<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>Hi Radovan,<br><br>I have tried the synchronization with these instructions. The sync still is not working, I set up my logging as you explained, and the logs that come out are like this:<br><br>2016-01-11 16:21:32,935 TRACE: method: getLatestSyncToken msg:Enter: getLatestSyncToken(ObjectClass: user)<br>2016-01-11 16:21:32,936 TRACE: method: null msg:check alive: OK<br>2016-01-11 16:21:32,936 TRACE: method: null msg:Searching DN ou=ProvSamu Users,dc=example,dc=test with (cn=__entry_like_this_is_unlikely_to_exist__), attrs: [], cookie: null<br>2016-01-11 16:21:32,943 WARN: method: null msg:No DirSync response control in search done response<br>2016-01-11 16:21:32,943 TRACE: method: getLatestSyncToken msg:Return: null<br>2016-01-11 16:21:32,946 TRACE: method: sync msg:Enter: sync(ObjectClass: user, null, com.evolveum.midpoint.provisioning.ucf.impl.ConnectorInstanceIcfImpl$1@35ce0e4c, OperationOptions: {RETURN_DEFAULT_ATTRIBUTES:true,ATTRS_TO_GET:[__PASSWORD__,__ENABLE__,createTimeStamp]})<br>2016-01-11 16:21:32,947 TRACE: method: null msg:check alive: OK<br>2016-01-11 16:21:32,947 TRACE: method: sync msg:Enter: sync(ObjectClass: user, null, org.identityconnectors.framework.impl.api.local.operations.SyncImpl$1@10d47c9c, OperationOptions: {RETURN_DEFAULT_ATTRIBUTES:true,ATTRS_TO_GET:[__PASSWORD__,__ENABLE__,createTimeStamp]})<br>2016-01-11 16:21:32,947 TRACE: method: null msg:Searching DN ou=ProvSamu Users,dc=example,dc=test with (objectClass=*), attrs: [], cookie: null<br>2016-01-11 16:21:32,992 WARN: method: null msg:No DirSync response control in search done response<br>2016-01-11 16:21:32,992 TRACE: method: null msg:Search DN ou=ProvSamu Users,dc=example,dc=test with (objectClass=*): 0 entries, 0 processed<br>2016-01-11 16:21:32,992 TRACE: method: sync msg:Return<br>2016-01-11 16:21:32,993 TRACE: method: sync msg:Return: null<br><br>What caught my attention is the "No DirSync response control in search done response". Doesn't the DirSync control determine what entries have been changed since last query? I really think I have to do something on the AD side, but I have no idea what. I can still read the AD accounts from the resource, but the sync is still not working for some reason... I will look into it later.<br><br>Thanks<br><br>BR,<br>Samu Viitanen<br><br><div><hr id="stopSpelling">To: midpoint@lists.evolveum.com<br>From: radovan.semancik@evolveum.com<br>Date: Mon, 4 Jan 2016 12:11:41 +0100<br>Subject: Re: [midPoint] Live Sync on AD LDAP Connector<br><br>
<div class="ecxmoz-cite-prefix">Hi Samu,<br>
<br>
AD Livesync with LDAP connector is supposed to work and it indeed
works in my tests. Here's the setup on midPoint side:<br>
<br>
<a class="ecxmoz-txt-link-freetext" href="https://github.com/Evolveum/midpoint/tree/master/testing/conntest/src/test/resources/ad-ldap" target="_blank">https://github.com/Evolveum/midpoint/tree/master/testing/conntest/src/test/resources/ad-ldap</a><br>
<br>
I have documented the entire setup in this wiki page:<br>
<br>
<a class="ecxmoz-txt-link-freetext" href="https://wiki.evolveum.com/display/midPoint/Active+Directory+with+LDAP+connector" target="_blank">https://wiki.evolveum.com/display/midPoint/Active+Directory+with+LDAP+connector</a><br>
<br>
However, I'm not really sure what are exactly the access rights
and setup to be done on the AD side.<br>
<br>
Perhaps the best steps for you are to enable trace on ConnId
framework and LDAP connector. Set up logging like this:<br>
<br>
org.identityconnectors.framework: TRACE<br>
com.evolveum.polygon.connector.ldap: TRACE<br>
<br>
The midPoint logfiles should tell you what exactly is going on and
why are you not getting any synchronization events. You should see
invocation of ConnId sync() method, then LDAP connector detecting
the change, invocation of ConnId handle() method for each change
and then midPoint provisioning and model (notifyChange() method)
processing the change.<br>
<br>
However, please be warned: if the problem is on the AD side then
all you usually get is "unwilling to perform" error and I have
found no practical way how to figure out what is going on on the
AD side. AD logfiles are mostly useless. So good old guessing and
trial and error is often the only way ...<br>
<br>
<pre class="ecxmoz-signature">--
Radovan Semancik
Software Architect
evolveum.com
</pre>
<br>
<br>
On 12/30/2015 09:40 AM, Samu Viitanen wrote:<br>
</div>
<blockquote cite="mid:DUB117-W3383E87642F46092478EE5D1FD0@phx.gbl">
<style><!--
.ExternalClass .ecxhmmessage P {
padding:0px;
}
.ExternalClass body.ecxhmmessage {
font-size:12pt;
font-family:Calibri;
}
--></style>
<div dir="ltr">Hello,<br>
<br>
I have experimented with the new experimental AD with LDAP
connector, and in my solution the Live Synchronization does not
seem to work. Is it supposed to work or is that still TODO? I
keep getting a warning about current sync token being null and
it does not sync anything from AD, but the task is still running
fine. If it should work, is there something special I need to
take into consideration to get it working?<br>
<br>
Best Regards<br>
Samu Viitanen<br>
</div>
<br>
<fieldset class="ecxmimeAttachmentHeader"></fieldset>
<br>
<pre>_______________________________________________
midPoint mailing list
<a class="ecxmoz-txt-link-abbreviated" href="mailto:midPoint@lists.evolveum.com">midPoint@lists.evolveum.com</a>
<a class="ecxmoz-txt-link-freetext" href="http://lists.evolveum.com/mailman/listinfo/midpoint" target="_blank">http://lists.evolveum.com/mailman/listinfo/midpoint</a>
</pre>
</blockquote>
<br>
<br>
<pre class="ecxmoz-signature"></pre>
<br>_______________________________________________
midPoint mailing list
midPoint@lists.evolveum.com
http://lists.evolveum.com/mailman/listinfo/midpoint</div> </div></body>
</html>