<html><head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head><body style="color: rgb(0, 0, 0); background-color: rgb(255, 255,
255);" text="#000000" bgcolor="#FFFFFF">
I'm running midPoint 3.9 with LDAP connector 2.0 Connecting to OpenLDAP
version 2.4.45+dfsg-1ubuntu1 memberOf, refInt, lastBind, and sssvlv
overlays are installed.<br>
<br>
I've been trying to setup LDAP group management according to the Wiki
and other docs I've found. Automatic groupOfNames creation in
"ou=roles,ou=accounts,dc=example,dc=com" is working fine when I create a
Role with an Assignment of the LDAP Group Metarole. So that seems like
most of the connection is working correctly.<br>
<br>
But I'm getting the following error message when I try to add a user to a
Role that should put them in the LDAP Group.<br>
-------<br>
Operation:
operation.org.identityconnectors.framework.api.ConnectorFacade.updateDelta<br>
<br>
Message: Unknown UID: LDAP entry for UID Attribute: {Name=__UID__,
Value=[caed9d00-0c8c-1039-98e5-a53942dc29e0], NameHint=Attribute:
{Name=__NAME__, Value=[cn=test
role,ou=roles,ou=accounts,dc=example,dc=com]}}
was not found<br>
<br>
Parameters: uid [caed9d00-0c8c-1039-98e5-a53942dc29e0]<br>
attributesDelta: [[Attribute: {Name=member,
ValuesToAdd=[cn=testuser,ou=users,ou=accounts,dc=example,dc=com],
ValuesToRemove=null,
ValuesToReplace=null}]]<br>
objectClass: [crOCD
({<a class="moz-txt-link-freetext"
href="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3">http://midpoint.evolveum.com/xml/ns/public/resource/instance-3</a>}groupOfNames)]<br>
options: [OperationOptions: {}]<br>
<br>
Context: connector [class
org.identityconnectors.framework.impl.api.local.LocalConnectorFacadeImpl]<br>
<br>
Error:
org.identityconnectors.framework.common.exceptions.UnknownUidException(LDAP
entry for UID Attribute: {Name=__UID__,
Value=[caed9d00-0c8c-1039-98e5-a53942dc29e0], NameHint=Attribute:
{Name=__NAME__, Value=[cn=test
role,ou=roles,ou=accounts,dc=example,dc=com]}}
was not found)<br>
-------<br>
<br>
Here is the Association section from the LDAP Resource:<br>
<association><br>
<ref>ri:ldapGroup</ref><br>
<tolerant>false</tolerant><br>
<displayName>LDAP Group
Membership</displayName><br>
<kind>entitlement</kind><br>
<intent>ldapGroup</intent><br>
<direction>objectToSubject</direction><br>
<associationAttribute>ri:member</associationAttribute><br>
<valueAttribute>ri:dn</valueAttribute><br>
<shortcutAssociationAttribute>ri:memberOf</shortcutAssociationAttribute>
<br>
<explicitReferentialIntegrity>false</explicitReferentialIntegrity><br>
</association><br>
<br>
And the Entitlement Object section from the LDAP Resource:<br>
<objectType><br>
<kind>entitlement</kind><br>
<intent>ldapGroup</intent><br>
<displayName>LDAP Group</displayName><br>
<objectClass>ri:groupOfNames</objectClass><br>
<br>
<attribute><br>
<ref>ri:dn</ref><br>
<matchingRule>mr:distinguishedName</matchingRule><br>
<outbound><br>
<!-- Name cannot be weak. Changes in name trigger
object rename. --><br>
<source><br>
<path>$focus/name</path><br>
</source><br>
<expression><br>
<script><br>
<code><br>
import javax.naming.ldap.Rdn<br>
import javax.naming.ldap.LdapName<br>
<br>
dn = new
LdapName('ou=roles,ou=accounts,dc=example,dc=org')<br>
dn.add(new Rdn('cn', name.toString()))<br>
return dn.toString()<br>
</code><br>
</script><br>
</expression><br>
</outbound><br>
</attribute><br>
<attribute><br>
<ref>ri:member</ref><br>
<matchingRule>mr:distinguishedName</matchingRule><br>
<fetchStrategy>minimal</fetchStrategy><br>
<outbound><br>
<strength>strong</strength><br>
<!-- Workaround - groupOfNames MUST have at least
one member. Even non-existent DN. --><br>
<expression><br>
<value>cn=dummy,o=whatever</value><br>
</expression><br>
</outbound><br>
</attribute> <br>
<attribute><br>
<ref>ri:cn</ref><br>
<matchingRule>mr:stringIgnoreCase</matchingRule><br>
<outbound><br>
<strength>weak</strength><br>
<source><br>
<path>$focus/name</path><br>
</source><br>
</outbound><br>
</attribute><br>
<attribute><br>
<ref>ri:description</ref><br>
<outbound><br>
<source><br>
<path>description</path><br>
</source><br>
</outbound><br>
</attribute><br>
<configuredCapabilities><br>
<cap:pagedSearch><br>
<cap:defaultSortField>ri:cn</cap:defaultSortField><br>
</cap:pagedSearch><br>
</configuredCapabilities><br>
</objectType><br>
<br>
I'm not sure if there are other important configs that would be helpful
to see. I'll be happy to post anything that's helpful.<br>
<br>
This may be a related issue that might help locate the issue: When I
look at the Accounts tab of the Resource in the GUI, Search In: Resource
gives a list of Accounts on the server. However, doing the same in the
Entitlements tab, with the Intent set to ldapGroup, does not display
any entries, even though there are groups on the server.<br>
<br>
One last thing that might help diagnose this: If I try to remove the
LDAP Group Metarole assignment from the Role, (hoping it would delete
the groupOfNames from the server, I get the following error:<br>
--------<br>
<span style="color: rgb(51, 51, 51); font-family: "Source Sans
Pro", "Helvetica Neue", Helvetica, Arial, sans-serif;
font-size: 14px; font-style: normal; font-variant-ligatures: normal;
font-variant-caps: normal; font-weight: normal; letter-spacing: normal;
orphans: 2; text-align: start; text-indent: 0px; text-transform: none;
white-space: normal; widows: 2; word-spacing: 0px;
-webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);
display: inline !important; float: none;">Can't delete object
shadow:7a74941f-a6cb-4af4-b012-d75cd4c57af7(cn=test
role,ou=roles,ou=accounts,dc=example,dc=com). Reason:
org.identityconnectors.framework.common.exceptions.UnknownUidException(LDAP
entry for UID Attribute: {Name=__UID__,
Value=[caed9d00-0c8c-1039-98e5-a53942dc29e0], NameHint=Attribute:
{Name=__NAME__, Value=[cn=test
role,ou=roles,ou=accounts,dc=example,dc=com]}} was not found): Can't
delete object shadow:7a74941f-a6cb-4af4-b012-d75cd4c57af7(cn=Test
Role,ou=roles,ou=accounts,dc=example,dc=com). Reason:
org.identityconnectors.framework.common.exceptions.UnknownUidException(LDAP
entry for UID Attribute: {Name=__UID__,
Value=[caed9d00-0c8c-1039-98e5-a53942dc29e0], NameHint=Attribute:
{Name=__NAME__, Value=[cn=test
role,ou=roles,ou=accounts,dc=example,dc=com]}}
was not found)</span><br>
<br>
-------<br>
I'm reasonably sure I just have something out of place somewhere.
Hopefully someone can spot what I've done wrong.<br>
Thank you!<br>
Brad <br>
</body></html>