web AS Java and Web AS ABAP.
My thought is to administrate the users in the LDAP-Directory. The users will be assigned to groups.
In EP and Web AS Java its no problem to assign these groups to roles and then just change the Users in the LDAP-Group and reach a synchron usermanagement.
In Web AS ABAP it seems impossible to assign roles to groups.
<b>The question is, is it possible to map ldap groups with the ldap connector of the web AS ABAP to Roles in an ABAP System?</b>
Or is there another way to administrate users in different systems?
Thanks alot for your answers,
stefan

Hi
in this case u have to use the concept of central user administration. use the following links
https://www.sdn.sap.com/irj/servlet/prt/portal/prtroot/com.sap.km.cm.docs/library/events/asug-biti-03/cua with sap webas, ldap and third party software
https://www.sdn.sap.com/irj/servlet/prt/portal/prtroot/com.sap.km.cm.docs/library/events/sap-teched-04/user management and authorizations overview.pdf
https://www.sdn.sap.com/irj/servlet/prt/portal/prtroot/com.sap.km.cm.docs/library/nw/dotnet/integration of sap central user administration into microsoft active directory.pdf
hope this helps u to get fair bit of idea
don,t forget to give points
With regards
subrato kundu

LDAP Groups Authorization

Hi,
I have read some of the forum threads about LDAP Group Authorization - I remain confused. Here's the problem I am trying to solve.
I was successfull in setting my Authentication to "Based on authentication scheme from gallery:Existing Login Page: Use LDAP Directory Credentials" -
That works fine, But I would not like all users in my OID LDAP directory to log into my application- Which is why I have created a group for the user I want to include in my OID directory.
Now at the " Builder->Application...->Security->Authorization Schemes->
I have created an Authorization Scheme as "PL/SQL Function returing a booloean" .
My Scheme Source(Identify Query or PL/SQL) is as follows and is set to "once Per session"
return wwv_flow_ldap.is_member
(:APP_USER,
null,
'cn=users,dc=wellesley,dc=edu',
'jadeland.wellesley.edu',
'389',
'wcd_HTMLDB',
'cn=portal.040323.1220,cn=Groups, dc=wellesley,dc=edu');
where in my LDAP directory, 'wcd_HTMLDB' is the subgroup under group "portal.040323.1220" -
I have included 3 users in the group 'wcd_HTMLDB' .
Still the login page allows all LDAP user ( and not just the 3 from the 'wcd_HTMLDB' group.
Where did I go wrong -?
What 's the proper way to authorise only LDAP users in a group ?
Any help would be really appreciated.
Thanks .

Indira,
The public synonym (and grant execute) must be created after that package is compiled which can happen after catldap is run in your database. This is only a problem if catldap has not been run before HTML DB is installed. That's described in the flows/doc/ldap.html file in the distribution directory (not very prominently, we know).
When you initially attached the authorization scheme to your login page and it wouldn't let you in, the reason is that it was using the value of APP_USER to drive your lookup function. But when the login page is rendered, APP_USER is null because you haven't logged in yet. So a user-based authorization scheme on a login page can never work.
When you changed the ldap username edit function the way you did, you achieved the goal of preventing an unauthorized user from using the login page to authenticate. Looks like the way it's set up is to give unauthorized users an authentication error, which is a little misleading (saying their credentials are invalid when in fact they are valid but they aren't authorized to use your application), but if it suits your purpose, great. You should consider that if you change the authentication method to, say Single Sign-On, you'll then want to use authorization schemes to keep unauthorized users out. So the authorization scheme that you first set about using would be fine in that case, so long as you adjust the code to allow for visits to public pages prior to authentication (v('APP_USER') = 'HTMLDB_PUBLIC_USER'). However, you'd want to attach that scheme to the application itself (Edit Application Attributes->Authorization) so it fires on every page. Evaluating a scheme like that on every page view rather that once per session probably works best, even better if you cache the result of the evaluation yourself for performance reasons, e.g., set an application item to some value the first time the authenticated user passes the ldap membership test, then using that item as an 'already passed' flag for subsequent invocations.
Finally, I assume you are using the built-in ldap_dnprep function because you need to replace '.' with '_' in the username value entered by the user. If that is not your requirement, let's talk.
Scott

Cannot Add user to CMC Group when they are a member of LDAP group

On PreProduction Server CMC
Softerra LDAP browser used to verify user is a member of LDAP group
User does not show as a member of that group in the CMC
Cannot add user to LDAP group showing in CMC, the same group shows the member in LDAP browser
On Production Server CMC
For kicks I logged into the CMC on Production and I found the user is correctly showing as a member of the Group
Why doesn't the groups in CMC show what is actually showing in the LDAP browser?

Hi,
Check if you have also mapped in both servers the same groups. It might be that there are some groups missing in the Pre-prod.
Also, try restarting the CMS. I have seen similar issues that are solved after forcing the recreation of the graph.
If after the restart you still can't see the groups, check the mapping on the LDAP server. It might be that both servers do not use the same attribute mappings.
Regards,
Julian

Wireless Deployment with Active Directory User Group Integration

I am trying to find out the best practice in deploying a WLAN for users in the cooperate environment, which uses their company active directory integrated laptops to join to the WLAN.
I know this can be done using certificates easily but I want to just find a way to deploy this without certificates and only based on the AD user group. Maybe a Radius server + LDAP server integration solution would be great.
Please advice. Thanks.
Cheers
Lal Antony
www.lalantony.com

The easiest way to deply this is with a Microsoft toolkit, it has everything you need included, manuals, scripts to install and configure server-side components and it's very easy to use. You can get it from here:
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=60c5d0a1-9820-480e-aa38-63485eca8b9b&displaylang=en
It's based on Win2003 server but I've been advised by MS that it should be OK on Win2008 as well.

Loading LDAP groups into WLS JAAS Subject

Hi,
I have a 10.1.4.3 OAM webgate+OHS setup to protect weblogic 10.3.2 as described ('1st best option') in this blog below.
http://fusionsecurity.blogspot.com/2010/01/integrating-oracle-access-manager-oam.html
In the weblogic security realm, I have the OAM Identity Asserter (REQUIRED), OID Authentication Provider (SUFFICIENT), Default Authenticator (SUFFICIENT), Default Identity Asserter configured in that order.
A simple JSP app with CLIENT-CERT is deployed to the WLS. After the user is authenticated at OHS Webgate, the OAM Identity asserter is correctly asserting the user (and the obSSOCookie) as can be seen from the logs. The JSP app is getting a valid (non-anoymous) JAAS Subject with a single JAAS principal (of the user).
But I 'm not sure it is loading the LDAP groups correctly using the OID provider. Are the LDAP groups supposed to be loaded as principals into the JAAS Subject? The user is part of many LDAP groups but only one principal (user itself) is in the JAAS Subject. Are there any additional steps to 'pair' the OAM Identity Asserter with the OID authentication provider as described in the above blog?
I 'm using weblogic.security.Security.getCurrentSubject() to get the Subject and subject.getPrincipals() to get the principals in the JSP app.
Thanks.

Like I said in my post, subject.getPrincipals() has only one entry, the user id. The LDAP groups aren't in the Set returned. I 'm wondering how to debug this or fix it. I 'm wondering if I need to re-associate the domain policy store with LDAP as described here before the LDAP groups will be loaded into the subject.
http://download.oracle.com/docs/cd/E14571_01/core.1111/e10043/cfgauthr.htm#CHDIIJDB

Cannot import LDAP group through Import Wizard.

Hello,
We have a issue where we are unable to import Ldap group if we use cluster name while logging into Import Wizard.
we are able to import the LDAP users/groups if we use the primary CMS name while logging into Import Wizard
Is this a known issue in XI R2 SP 3 or are we missing out something?
Please help!!!
Thanks...

I'm really surprised the import wizard even works with a clustername. Considering it's design is to migrate from 1 CMS to another it should require a CMS name and not a clustername. I don't think using clusternames was ever part of its design. It's even more bizarre that a clustername would conflict with LDAP. SP3 had several other LDAP bugs that are fixed in SP4 but other than that I'm not sure. What's the issue with using just 1 CMS name. This should be desirable so you can control which CMS gets the added load from the IW, otherwise it would just randomly select one.
Regards,
Tim

Webcenter dicussion forum - Ldap Group Integration issue

Similar Messages

Maybe you are looking for