Problem 6002 (OBJ_CLASS_VIOLATION) Provisioning to Microsoft Lightweight Directory Services( ADAM )

pkumar22 · March 21, 2024, 12:24am

Hi,

While provisioning to LDAP, I am getting the error message below. I tried sending the objectclass below, but I still get the same error. Any idea?

top
person
organizationalPerson
userProxyFull

sailpoint. connector.ConnectorException: [LDAP: error code 65 - 000020B4: UpdErr: DSID-03051467, problem 6002 (OBJ_CLASS_VIOLATION), data 0 ]

Thanks,

pkumar22 · March 21, 2024, 8:07pm

The application team said that I need to send all the objectClass, and I am sending multiple values in create profile like below, but it is still getting the same error,

Is it the correct way to send multiple values?

{
        "attributes": {
          "cloudRequired": "true"
        },
        "isRequired": false,
        "multi": true,
        "name": "objectClass",
        "transform": {
          "attributes": {
            "value": "userProxyFull, top, person, organizationalPerson"
          },
          "type": "static"
        },
        "type": "string"
      }

pkumar22 · March 22, 2024, 7:01pm

I did add multiple values to the create profile, and the error below is showing. Any idea please.

https://community.sailpoint.com/t5/IdentityNow-Articles/Best-Practices-Provisioning-Multi-Valued-Attributes/ta-p/153748

sailpoint.connector.ConnectorException: [LDAP: error code 16 - 00000057: LdapErr: DSID-0C0911AD, comment: Error in attribute conversion operation, data 0, v3839]

sailpoint.connector.ConnectorException: [LDAP: error code 16 - 00000057: LdapErr: DSID-0C0911AD, comment: Error in attribute conversion operation, data 0, v3839

Sachin_Rajathadri · March 22, 2024, 7:40pm

Hi @pkumar22,

I can think of 2 things,

Check the schema documentation or schema browser for your LDAP directory to ensure that the “userProxyFull” object class is defined and supported. Also, makes sure the SailPoint connector for your LDAP directory is correctly configured with the appropriate schema mappings and object class settings.
Based on the object classes you provided (userProxyFull , top , person , organizationalPerson ), a common order or the best practices would be: top, person, organizationalPerson, userProxyFull. This order places the abstract top object class first, followed by the other abstract object classes (person , organizationalPerson ), and then the structural or custom object class (userProxyFull ) last.

Hope this helps!

brennenscott · March 22, 2024, 8:01pm

Hey @pkumar22, you are missing the cloudDelimiter attribute. This may be what you need:

{
  "attributes": {
    "cloudDelimiter": ","
  },
  "isRequired": false,
  "multi": true,
  "name": "objectClass",
  "transform": {
    "attributes": {
      "value": "userProxyFull,top,person,organizationalPerson"
    },
    "type": "static"
  },
  "type": "string"
}

pkumar22 · March 25, 2024, 12:23pm

@Sachin_Rajathadri @brennenscott

I added cloudDelimiter and all the attributes into the schema and provisioning basic info, but I’m still getting the same issue.

Below is the search DN and Filter

brennenscott · March 25, 2024, 5:38pm

Hey @pkumar22, will you try this next? Instead of using the multi value, I changed it to the attribute of isMultiValued.

{
  "attributes": {
    "cloudDelimiter": ","
  },
  "isRequired": false,
  "isMultiValued": true,
  "name": "objectClass",
  "transform": {
    "attributes": {
      "value": "top,person,organizationalPerson,userProxyFull"
    },
    "type": "static"
  },
  "type": "string"
}

I also reordered the object classes in the correct order as provided by @Sachin_Rajathadri.

If this works for you, let me know. I can then take that information and work to determine why this attribute works while multi does not. I believe multi was changed to isMultiValued but documentation needs to be updated to reflect that.

pkumar22 · March 25, 2024, 7:40pm

Still, the same error and below plan and log.

“Provisioning plan in return : <?xml version='1.0' encoding='UTF-8'?>\n\n<ProvisioningPlan nativeIdentity="801998">\n <AccountRequest application="ADLDS [source]" nativeIdentity="CN=torkflte,CN=TestUsers,DC=lthlds" op="Create">\n <AttributeRequest name="memberOf" op="Add" value="CN=Readers,CN=Roles,DC=lthlds"/>\n <AttributeRequest name="objectSid" op="Add" value="S-1-5-21-515967899-1060284298-682003330-5042650"/>\n <AttributeRequest name="objectguid" op="Add" value="{6c6eebd2-e3df-4291-965f-e1dbeb7895be}"/>\n <AttributeRequest name="Class" op="Add" value="userProxyFull"/>\n <AttributeRequest name="objectclass" op="Add" value="top,person,organizationalPerson,userProxyFull"/>\n <AttributeRequest name="uid" op="Add" value="torkflte"/>\n <ProvisioningResult status="failed">\n \n <Message key="sailpoint.connector.ConnectorException: [LDAP: error code 16 - 00000057: LdapErr: DSID-0C0911AD, comment: Error in attribute conversion operation, data 0, v3839]" type="Error"/>\n </Errors>\n </ProvisioningResult>\n </AccountRequest>\n \n \n <entry key="accessRequestType" value="GRANT_ACCESS"/>\n <entry key="identityRequestId" value="6234a7fbfb9f4b40998902dd9cec3fb9"/>\n <entry key="requester" value="Prasantha.Kumar"/>\n <entry key="source" value="LCM"/>\n </Map>\n </Attributes>\n <ProvisioningResult status="failed">\n \n <Message key="sailpoint.connector.ConnectorException: [LDAP: error code 16 - 00000057: LdapErr: DSID-0C0911AD, comment: Error in attribute conversion operation, data 0, v3839]" type="Error"/>\n </Errors>\n </ProvisioningResult>\n</ProvisioningPlan>\n”,

Log

{“exception”:{“stacktrace”:“sailpoint.connector.ConnectorException: [LDAP: error code 16 - 00000057: LdapErr: DSID-0C0911AD, comment: Error in attribute conversion operation, data 0, v3839\u0000]\n\tat sailpoint.connector.LDAPConnector.exceptionBucketing(LDAPConnector.java:3061)\n\tat sailpoint.connector.LDAPConnector.create(LDAPConnector.java:9995)\n\tat sailpoint.connector.LDAPConnector.provision(LDAPConnector.java:9219)\n\tat sailpoint.connector.ConnectorProxy.provision(ConnectorProxy.java:1206)\n\tat com.sailpoint.ccg.cloud.container.Container.provision(Container.java:326)\n\tat com.sailpoint.ccg.cloud.container.ContainerIntegration.provision(ContainerIntegration.java:156)\n\tat com.sailpoint.ccg.handler.ProvisionHandler.invoke(ProvisionHandler.java:190)\n\tat sailpoint.gateway.accessiq.CcgPipelineMessageHandler.handleMessage_aroundBody0(CcgPipelineMessageHandler.java:47)\n\tat sailpoint.gateway.accessiq.CcgPipelineMessageHandler$AjcClosure1.run(CcgPipelineMessageHandler.java:1)\n\tat org.aspectj.runtime.reflect.JoinPointImpl.proceed(JoinPointImpl.java:167)\n\tat com.sailpoint.tracing.otel.TracedAspect.lambda$traceExecution$0(TracedAspect.java:30)\n\tat com.sailpoint.tracing.otel.GlobalTracer.trace(GlobalTracer.java:158)\n\tat com.sailpoint.tracing.otel.GlobalTracer.trace(GlobalTracer.java:137)\n\tat com.sailpoint.tracing.otel.GlobalTracer.trace(GlobalTracer.java:125)\n\tat com.sailpoint.tracing.otel.TracedAspect.traceExecution(TracedAspect.java:32)\n\tat sailpoint.gateway.accessiq.CcgPipelineMessageHandler.handleMessage(CcgPipelineMessageHandler.java:36)\n\tat com.sailpoint.pipeline.server.PipelineServer$InboundQueueListener$MessageHandler.run(PipelineServer.java:369)\n\tat java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515)\n\tat java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)\n\tat java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)\n\tat java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)\n\tat java.base/java.lang.Thread.run(Thread.java:829)\nCaused by: javax.naming.directory.NoSuchAttributeException: [LDAP: error code 16 - 00000057: LdapErr: DSID-0C0911AD, comment: Error in attribute conversion operation, data 0, v3839\u0000]; remaining name ‘CN=torkflte,CN=TestUsers,DC=lthlds’\n\tat java.naming/com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3280)\n\tat java.naming/com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:3205)\n\tat java.naming/com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2996)\n\tat java.naming/com.sun.jndi.ldap.LdapCtx.c_bind(LdapCtx.java:452)\n\tat java.naming/com.sun.jndi.toolkit.ctx.ComponentDirContext.p_bind(ComponentDirContext.java:299)\n\tat java.naming/com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.bind(PartialCompositeDirContext.java:217)\n\tat java.naming/com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.bind(PartialCompositeDirContext.java:206)\n\tat java.naming/javax.naming.directory.InitialDirContext.bind(InitialDirContext.java:177)\n\tat sailpoint.connector.LDAPConnector.create(LDAPConnector.java:9760)\n\t… 20 more\n”,“exception_class”:“sailpoint.connector.ConnectorException”,“exception_message”:“[LDAP: error code 16 - 00000057: LdapErr: DSID-0C0911AD, comment: Error in attribute conversion operation, data 0, v3839\u0000]”},“stack”:“ccg”,“pod”:“stg07-useast1”,“connector-logging”:“150”,“Operation”:“Create”,“clusterId”:“391”,“buildNumber”:“955”,“apiUsername”:“dfc0e4a3-4789-4bcc-9784-e82ca690d25a”,“ObjectType”:“account”,“orgType”:“”,“file”:“LDAPConnector.java”,“encryption”:“1266”,“messageType”:“provision”,“connector-bundle-identityiq”:“212”,“line_number”:10000,“@version”:1,“CB_version”:“533”,“cloud-modules-api”:“1477”,“logger_name”:“sailpoint.connector.LDAPConnector”,“mantis-client”:“1400”,“class”:“sailpoint.connector.LDAPConnector”,“ParentOperation”:“ProvisioningOperation”,“atlas-api”:“1823”,“va-gateway-client”:“46”,“tracing”:“1400”,“clientId”:“dfc0e4a3-4789-4bcc-9784-e82ca690d25a”,“request_milliseconds”:“5435”,“source_host”:“c54774fea093”,“method”:“create”,“org”:“uch-sb”,“level”:“ERROR”,“IdentityIQ”:“8.3p4 Build 1527a593753-20230805-223436”,“message”:“372744221 Failed to create object [CN=torkflte,CN=TestUsers,DC=lthlds]: [LDAP: error code 16 - 00000057: LdapErr: DSID-0C0911AD, comment: Error in attribute conversion operation, data 0, v3839\u0000]”,“pipeline”:“1266”,“@timestamp”:“2024-03-25T19:25:34.540Z”,“NativeIdentity”:“801998”,“thread_name”:“pool-6-thread-1”,“atlas-util”:“1823”,“metrics”:“1266”,“region”:“u-1”,“AppType”:“ADAM - Direct”,“Application”:“ADLDS [source]”,}

brennenscott · March 25, 2024, 7:48pm

This looks like an incorrect DN. I think you need to correct this to CN=torkflte,OU=TestUsers,DC=lthlds (where the TestUsers is OU= instead of CN=).

<AttributeRequest name="memberOf" op="Add" value="CN=Readers,CN=Roles,DC=lthlds"/>

Same thing with this. It looks like you are not defining the OU and instead are using CN. It (probably) should be:

CN=Readers,OU=Roles,DC=lthlds

pkumar22 · March 25, 2024, 8:32pm

We are using Microsoft Lightweight Directory Services as the connector, and the DN format is correct. The test user is created from the target system and aggregated into sailpoint, and the format is CN only and all the existing users are in CN.

system · May 24, 2024, 8:33pm

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Getting error while provisioning into ADLDS ISC Discussion and Questions identity-security-cloud	6	45	October 21, 2024
Provisioning IN LDAP - Getting LDAP error code 65 ISC Discussion and Questions identity-security-cloud , provisioning	6	1183	January 28, 2024
Issue with Before Provisioning Rule and ObjectNotFoundException during User Leaver Process ISC Discussion and Questions identity-security-cloud , provisioning	30	610	July 23, 2024
Object Class violation error in LDAP provisioning! ISC Discussion and Questions rules , identity-security-cloud , provisioning	4	205	June 16, 2024
LDAP: error code 65 atribute not allowed ISC Discussion and Questions identity-security-cloud	3	624	April 7, 2024

Problem 6002 (OBJ_CLASS_VIOLATION) Provisioning to Microsoft Lightweight Directory Services( ADAM )

Related topics