LDAP job error

Hi Experts,

we have a custom job - LDAPDisableUsersOnlyJob, that we used to sync the user status from LDAP ... if the user is disabled in LDAP, the job will disable the same in docbase.

here is code snippet of method (for above job) -

===========================================================================================

if (user_state.equals("0")&&user_login_domain.equals(ldap_name)&&(user_source.equals("LDAP"))) {

trace( "Check validity of DN for user " + user_name);

trace( " dn is : " + user_ldap_dn);

// user is activated and has a user_ldap_dn, must be verified

String search_string = user_ldap_dn.substring(0, user_ldap_dn.indexOf(","));

// added a filter to select only active users (disabled=false)

search_string ="(&("+search_string+")(disabled=false))";

trace( " search string is : " + search_string);

//ldap.setSearchString("uid="+"<uid_of_user>");

ldap.setSearchString(search_string);

ldap.traceParameters();

ArrayList result = ldap.search();

if (result==null) {

trace ("result null : LDAP cannot give result back "); }

else if (result.isEmpty()){trace("User " + user_name + " with dn " + user_ldap_dn + " does not exists in LDAP.");

trace("User " + user_name + " with dn " + user_ldap_dn + " does not exists in LDAP must be Disabled.");

IDfUser current_user = (IDfUser)session.getObject(new DfId(id));

// set user as inactive

current_user.setInt("user_state", 1);

current_user.save();

trace("User " + user_name + " with dn " + user_ldap_dn + " is now disabled.");

disabled++;

}

else {

trace("User " + user_name + " with dn " + user_ldap_dn + " is valid in LDAP.");

leave_active++;

}

else {

trace( "User " + user_name + " is already disabled or is not configured with LDAP Authentication");

}

========================================================================================

this code, we are using for all users in loop.

earlier it was working fine .... but from few days i am getting following in the log file -

========================================================================================

2016-07-15 11:04:10 CEST: search(): begin ...

2016-07-15 11:04:10 CEST: setupSSL(): begin:

2016-07-15 11:04:10 CEST: setupSSL(): setting system propery "javax.net.ssl.trustStore" to ldapCertDB=(/export/home/dmadmin/shared/java/1.6.0_27/jre/lib/security/cacerts)

2016-07-15 11:04:10 CEST: setupSSL(): setting system propery "javax.net.ssl.trustStorePassword" to ldapCertDBPassword=(*****************)

2016-07-15 11:04:10 CEST: setupSSL(): end:

2016-07-15 11:04:10 CEST: search(): LDAPConnection successfully created ...

2016-07-15 11:04:10 CEST: search(): successfully connected to LDAP server host: ldap-cad-cch.com at port: 636 ...

2016-07-15 11:04:10 CEST: error result

2016-07-15 11:04:10 CEST: netscape.ldap.LDAPException: error result (49)

at netscape.ldap.LDAPConnection.checkMsg(LDAPConnection.java:4852)

at netscape.ldap.LDAPConnection.internalBind(LDAPConnection.java:1757)

at netscape.ldap.LDAPConnection.internalBind(LDAPConnection.java:1844)

at netscape.ldap.LDAPConnection.search(LDAPConnection.java:2499)

at netscape.ldap.LDAPConnection.search(LDAPConnection.java:2402)

at LDAPSearch.search(LDAPSearch.java:295)

at LDAPDisableUsersOnlyMethod.execute(LDAPDisableUsersOnlyMethod.java:387)

at com.documentum.mthdservlet.DmMethodRunner.runIt(Unknown Source)

at com.documentum.mthdservlet.AMethodRunner.runAndReturnStatus(Unknown Source)

at com.documentum.mthdservlet.DoMethod.invokeMethod(Unknown Source)

at com.documentum.mthdservlet.DoMethod.doPost(Unknown Source)

at javax.servlet.http.HttpServlet.service(HttpServlet.java:637)

at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)

at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)

at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)

at org.jboss.web.tomcat.filters.ReplyHeaderFilter.doFilter(ReplyHeaderFilter.java:96)

at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)

at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)

at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:235)

at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)

at org.jboss.web.tomcat.security.SecurityAssociationValve.invoke(SecurityAssociationValve.java:190)

at org.jboss.web.tomcat.security.JaccContextValve.invoke(JaccContextValve.java:92)

at org.jboss.web.tomcat.security.SecurityContextEstablishmentValve.process(SecurityContextEstablishmentValve.java:126)

at org.jboss.web.tomcat.security.SecurityContextEstablishmentValve.invoke(SecurityContextEstablishmentValve.java:70)

at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)

at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)

at org.jboss.web.tomcat.service.jca.CachedConnectionValve.invoke(CachedConnectionValve.java:158)

at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)

at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:330)

at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:829)

at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:598)

at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:447)

at java.lang.Thread.run(Thread.java:662)

2016-07-15 11:04:10 CEST: search(): successfully disconnected from LDAP server ...

2016-07-15 11:04:10 CEST: result null : LDAP cannot give result back

2016-07-15 11:04:10 CEST: *************************************************************************

========================================================================================

i checked the LDAP config object, it is fine with all details and i am able to run the search from command line.

can you please help me fix this issue.

Thanks in advance!

Find more posts tagged with

Comments

Haroon_A

Isn't it how the OOTB LDAP sync job works?

Brijendra

Hi,

i think you are referring to the dm_LDAPSynchronization, this OOTB jobs do the -

• Import new users and groups in the directory server into the repository.

• Rename users in the repository if their names changed in the directory server.

• Rename groups in the repository if their names changed in the directory server.

• Inactivate users in the repository that if they were deleted from the directory server.

in my case (LDAPDisableUsersOnlyJob), the job will do the

• Inactivate users in the repository that if they were deleted from the directory server.

can you please guide me how can i fix this.

Thanks in advance!

Haroon_A

In your LDAP config object, you should have an option what to do when a user is deleted in your LDAP side.

Brijendra

Hi,

Thank you for the reply.

understood your point that we can achieve the same from Sync option from LDAP config object.

but i am looking for troubleshooting my issue.

More over if i run this sync, i guess all the users which are active in LDAP will get created in my docbase (considering unchecked the update names box and import users only) + i have another custom object type for user info (that is not derived from dm_user so not available in drop down).

i can't allow all users to be created from LDAP as we have licensing based on user count.

i know this is bad customization of the application, but it is done by earlier developers

can you please guide how can i troubleshoot my issue, actually job was running fine since 2011.

DCTM_Guru

"More over if i run this sync, i guess all the users which are active in LDAP will get created in my docbase..."

This depends on the user filter you apply. You have ability to only query against specified branch in your LDAP tree.

Haroon_A

Paste your dm_ldap_config object, so we can see the filters you applied, as Johnny stated.

You can then run a test query against your LDAP, to see the results. Obviously, you don't want to sync up your entire user accounts from LDAP to Documentum.

There are free LDAP client tools -- I use Softerra LDAP Browser -- to connect to your LDAP and test. Once you use proper filters to only return the users that you want, based on your OU, then you can use that filter in your LDAP configuration object in Documentum.

Brijendra

Thanks Johnny and Ahmad for the reply.

As suggested i have used the Softerra and found that there is no separate child node for my application

0032.JPG.jpg

Here is my dm_ldap_config

USER ATTRIBUTES

object_name : LDAP

title :

subject :

authors []: <none>

keywords []: <none>

resolution_label :

owner_name : dmadmin

owner_permit : 7

group_name : docu

group_permit : 5

world_permit : 2

log_entry :

acl_domain : dmadmin

acl_name : dm_450011f080306e69

language_code :

map_attr [0]: user_name

[1]: user_login_name

[2]: user_address

[3]: group_name

map_val [0]: cn

[1]: uid

[2]: mail

[3]: cn

map_const_attr []: <none>

map_const_val []: <none>

ldap_host : ldap-cad-cch.com

port_number : 636

person_obj_class : alstomuser

group_obj_class : alstomgroup

per_search_base : ou=people,o=alstom

grp_search_base : ou=people,o=alstom

per_search_filter : (uid=224766)

grp_search_filter : (cn=dummy_group)

bind_dn : uid=InfoSystem,ou=users,o=system

bind_pwd :

user_subtype : dm_user

map_attr_type [0]: dm_user

[1]: dm_user

[2]: dm_user

[3]: dm_group

map_val_type [0]: A

[1]: A

[2]: A

[3]: A

rename_user_option : F

deactivate_user_option : T

rename_group_option : F

import_mode : users

bind_type : bind_by_dn

use_ext_auth_prog : F

ssl_mode : 1

ssl_port : 636

certdb_location : ldapcertdb_loc

first_time_sync : F

map_rejection [0]: 2

[1]: 2

[2]: 2

[3]: 2

retry_count : 3

retry_interval : 3

failover_ldap_config_ids []: <none>

failover_use_interval : 300

SYSTEM ATTRIBUTES

r_object_type : dm_ldap_config

r_creation_date : 8/24/2012 2:26:12 PM

r_modify_date : 7/11/2016 1:27:17 PM

r_modifier : dmadmin

r_access_date : nulldate

r_composite_id []: <none>

r_composite_label []: <none>

r_component_label []: <none>

r_order_no []: <none>

r_link_cnt : 0

r_link_high_cnt : 0

r_assembled_from_id : 0000000000000000

r_frzn_assembly_cnt : 0

r_has_frzn_assembly : F

r_is_virtual_doc : 0

r_page_cnt : 0

r_content_size : 0

r_lock_owner :

r_lock_date : nulldate

r_lock_machine :

r_version_label [0]: 1.0

[1]: CURRENT

r_immutable_flag : F

r_frozen_flag : F

r_has_events : F

r_creator_name : dmadmin

r_is_public : F

r_policy_id : 0000000000000000

r_resume_state : 0

r_current_state : 0

r_alias_set_id : 0000000000000000

r_full_content_size : 0

r_aspect_name []: <none>

r_object_id : 080011f08042229a

APPLICATION ATTRIBUTES

a_application_type : netscape

a_status :

a_is_hidden : F

a_retention_date : nulldate

a_archive : F

a_compound_architecture :

a_link_resolved : F

a_content_type :

a_full_text : T

a_storage_type :

a_special_app : 6.0

a_effective_date []: <none>

a_expiration_date []: <none>

a_publish_formats []: <none>

a_effective_label []: <none>

a_effective_flag []: <none>

a_category :

a_is_template : F

a_controlling_app :

a_extended_properties []: <none>

a_is_signed : F

a_last_review_date : nulldate

a_last_run : 20150901083613Z

a_last_no :

INTERNAL ATTRIBUTES

i_is_deleted : F

i_reference_cnt : 1

i_has_folder : T

i_folder_id [0]: 0c0011f080000105

i_contents_id : 0000000000000000

i_cabinet_id : 0c0011f080000105

i_antecedent_id : 0000000000000000

i_chronicle_id : 080011f08042229a

i_latest_flag : T

i_branch_cnt : 0

i_direct_dsc : F

i_is_reference : F

i_is_replica : F

i_retain_until : nulldate

i_retainer_id []: <none>

i_vstamp : 67

DCTM_Guru

If your goal is purely to troubleshoot your custom job, then ask your AD admin to create sample OU and add/remove test users from that. This way you can isolate the user filter to that tree and troubleshoot your code.

I do agree with Ahmad that you should use the OOTB features instead of depending on old custom job. The OOTB features are supported by EMC, any kind of customization you do is your responsibility. Any changes in environment (eg Java update, LDAP upgrade, etc) can affect custom code.

Haroon_A

Assuming your person/group object classes are valid (alstonuser/alsotmgroup), then you need to add your users to the group that you specified for group search filter (dummy_group).

Currently, this will only look for one user with UID=224766.


  person_obj_class                : alstomuser
  group_obj_class                 : alstomgroup
  per_search_base                 : ou=people,o=alstom
  grp_search_base                 : ou=people,o=alstom
  per_search_filter               : (uid=224766)
  grp_search_filter               : (cn=dummy_group)
  bind_dn                         : uid=InfoSystem,ou=users,o=system

So, your person search filter should be something like this...


per_search_filter = memberOf=CN=dummy_group,<other OU, DC filters if any...>