WSO2更新AD中的用户

Question

we try to connect to active directory as secondary store, we retrieved the data from AD successfully, but when we try to update user Info from user profile we get the following Message :

when we look to log we found the follwing problem :

javax.naming.directory.NoSuchAttributeException: [LDAP: error code 16 - 00000057: LdapErr: DSID-0C090EC7, comment: Error in attribute conversion operation, data 0, v3839 ]; remaining name 'CN=mhejazi'

the secondry store config is :

<?xml version="1.0" encoding="UTF-8"?><UserStoreManager class="org.wso2.carbon.user.core.ldap.ActiveDirectoryUserStoreManager">
  <Property name="ConnectionURL">ldap://10.3.5.33:389</Property>
  <Property name="ConnectionName">CN=mhejazi,CN=Users,DC=devdc,DC=sure,DC=Com,DC=sa</Property>
  <Property encrypted="true" name="ConnectionPassword">kuv2MubUUveMyv6GeHrXr9il59ajJIqUI4eoYHcgGKf/BBFOWn96NTjJQI+wYbWjKW6r79S7L7ZzgYeWx7DlGbff5X3pBN2Gh9yV0BHP1E93QtFqR7uTWi141Tr7V7ZwScwNqJbiNoV+vyLbsqKJE7T3nP8Ih9Y6omygbcLcHzg=</Property>
  <Property name="UserSearchBase">CN=Users,DC=devdc,DC=sure,DC=com,DC=sa</Property>
  <Property name="UserEntryObjectClass">user</Property>
  <Property name="UserNameAttribute">sAMAccountName</Property>
  <Property name="UserNameSearchFilter">(&amp;(objectClass=user)(sAMAccountName=?))</Property>
  <Property name="UserNameListFilter">(objectClass=person)</Property>
  <Property name="UserDNPattern"/>
  <Property name="DisplayNameAttribute"/>
  <Property name="Disabled">false</Property>
  <Property name="ReadGroups">true</Property>
  <Property name="WriteGroups">true</Property>
  <Property name="GroupSearchBase">CN=Users,DC=devdc,DC=sure,DC=com,DC=sa</Property>
  <Property name="GroupEntryObjectClass">group</Property>
  <Property name="GroupNameAttribute">cn</Property>
  <Property name="GroupNameSearchFilter">(&amp;(objectClass=group)(cn=?))</Property>
  <Property name="GroupNameListFilter">(objectcategory=group)</Property>
  <Property name="RoleDNPattern"/>
  <Property name="MembershipAttribute">member</Property>
  <Property name="MemberOfAttribute">memberOf</Property>
  <Property name="BackLinksEnabled">true</Property>
  <Property name="Referral">follow</Property>
  <Property name="UserNameJavaRegEx">[a-zA-Z0-9._-|//]{3,30}$</Property>
  <Property name="UserNameJavaScriptRegEx">^[\S]{3,30}$</Property>
  <Property name="UsernameJavaRegExViolationErrorMsg">Username pattern policy violated.</Property>
  <Property name="PasswordJavaRegEx">^[\S]{5,30}$</Property>
  <Property name="PasswordJavaScriptRegEx">^[\S]{5,30}$</Property>
  <Property name="PasswordJavaRegExViolationErrorMsg">Password pattern policy violated.</Property>
  <Property name="RoleNameJavaRegEx">[a-zA-Z0-9._-|//]{3,30}$</Property>
  <Property name="RoleNameJavaScriptRegEx">^[\S]{3,30}$</Property>
  <Property name="SCIMEnabled">false</Property>
  <Property name="BulkImportSupported">true</Property>
  <Property name="EmptyRolesAllowed">true</Property>
  <Property name="PasswordHashMethod">PLAIN_TEXT</Property>
  <Property name="MultiAttributeSeparator">,</Property>
  <Property name="isADLDSRole">false</Property>
  <Property name="userAccountControl">512</Property>
  <Property name="MaxUserNameListLength">100</Property>
  <Property name="MaxRoleNameListLength">100</Property>
  <Property name="kdcEnabled">false</Property>
  <Property name="defaultRealmName">WSO2.ORG</Property>
  <Property name="UserRolesCacheEnabled">true</Property>
  <Property name="ConnectionPoolingEnabled">false</Property>
  <Property name="LDAPConnectionTimeout">5000</Property>
  <Property name="ReadTimeout">5000</Property>
  <Property name="RetryAttempts">0</Property>
  <Property name="CountRetrieverClass"/>
  <Property name="java.naming.ldap.attributes.binary"/>
  <Property name="DomainName">devdc.sure.com.sa</Property>
  <Property name="Description">Sue Dev&#13;
        </Property>

Answer 1

javax.naming.directory.NoSuchAttributeException: [LDAP: error code 16 - 00000057: LdapErr: DSID-0C090D50, comment: Error in attribute conversion operation, data 0, v3839

This error occurs when the claim mapping is not properly configured against the AD attributes via Claim Management UI.

You need to make sure that all the attributes mapped are valid and existing in Active Directory. Different user stores uses different attributes. In [2] you can find a reference to the set of attributes supported by active directory. The default WSO2 claims are mapped to some generic attributes, the Firstname is mapped to the nickname attribute but active directory does not have a nickname attribute. The Full Name is mapped to the cn attribute, in active directory cn has other semantic meanings.

Similarly in your claim configuration you need to make sure that all the attributes defined there are supported by Active Directory. If it is not supported you can add an additional mapped attribute in claim configuration for the local claim that is supported by AD. Sample configuration is as follows.

Refer [3] for more information regarding this.

[ 1] https://wiki.servicenow.com/index.php?title=LDAP_Error_Codes

[2] http://www.kouti.com/tables/userattributes.htm

[3] https://docs.wso2.com/display/IS540/Managing+User+Attributes