<html><body><div style="font-family: times new roman, new york, times, serif; font-size: 12pt; color: #000000"><div>Hi,<br></div><div><br></div><div>Blame Microsoft :-)<br></div><div><br></div><div>The root cause of these errors is the fact that Active Directory does not really follow LDAP standard. E.g. it does not provide SYNTAX clauses in the schema, redefines attributes, etc. The Apache Directory API that we are using was originally designed for ApacheDS which is a designed as an LDAP-compliant server. When I was starting with LDAP connector and tried to use the Apache Directory API with real-world servers such as AD then it broke down on LDAP standard violations. Many of these issues are now "fixed" in the Apache Directory API code. But the errors and warning remain. Given the current structure of the Apache Directory API code these errors are not entirely easy to eliminate. I hope to find some time to rework the Apache Directory API error handling and reporting one day, so they can disappear. But for now they are a sad reminder of a the way how some corporations (mis)interpret the standards.<br></div><div><br></div><div>But, the relatively slow speed is a different issues that is only marginally related. The delays is caused by the connector reading the LDAP schema. The connector has to read the entire LDAP schema, as there is no way to select only some objectclasses and attributes (and there is no way how to express that in ConnId either, but that can be fixed). The connector needs that schema to correctly interpret datatypes, compare values, etc. But that would not be a big problem if the schema is retrieved only once. Now it is retrieved once for every new connection. That is caused by the fact that it is not entirely easy to share a cached schema between ConnId connector instances. Therefore each new connector instance needs to retrieve the schema from server. But that will be hopefully fixed in the future: https://jira.evolveum.com/browse/MID-2702<br></div><div><br></div><div><span name="x"></span>-- <br>Radovan Semancik<br>Software Architect<br>evolveum.com<span name="x"></span><br></div><div><br></div><hr id="zwchr"><blockquote style="border-left:2px solid #1010FF;margin-left:5px;padding-left:5px;color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;"><b>From: </b>"Florin. Stingaciu" <fstingaciu@mirantis.com><br><b>To: </b>midpoint@lists.evolveum.com<br><b>Sent: </b>Tuesday, May 10, 2016 2:45:53 AM<br><b>Subject: </b>[midPoint] ERR_04306 Cannot find a Syntax object ....<br><div><br></div><div dir="ltr"><div>Hello, </div><div><br></div><div>I'm using the AdLdapConnector version 1.4.3.0 to directly connect to an Active Directory instance in a read only mode of operation. Whenever I click on the resource or try to open a user profile that has an account on this Active Directory, the following error appears in the logs: </div>
<div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">2016-05-10 00:33:56,087 [UCF] [http-bio-8080-exec-6] INFO (org.apache.directory.api.ldap.schema.manager.impl.DefaultSchemaManager): Loading other enabled schema:<br> Schema Name: other<br> Disabled: false<br> Owner: uid=admin,ou=system<br> Dependencies: []<br> SchemaLoader : DefaultSchemaLoader<br>2016-05-10 00:33:56,157 [UCF] [http-bio-8080-exec-6] INFO (org.apache.directory.api.ldap.model.schema.registries.helper.AttributeTypeHelper): ERR_04306 Cannot find a Syntax object 1.3.6.1.4.1.1466.115.121.1.40 while building cross-references for the x25FacilitiesDataOutgoing AttributeType.<br>2016-05-10 00:33:56,157 [UCF] [http-bio-8080-exec-6] INFO (org.apache.directory.api.ldap.model.schema.registries.helper.AttributeTypeHelper): ERR_04306 Cannot find a Syntax object 1.3.6.1.4.1.1466.115.121.1.40 while building cross-references for the x25FacilitiesDataIncoming AttributeType.<br>2016-05-10 00:33:56,157 [UCF] [http-bio-8080-exec-6] INFO (org.apache.directory.api.ldap.model.schema.registries.helper.AttributeTypeHelper): ERR_04306 Cannot find a Syntax object 1.3.6.1.4.1.1466.115.121.1.40 while building cross-references for the x25CallUserDataOutgoing AttributeType.<br>2016-05-10 00:33:56,157 [UCF] [http-bio-8080-exec-6] INFO (org.apache.directory.api.ldap.model.schema.registries.helper.AttributeTypeHelper): ERR_04306 Cannot find a Syntax object 1.3.6.1.4.1.1466.115.121.1.12 while building cross-references for the fromServer AttributeType.<br>2016-05-10 00:33:56,157 [UCF] [http-bio-8080-exec-6] INFO (org.apache.directory.api.ldap.model.schema.registries.helper.AttributeTypeHelper): ERR_04306 Cannot find a Syntax object 1.3.6.1.4.1.1466.115.121.1.12 while building cross-references for the msDS-Preferred-GC-Site AttributeType.<br>2016-05-10 00:33:56,157 [UCF] [http-bio-8080-exec-6] INFO (org.apache.directory.api.ldap.model.schema.registries.helper.AttributeTypeHelper): ERR_04306 Cannot find a Syntax object 1.3.6.1.4.1.1466.115.121.1.7 while building cross-references for the generatedConnection AttributeType.</blockquote><div><br></div><div>This error continues appearing for a lot of different attributes. This is just a snippet. This causes a very slow loading time for an action that requires a schema load. Also, keep in mind that this actually doesn't break anything. It's just slow. </div><div>Here's my connector config: </div><div><br></div><div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><resource ><br> <!-- Resource name. It will be displayed in GUI. --><br> <name>Active Directory</name><br> <description><br> LDAP resource using a ConnId AD connector.<br> </description><br><connectorRef type="ConnectorType"><br> <description><br> Reference to the OpenICF LDAP connector. This is dynamic reference, it will be translated to<br> OID during import.<br> </description><br> <filter><br> <q:and><br> <q:equal><br> <q:path>c:connectorType</q:path><br> <q:value>com.evolveum.polygon.connector.ldap.ad.AdLdapConnector</q:value><br> </q:equal><br> <q:equal><br> <q:path>c:connectorVersion</q:path><br> <q:value>1.4.3.0-SNAPSHOT</q:value><br> </q:equal><br> </q:and><br> </filter><br> </connectorRef><br> <br> <!-- Configuration section contains configuration of the connector,<br> such as hostnames and passwords --><br><connectorConfiguration xmlns:icfc="<a href="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/connector-schema-3" target="_blank">http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/connector-schema-3</a>"><br> <icfc:configurationProperties xmlns:icfcldap="<a href="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/bundle/com.evolveum.polygon.connector-ldap/com.evolveum.polygon.connector.ldap.ad.AdLdapConnector" target="_blank">http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/bundle/com.evolveum.polygon.connector-ldap/com.evolveum.polygon.connector.ldap.ad.AdLdapConnector</a>"><br> <icfcldap:port>3268</icfcldap:port><br> <icfcldap:host>active_directory.server</icfcldap:host><br> <icfcldap:baseContext>ou=People,dc=example,dc=com</icfcldap:baseContext><br> <icfcldap:bindDn>CN=ldap.service,dc=example,dc=com</icfcldap:bindDn><br> <icfcldap:bindPassword><br> <t:clearValue>password</t:clearValue><br> </icfcldap:bindPassword><br> <icfcldap:pagingStrategy>auto</icfcldap:pagingStrategy><br> <icfcldap:vlvSortAttribute>sAMAccountName</icfcldap:vlvSortAttribute><br> <icfcldap:vlvSortOrderingRule>2.5.13.3</icfcldap:vlvSortOrderingRule><br> </icfc:configurationProperties><br> <icfc:resultsHandlerConfiguration><br> <icfc:enableNormalizingResultsHandler>false</icfc:enableNormalizingResultsHandler><br> <icfc:enableFilteredResultsHandler>false</icfc:enableFilteredResultsHandler><br> <icfc:enableAttributesToGetSearchResultsHandler>false</icfc:enableAttributesToGetSearchResultsHandler><br> </icfc:resultsHandlerConfiguration><br> </connectorConfiguration></blockquote><div><br></div><div>Any help would be greatly appreciated. </div><div><br></div><div>Thanks, </div><div>-F </div></div></div>
<br>_______________________________________________<br>midPoint mailing list<br>midPoint@lists.evolveum.com<br>http://lists.evolveum.com/mailman/listinfo/midpoint<br></blockquote><div><br></div></div></body></html>