I can't create, modify and disabled accounts on AD

Hello developers.

I have an Active Directory integration that has been working flawlessly for several years until recently when the client made changes to their infrastructure. Now, we’re getting this error on all create, delete, and modify events:

Error(s) reported back from the IQService - Error occurred while disabling the account CN=Amanda Ross,OU=Operations,OU=GSP,DC=customerDomain,DC=com. An operations error occurred. 000004DC: LdapErr: DSID-0C091212, comment: In order to perform this operation, a successful bind must be completed on the connection., data 0, v4f7c HRESULT: [0x80072020]

The only operations that execute correctly are a Test Connection and Aggregation tasks. The client reports that the user communicating with has Full Admin permissions.

Regarding LDAP ports (389, 636, 3268, and 3269), communication is established on all of them. The IQService is installed on the same server as the IIQ on port 5050, with which communication is established.

The authentication used is simple, without TLS enabled.

What else can I check or what tests can I run?

@jacob_islas

Please refer the URL below:

@jacob_islas

Let me know if you are still receving this error ?

how can i move a user from one OU to another OU through before provisioning and provisioning policy. i created Active OU and Disable OU..

Hi @Rameshv,

You can use the default Rapid Setup leaver configuration. When a user is disabled, you can specify the OU, and the account will be moved accordingly

Hi @Rameshv ,

You can add the following AttributeRequest to your provisioningPlan in the before provisioning rule if the operation is disable.

AttributeRequest attrReq  = new AttributeRequest("AC_NewParent", ProvisioningPlan.Operation.Set,"OU=DisabledUsers,DC=example,DC=com")); //Give Disabled OU Path);

@jacob_islas This issue seems to be with IQService. Could you please check if the service account used is still binding to the right AD environment? As you have mentioned TLS is not enabled, it should work with 389 port.

@Rameshv Current post is having a different issue than you posted. Would recommend starting a new thread instead of continuing discussing here.

What kind of infrastructure changes are done?

Are they mandating TLS now? asking since your read is working (test/aggregation) but write is failing (modify, create etc).

Please explain about provisioning plan. where should i start it. i have copied code. but that’s not working well. please any one assist me through from scratch it would be useful for me.

@Rameshv I would recommend starting a new thread for your issue/requirement. Also, you might want to go over the community posts and training videos to understand more about the tool and its componets. That’'ll greatly help you. For now, please go over this: https://community.sailpoint.com/t5/IdentityIQ-Forum/Provisioning-Plan/m-p/61632

For any new queries, please start a new thread.

@Neelmahadev, i got error. what is the reason behind it. how can i resolve the issue.