<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">Hi Sammu,<br>
<br>
Yes, it looks like the DirSync is not working on the AD side. As
far as I remember I haven't done any special configuration to
enable DirSync. There is nothing that the connector can do to help
you diagnose this. You have to look at the Active Directory
server. But overall, it is very difficult to figure out what is
wrong on the AD side, as it provides very little information. Logs
are almost useless, so the best option is often plain old trial
and error. Try googling for similar problems (DirSync not
working). Also please check that the AD user that you use to
access AD from midPoint has the necessary privileges. Maybe try
using the most powerful administration privileges and then strip
them down as necessary.<br>
<br>
My notes about AD are here:<br>
<a class="moz-txt-link-freetext" href="https://wiki.evolveum.com/display/midPoint/Active+Directory+with+LDAP+connector">https://wiki.evolveum.com/display/midPoint/Active+Directory+with+LDAP+connector</a><br>
<a class="moz-txt-link-freetext" href="https://wiki.evolveum.com/pages/viewpage.action?pageId=20709437">https://wiki.evolveum.com/pages/viewpage.action?pageId=20709437</a><br>
<br>
<pre class="moz-signature" cols="72">--
Radovan Semancik
Software Architect
evolveum.com
</pre>
<br>
<br>
On 01/11/2016 03:29 PM, Samu Viitanen wrote:<br>
</div>
<blockquote cite="mid:DUB117-W627321DA52015D494B1F37D1C90@phx.gbl"
type="cite">
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style>
<div dir="ltr">Hi Radovan,<br>
<br>
I have tried the synchronization with these instructions. The
sync still is not working, I set up my logging as you explained,
and the logs that come out are like this:<br>
<br>
2016-01-11 16:21:32,935 TRACE: method: getLatestSyncToken
msg:Enter: getLatestSyncToken(ObjectClass: user)<br>
2016-01-11 16:21:32,936 TRACE: method: null msg:check alive: OK<br>
2016-01-11 16:21:32,936 TRACE: method: null msg:Searching DN
ou=ProvSamu Users,dc=example,dc=test with
(cn=__entry_like_this_is_unlikely_to_exist__), attrs: [],
cookie: null<br>
2016-01-11 16:21:32,943 WARN: method: null msg:No DirSync
response control in search done response<br>
2016-01-11 16:21:32,943 TRACE: method: getLatestSyncToken
msg:Return: null<br>
2016-01-11 16:21:32,946 TRACE: method: sync msg:Enter:
sync(ObjectClass: user, null,
com.evolveum.midpoint.provisioning.ucf.impl.ConnectorInstanceIcfImpl$1@35ce0e4c,
OperationOptions:
{RETURN_DEFAULT_ATTRIBUTES:true,ATTRS_TO_GET:[__PASSWORD__,__ENABLE__,createTimeStamp]})<br>
2016-01-11 16:21:32,947 TRACE: method: null msg:check alive: OK<br>
2016-01-11 16:21:32,947 TRACE: method: sync msg:Enter:
sync(ObjectClass: user, null,
org.identityconnectors.framework.impl.api.local.operations.SyncImpl$1@10d47c9c,
OperationOptions:
{RETURN_DEFAULT_ATTRIBUTES:true,ATTRS_TO_GET:[__PASSWORD__,__ENABLE__,createTimeStamp]})<br>
2016-01-11 16:21:32,947 TRACE: method: null msg:Searching DN
ou=ProvSamu Users,dc=example,dc=test with (objectClass=*),
attrs: [], cookie: null<br>
2016-01-11 16:21:32,992 WARN: method: null msg:No DirSync
response control in search done response<br>
2016-01-11 16:21:32,992 TRACE: method: null msg:Search DN
ou=ProvSamu Users,dc=example,dc=test with (objectClass=*): 0
entries, 0 processed<br>
2016-01-11 16:21:32,992 TRACE: method: sync msg:Return<br>
2016-01-11 16:21:32,993 TRACE: method: sync msg:Return: null<br>
<br>
What caught my attention is the "No DirSync response control in
search done response". Doesn't the DirSync control determine
what entries have been changed since last query? I really think
I have to do something on the AD side, but I have no idea what.
I can still read the AD accounts from the resource, but the sync
is still not working for some reason... I will look into it
later.<br>
<br>
Thanks<br>
<br>
BR,<br>
Samu Viitanen<br>
<br>
<div>
<hr id="stopSpelling">To: <a class="moz-txt-link-abbreviated" href="mailto:midpoint@lists.evolveum.com">midpoint@lists.evolveum.com</a><br>
From: <a class="moz-txt-link-abbreviated" href="mailto:radovan.semancik@evolveum.com">radovan.semancik@evolveum.com</a><br>
Date: Mon, 4 Jan 2016 12:11:41 +0100<br>
Subject: Re: [midPoint] Live Sync on AD LDAP Connector<br>
<br>
<div class="ecxmoz-cite-prefix">Hi Samu,<br>
<br>
AD Livesync with LDAP connector is supposed to work and it
indeed works in my tests. Here's the setup on midPoint side:<br>
<br>
<a moz-do-not-send="true" class="ecxmoz-txt-link-freetext"
href="https://github.com/Evolveum/midpoint/tree/master/testing/conntest/src/test/resources/ad-ldap"
target="_blank">https://github.com/Evolveum/midpoint/tree/master/testing/conntest/src/test/resources/ad-ldap</a><br>
<br>
I have documented the entire setup in this wiki page:<br>
<br>
<a moz-do-not-send="true" class="ecxmoz-txt-link-freetext"
href="https://wiki.evolveum.com/display/midPoint/Active+Directory+with+LDAP+connector"
target="_blank">https://wiki.evolveum.com/display/midPoint/Active+Directory+with+LDAP+connector</a><br>
<br>
However, I'm not really sure what are exactly the access
rights and setup to be done on the AD side.<br>
<br>
Perhaps the best steps for you are to enable trace on ConnId
framework and LDAP connector. Set up logging like this:<br>
<br>
org.identityconnectors.framework: TRACE<br>
com.evolveum.polygon.connector.ldap: TRACE<br>
<br>
The midPoint logfiles should tell you what exactly is going
on and why are you not getting any synchronization events.
You should see invocation of ConnId sync() method, then LDAP
connector detecting the change, invocation of ConnId
handle() method for each change and then midPoint
provisioning and model (notifyChange() method) processing
the change.<br>
<br>
However, please be warned: if the problem is on the AD side
then all you usually get is "unwilling to perform" error and
I have found no practical way how to figure out what is
going on on the AD side. AD logfiles are mostly useless. So
good old guessing and trial and error is often the only way
...<br>
<br>
<pre class="ecxmoz-signature">--
Radovan Semancik
Software Architect
evolveum.com
</pre>
<br>
<br>
On 12/30/2015 09:40 AM, Samu Viitanen wrote:<br>
</div>
<blockquote
cite="mid:DUB117-W3383E87642F46092478EE5D1FD0@phx.gbl">
<style><!--
.ExternalClass .ecxhmmessage P {
padding:0px;
}
.ExternalClass body.ecxhmmessage {
font-size:12pt;
font-family:Calibri;
}
--></style>
<div dir="ltr">Hello,<br>
<br>
I have experimented with the new experimental AD with LDAP
connector, and in my solution the Live Synchronization
does not seem to work. Is it supposed to work or is that
still TODO? I keep getting a warning about current sync
token being null and it does not sync anything from AD,
but the task is still running fine. If it should work, is
there something special I need to take into consideration
to get it working?<br>
<br>
Best Regards<br>
Samu Viitanen<br>
</div>
<br>
<fieldset class="ecxmimeAttachmentHeader"></fieldset>
<br>
<pre>_______________________________________________
midPoint mailing list
<a moz-do-not-send="true" class="ecxmoz-txt-link-abbreviated" href="mailto:midPoint@lists.evolveum.com">midPoint@lists.evolveum.com</a>
<a moz-do-not-send="true" class="ecxmoz-txt-link-freetext" href="http://lists.evolveum.com/mailman/listinfo/midpoint" target="_blank">http://lists.evolveum.com/mailman/listinfo/midpoint</a>
</pre>
</blockquote>
<br>
<br>
<br>
_______________________________________________
midPoint mailing list
<a class="moz-txt-link-abbreviated" href="mailto:midPoint@lists.evolveum.com">midPoint@lists.evolveum.com</a>
<a class="moz-txt-link-freetext" href="http://lists.evolveum.com/mailman/listinfo/midpoint">http://lists.evolveum.com/mailman/listinfo/midpoint</a></div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
midPoint mailing list
<a class="moz-txt-link-abbreviated" href="mailto:midPoint@lists.evolveum.com">midPoint@lists.evolveum.com</a>
<a class="moz-txt-link-freetext" href="http://lists.evolveum.com/mailman/listinfo/midpoint">http://lists.evolveum.com/mailman/listinfo/midpoint</a>
</pre>
</blockquote>
<br>
<br>
</body>
</html>