Adding User on LDAP via JNDI (Java) -> NoPermissionError

Question

First i want to explain what i want to do and how the code is looking:

I want to add a User via JNDI on my LDAP with JAVA, i added following code:

public void addUser(String firstName, String lastName, String number) throws NamingException {
        Properties initialProperties = new Properties();
        initialProperties.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
        initialProperties.put(Context.PROVIDER_URL, "***");
        initialProperties.put(Context.SECURITY_AUTHENTICATION, "simple");
        initialProperties.put(Context.SECURITY_PRINCIPAL, "***");
        initialProperties.put(Context.SECURITY_CREDENTIALS, "***");
        DirContext context = new InitialDirContext(initialProperties);
        
        BasicAttributes attributes = new BasicAttributes();
        Attribute attribute = new BasicAttribute("objectClass");
        attribute.add("top");
        attribute.add("person");
        attribute.add("organizationalPerson");
        attribute.add("inetOrgPerson");
        Attribute sn = new BasicAttribute("sn");
        Attribute cn = new BasicAttribute("cn");
        sn.add(lastName);
        cn.add(firstName);
        attributes.put(sn);
        attributes.put(cn);
        attributes.put(attribute);
        
        try {
            context.createSubcontext("***", attributes);
        } catch(NamingException e) {
            e.printStackTrace();
        }
    }

When i call the method i get following error:

javax.naming.NoPermissionException: [LDAP: error code 50 - 00000005: SecErr: DSID-031528D2, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0

Which makes no sense in my point of view because i created two other methods, one for getting all the users which works and one for editing a user which works too, so i have the rights to read and write a user, but when i want to create a user it says i have no permission?

Do anyone else had this problem? Is there any configuration on the Administrator user necessary on the LDAP? But the Administrator should be have all rights?

I hope anyone can help me: :)

Greetings,

Fabian.

Answer 1

so i have the rights to read and write a user, but when i want to create a user it says i have no permission

Read, write and create are 3 separate permissions. A user can have write permissions to existing objects, but not have permission to create a new object. Those permissions can be set differently on each OU.