Problem 6002 (OBJ_CLASS_VIOLATION) Provisioning to Microsoft Lightweight Directory Services( ADAM )

pkumar22 · March 21, 2024, 12:24am

Hi,

While provisioning to LDAP, I am getting the error message below. I tried sending the objectclass below, but I still get the same error. Any idea?

top
person
organizationalPerson
userProxyFull

sailpoint. connector.ConnectorException: [LDAP: error code 65 - 000020B4: UpdErr: DSID-03051467, problem 6002 (OBJ_CLASS_VIOLATION), data 0 ]

Thanks,

pkumar22 · March 21, 2024, 8:07pm

The application team said that I need to send all the objectClass, and I am sending multiple values in create profile like below, but it is still getting the same error,

Is it the correct way to send multiple values?

{
        "attributes": {
          "cloudRequired": "true"
        },
        "isRequired": false,
        "multi": true,
        "name": "objectClass",
        "transform": {
          "attributes": {
            "value": "userProxyFull, top, person, organizationalPerson"
          },
          "type": "static"
        },
        "type": "string"
      }

pkumar22 · March 22, 2024, 7:01pm

I did add multiple values to the create profile, and the error below is showing. Any idea please.

https://community.sailpoint.com/t5/IdentityNow-Articles/Best-Practices-Provisioning-Multi-Valued-Attributes/ta-p/153748

sailpoint.connector.ConnectorException: [LDAP: error code 16 - 00000057: LdapErr: DSID-0C0911AD, comment: Error in attribute conversion operation, data 0, v3839]

sailpoint.connector.ConnectorException: [LDAP: error code 16 - 00000057: LdapErr: DSID-0C0911AD, comment: Error in attribute conversion operation, data 0, v3839

Sachin_Rajathadri · March 22, 2024, 7:40pm

Hi @pkumar22,

I can think of 2 things,

Check the schema documentation or schema browser for your LDAP directory to ensure that the “userProxyFull” object class is defined and supported. Also, makes sure the SailPoint connector for your LDAP directory is correctly configured with the appropriate schema mappings and object class settings.
Based on the object classes you provided (userProxyFull , top , person , organizationalPerson ), a common order or the best practices would be: top, person, organizationalPerson, userProxyFull. This order places the abstract top object class first, followed by the other abstract object classes (person , organizationalPerson ), and then the structural or custom object class (userProxyFull ) last.

Hope this helps!

brennenscott · March 22, 2024, 8:01pm

Hey @pkumar22, you are missing the cloudDelimiter attribute. This may be what you need:

{
  "attributes": {
    "cloudDelimiter": ","
  },
  "isRequired": false,
  "multi": true,
  "name": "objectClass",
  "transform": {
    "attributes": {
      "value": "userProxyFull,top,person,organizationalPerson"
    },
    "type": "static"
  },
  "type": "string"
}

pkumar22 · March 25, 2024, 12:23pm

@Sachin_Rajathadri @brennenscott

I added cloudDelimiter and all the attributes into the schema and provisioning basic info, but I’m still getting the same issue.

Below is the search DN and Filter

brennenscott · March 25, 2024, 5:38pm

Hey @pkumar22, will you try this next? Instead of using the multi value, I changed it to the attribute of isMultiValued.

{
  "attributes": {
    "cloudDelimiter": ","
  },
  "isRequired": false,
  "isMultiValued": true,
  "name": "objectClass",
  "transform": {
    "attributes": {
      "value": "top,person,organizationalPerson,userProxyFull"
    },
    "type": "static"
  },
  "type": "string"
}

I also reordered the object classes in the correct order as provided by @Sachin_Rajathadri.

If this works for you, let me know. I can then take that information and work to determine why this attribute works while multi does not. I believe multi was changed to isMultiValued but documentation needs to be updated to reflect that.

pkumar22 · March 25, 2024, 7:40pm

Still, the same error and below plan and log.

“Provisioning plan in return : <?xml version='1.0' encoding='UTF-8'?>\n\n<ProvisioningPlan nativeIdentity="801998">\n <AccountRequest application="ADLDS [source]" nativeIdentity="CN=torkflte,CN=TestUsers,DC=lthlds" op="Create">\n <AttributeRequest name="memberOf" op="Add" value="CN=Readers,CN=Roles,DC=lthlds"/>\n <AttributeRequest name="objectSid" op="Add" value="S-1-5-21-515967899-1060284298-682003330-5042650"/>\n <AttributeRequest name="objectguid" op="Add" value="{6c6eebd2-e3df-4291-965f-e1dbeb7895be}"/>\n <AttributeRequest name="Class" op="Add" value="userProxyFull"/>\n <AttributeRequest name="objectclass" op="Add" value="top,person,organizationalPerson,userProxyFull"/>\n <AttributeRequest name="uid" op="Add" value="torkflte"/>\n <ProvisioningResult status="failed">\n \n <Message key="sailpoint.connector.ConnectorException: [LDAP: error code 16 - 00000057: LdapErr: DSID-0C0911AD, comment: Error in attribute conversion operation, data 0, v3839]" type="Error"/>\n </Errors>\n </ProvisioningResult>\n </AccountRequest>\n \n \n <entry key="accessRequestType" value="GRANT_ACCESS"/>\n <entry key="identityRequestId" value="6234a7fbfb9f4b40998902dd9cec3fb9"/>\n <entry key="requester" value="Prasantha.Kumar"/>\n <entry key="source" value="LCM"/>\n </Map>\n </Attributes>\n <ProvisioningResult status="failed">\n \n <Message key="sailpoint.connector.ConnectorException: [LDAP: error code 16 - 00000057: LdapErr: DSID-0C0911AD, comment: Error in attribute conversion operation, data 0, v3839]" type="Error"/>\n </Errors>\n </ProvisioningResult>\n</ProvisioningPlan>\n”,

Log

{“exception”:{“stacktrace”:“sailpoint.connector.ConnectorException: [LDAP: error code 16 - 00000057: LdapErr: DSID-0C0911AD, comment: Error in attribute conversion operation, data 0, v3839\u0000]\n\tat sailpoint.connector.LDAPConnector.exceptionBucketing(LDAPConnector.java:3061)\n\tat sailpoint.connector.LDAPConnector.create(LDAPConnector.java:9995)\n\tat sailpoint.connector.LDAPConnector.provision(LDAPConnector.java:9219)\n\tat sailpoint.connector.ConnectorProxy.provision(ConnectorProxy.java:1206)\n\tat com.sailpoint.ccg.cloud.container.Container.provision(Container.java:326)\n\tat com.sailpoint.ccg.cloud.container.ContainerIntegration.provision(ContainerIntegration.java:156)\n\tat com.sailpoint.ccg.handler.ProvisionHandler.invoke(ProvisionHandler.java:190)\n\tat sailpoint.gateway.accessiq.CcgPipelineMessageHandler.handleMessage_aroundBody0(CcgPipelineMessageHandler.java:47)\n\tat sailpoint.gateway.accessiq.CcgPipelineMessageHandler$AjcClosure1.run(CcgPipelineMessageHandler.java:1)\n\tat org.aspectj.runtime.reflect.JoinPointImpl.proceed(JoinPointImpl.java:167)\n\tat com.sailpoint.tracing.otel.TracedAspect.lambda$traceExecution$0(TracedAspect.java:30)\n\tat com.sailpoint.tracing.otel.GlobalTracer.trace(GlobalTracer.java:158)\n\tat com.sailpoint.tracing.otel.GlobalTracer.trace(GlobalTracer.java:137)\n\tat com.sailpoint.tracing.otel.GlobalTracer.trace(GlobalTracer.java:125)\n\tat com.sailpoint.tracing.otel.TracedAspect.traceExecution(TracedAspect.java:32)\n\tat sailpoint.gateway.accessiq.CcgPipelineMessageHandler.handleMessage(CcgPipelineMessageHandler.java:36)\n\tat com.sailpoint.pipeline.server.PipelineServer$InboundQueueListener$MessageHandler.run(PipelineServer.java:369)\n\tat java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515)\n\tat java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)\n\tat java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)\n\tat java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)\n\tat java.base/java.lang.Thread.run(Thread.java:829)\nCaused by: javax.naming.directory.NoSuchAttributeException: [LDAP: error code 16 - 00000057: LdapErr: DSID-0C0911AD, comment: Error in attribute conversion operation, data 0, v3839\u0000]; remaining name ‘CN=torkflte,CN=TestUsers,DC=lthlds’\n\tat java.naming/com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3280)\n\tat java.naming/com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:3205)\n\tat java.naming/com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2996)\n\tat java.naming/com.sun.jndi.ldap.LdapCtx.c_bind(LdapCtx.java:452)\n\tat java.naming/com.sun.jndi.toolkit.ctx.ComponentDirContext.p_bind(ComponentDirContext.java:299)\n\tat java.naming/com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.bind(PartialCompositeDirContext.java:217)\n\tat java.naming/com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.bind(PartialCompositeDirContext.java:206)\n\tat java.naming/javax.naming.directory.InitialDirContext.bind(InitialDirContext.java:177)\n\tat sailpoint.connector.LDAPConnector.create(LDAPConnector.java:9760)\n\t… 20 more\n”,“exception_class”:“sailpoint.connector.ConnectorException”,“exception_message”:“[LDAP: error code 16 - 00000057: LdapErr: DSID-0C0911AD, comment: Error in attribute conversion operation, data 0, v3839\u0000]”},“stack”:“ccg”,“pod”:“stg07-useast1”,“connector-logging”:“150”,“Operation”:“Create”,“clusterId”:“391”,“buildNumber”:“955”,“apiUsername”:“dfc0e4a3-4789-4bcc-9784-e82ca690d25a”,“ObjectType”:“account”,“orgType”:“”,“file”:“LDAPConnector.java”,“encryption”:“1266”,“messageType”:“provision”,“connector-bundle-identityiq”:“212”,“line_number”:10000,“@version”:1,“CB_version”:“533”,“cloud-modules-api”:“1477”,“logger_name”:“sailpoint.connector.LDAPConnector”,“mantis-client”:“1400”,“class”:“sailpoint.connector.LDAPConnector”,“ParentOperation”:“ProvisioningOperation”,“atlas-api”:“1823”,“va-gateway-client”:“46”,“tracing”:“1400”,“clientId”:“dfc0e4a3-4789-4bcc-9784-e82ca690d25a”,“request_milliseconds”:“5435”,“source_host”:“c54774fea093”,“method”:“create”,“org”:“uch-sb”,“level”:“ERROR”,“IdentityIQ”:“8.3p4 Build 1527a593753-20230805-223436”,“message”:“372744221 Failed to create object [CN=torkflte,CN=TestUsers,DC=lthlds]: [LDAP: error code 16 - 00000057: LdapErr: DSID-0C0911AD, comment: Error in attribute conversion operation, data 0, v3839\u0000]”,“pipeline”:“1266”,“@timestamp”:“2024-03-25T19:25:34.540Z”,“NativeIdentity”:“801998”,“thread_name”:“pool-6-thread-1”,“atlas-util”:“1823”,“metrics”:“1266”,“region”:“u-1”,“AppType”:“ADAM - Direct”,“Application”:“ADLDS [source]”,}

brennenscott · March 25, 2024, 7:48pm

This looks like an incorrect DN. I think you need to correct this to CN=torkflte,OU=TestUsers,DC=lthlds (where the TestUsers is OU= instead of CN=).

<AttributeRequest name="memberOf" op="Add" value="CN=Readers,CN=Roles,DC=lthlds"/>

Same thing with this. It looks like you are not defining the OU and instead are using CN. It (probably) should be:

CN=Readers,OU=Roles,DC=lthlds

pkumar22 · March 25, 2024, 8:32pm

We are using Microsoft Lightweight Directory Services as the connector, and the DN format is correct. The test user is created from the target system and aggregated into sailpoint, and the format is CN only and all the existing users are in CN.

Topic		Replies	Views
While onboarding an app with LDAP connector unable to get project info from LDAP IIQ Discussion and Questions webservice-connector , identityiq , roles , certifications	2	295	August 10, 2023
Issue while validating the before provisioning rule - Can't find where the exact issue is ISC Discussion and Questions rules , identity-security-cloud , provisioning	3	223	March 10, 2024
ObjectNotFoundException Provisioning failed for XXXXXXX. Entitlement ID: YYYYYYY .Response Code - 404 Error - Resource 'ZZZZZZZ' does not exist or one of its queried reference-property objects are not present IIQ Discussion and Questions	6	1087	August 12, 2023
Failed provisioning of identity in Active Directory IIQ Discussion and Questions aggregation , identityiq , provisioning	5	124	April 3, 2024
Azure Guest Sync ISC Discussion and Questions webservice-connector	3	438	July 19, 2023

Problem 6002 (OBJ_CLASS_VIOLATION) Provisioning to Microsoft Lightweight Directory Services( ADAM )

Related Topics