Active Directory Integration over LDAP - dm_ldapsychronization runs but no import of user/groups

MaRaa

Hi everyone, I am facing another problem.

I try to import user and groups from Active directory to the documentum repository.

I think the configuration of the first two tabs can´t be the problem.

Here is my mapping for the ldap object:

Here is the log of the job, no error. Is there a hint for the issue?

LDAPSynchronization Report For DocBase favdev As Of 2014/12/03 15:18:25

2014-12-03 16:18:25:12 CET [http-0.0.0.0-9080-2]: LDAP Synchronization Started @ Wed Dec 03 16:18:25 CET 2014

2014-12-03 16:18:25:12 CET [http-0.0.0.0-9080-2]:

2014-12-03 16:18:25:12 CET [http-0.0.0.0-9080-2]: Preparing LDAP Synchronization...

2014-12-03 16:18:25:43 CET [http-0.0.0.0-9080-2]: INFO: Job Status: [LDAP Synchronization Started @ Wed Dec 03 16:18:25 CET 2014]

2014-12-03 16:18:25:59 CET [http-0.0.0.0-9080-2]: INFO: Job Status updated

2014-12-03 16:18:25:168 CET [http-0.0.0.0-9080-2]: INFO: List of Ldap Configs chosen for Synchronization

2014-12-03 16:18:25:168 CET [http-0.0.0.0-9080-2]: INFO: >>>080249f080007139 - Company<<<

2014-12-03 16:18:25:168 CET [http-0.0.0.0-9080-2]: INFO:

2014-12-03 16:18:25:168 CET [http-0.0.0.0-9080-2]:

2014-12-03 16:18:25:168 CET [http-0.0.0.0-9080-2]: ==================================================================================

2014-12-03 16:18:25:168 CET [http-0.0.0.0-9080-2]: Starting Sychronization for ldap config object >>>company<<< ...

2014-12-03 16:18:25:184 CET [http-0.0.0.0-9080-2]: INFO: Directory Type: Microsoft's Active Directory Server ...

2014-12-03 16:18:25:184 CET [http-0.0.0.0-9080-2]: INFO: Ldap Connection: non-SSL connection

2014-12-03 16:18:25:199 CET [http-0.0.0.0-9080-2]: INFO: Default Query Policy DN: [CN=Default Query Policy,CN=Query-Policies,CN=Directory Service,CN=Windows NT,CN=Services, CN=Configuration,DC=company,DC=com]

2014-12-03 16:18:25:199 CET [http-0.0.0.0-9080-2]: INFO: Last Change No: [16522]

2014-12-03 16:18:25:199 CET [http-0.0.0.0-9080-2]: INFO: Delete Change Log Name: [cn=Deleted Objects,DC=company,DC=com]

2014-12-03 16:18:25:199 CET [http-0.0.0.0-9080-2]: Starting the user synchronization...

2014-12-03 16:18:25:199 CET [http-0.0.0.0-9080-2]: ====================================================================

2014-12-03 16:18:25:199 CET [http-0.0.0.0-9080-2]: INFO: User Search Base is: [ou=leadership,ou=User,dc=company,dc=com]

2014-12-03 16:18:25:199 CET [http-0.0.0.0-9080-2]: INFO: User Search Filter is: [(&(objectclass=inetOrgPerson)(|(modifyTimestamp>=20141203151555.0Z)(createTimestamp>=20141203151555.0Z))(cn=*))]

2014-12-03 16:18:25:199 CET [http-0.0.0.0-9080-2]: "UserSync-DirectoryPinger for company" thread started...

2014-12-03 16:18:25:199 CET [http-0.0.0.0-9080-2]: Processing Deactivated Users...

2014-12-03 16:18:25:215 CET [http-0.0.0.0-9080-2]: Finished processing Deactivated Users

2014-12-03 16:18:25:215 CET [http-0.0.0.0-9080-2]: LDAP User Cache max_capacity=30000: current_size=0

2014-12-03 16:18:25:215 CET [http-0.0.0.0-9080-2]: LDAP Group Cache max_capacity=10000: current_size=0

2014-12-03 16:18:25:215 CET [http-0.0.0.0-9080-2]: User synchronization finished.

2014-12-03 16:18:25:215 CET [http-0.0.0.0-9080-2]:

2014-12-03 16:18:25:215 CET [http-0.0.0.0-9080-2]: Starting the group synchronization...

2014-12-03 16:18:25:215 CET [http-0.0.0.0-9080-2]: ====================================================================

2014-12-03 16:18:25:215 CET [http-0.0.0.0-9080-2]: INFO: Group Search Base is: [ou=groups,dc=company,dc=com]

2014-12-03 16:18:25:215 CET [http-0.0.0.0-9080-2]: INFO: Group Search Filter is: [(&(objectclass=group)(|(modifyTimestamp>=20141203151555.0Z)(createTimestamp>=20141203151555.0Z))(cn=*))]

2014-12-03 16:18:25:215 CET [http-0.0.0.0-9080-2]: LDAP User Cache max_capacity=30000: current_size=0

2014-12-03 16:18:25:215 CET [http-0.0.0.0-9080-2]: LDAP Group Cache max_capacity=10000: current_size=0

2014-12-03 16:18:25:215 CET [http-0.0.0.0-9080-2]: Group synchronization finished.

2014-12-03 16:18:25:215 CET [http-0.0.0.0-9080-2]:

2014-12-03 16:18:25:215 CET [http-0.0.0.0-9080-2]: INFO: Updating Last Run Time: [20141203151825.0Z]

2014-12-03 16:18:25:215 CET [http-0.0.0.0-9080-2]: INFO: Updating Last Change No: [16522]

2014-12-03 16:18:25:215 CET [http-0.0.0.0-9080-2]: INFO: Ldap Config Object >>>>company<<<< updated

2014-12-03 16:18:25:215 CET [http-0.0.0.0-9080-2]: Disconnected from LDAP Server successfully.

2014-12-03 16:18:25:215 CET [http-0.0.0.0-9080-2]: Synchronization of ldap config object >>>company<<< is finished

2014-12-03 16:18:25:215 CET [http-0.0.0.0-9080-2]: ==================================================================================

2014-12-03 16:18:25:215 CET [http-0.0.0.0-9080-2]:

2014-12-03 16:18:25:231 CET [http-0.0.0.0-9080-2]: INFO: Job Status: [dm_LDAPSynchronization Tool Completed at 2014/12/03 15:18:25. Total duration was 0 minutes.]

2014-12-03 16:18:25:231 CET [http-0.0.0.0-9080-2]: INFO: Job Status updated

2014-12-03 16:18:25:231 CET [http-0.0.0.0-9080-2]: LDAP Synchronization Ended @ Wed Dec 03 16:18:25 CET 2014

2014-12-03 16:18:25:231 CET [http-0.0.0.0-9080-2]: Session released successfully

Report End 2014/12/03 15:18:25

If anybody could clarify how the mapping works, would help me a lot. How do you use the search base and the search base filter the right way?

Cheers!

Find more posts tagged with

Comments

AshishSrivastava

Seems you have mentioned two ou. Try with one first say ou=people, dc=company,dc=com

Also you can try with syncing one user first instead of all by specifying his cn

You need to understand the structure of AD scheme to select the filters. You can use ldap browser open source tool to see it by connecting using same credentials as specified in ldap config object

Let me know for additional questions if any

Thanks

Kind Regards,

Ashish Srivastava

MaRaa

Hi Ashish Srivastava, thanks for your reply.

It was helpfull to use a ldap browser tool to understand the problem a bit more. This way I found the source of the problem: I used InetOrgPerson and GroupOfUniqueNames. When I changed these values to user and group the synchronization was succesfull for the first time. I am not sure if this is a problem specific to my enviroment or if InetOrgPerson is not a attruibute for a User in Microsoft Active Directory.

Right now my issue is to log in to Documentum with the synchronized Accounts. The authentication fails. If anyone has any about that would be great but it is not too urgent.

Best!

AshishSrivastava

Good to know that the original problem is resolved and users are being imported. You can mark the thread as correct so that other may get help from the solution

Can you open a separate thread with the new issue of authentication. Authentication issues can happen due to a wide set of cause depending upon your environment. Post the dump of the user, provide details if you are using single sign on etc or not and if user is logging using Webtop/Customized Webtop and I will take a look

Kind Regards,

Ashish Srivastava