<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
Eugene,</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
I am testing Claude.ai at several tasks. I submitted your email and got this response. I'd be interested in what you make of this response or if it is misdirecting.<a href="https://claude.ai/share/67073561-d22d-43fe-8423-df33ad26cbf4">https://claude.ai/share/67073561-d22d-43fe-8423-df33ad26cbf4</a></div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
—Keith Hazelton (hazelton@internet2.edu)</div>
<div class="_Entity _EType_OWALinkPreview _EId_OWALinkPreview _EReadonly_1" style="width: 100%; display: inline-block;">
<div style="width: 100%; margin-top: 16px; margin-bottom: 16px; position: relative; max-width: 800px; min-width: 424px;" class="LPBorder747949" id="LPBorder_GTaHR0cHM6Ly9jbGF1ZGUuYWkvc2hhcmUvNjcwNzM1NjEtZDIyZC00M2ZlLTg0MjMtZGYzM2FkMjZjYmY0">
<table style="padding: 12px 36px 12px 12px; width: 100%; border-width: 1px; border-style: solid; border-color: rgb(200, 200, 200); border-radius: 2px;" role="presentation" id="LPContainer747949">
<tbody>
<tr style="border-spacing: 0px;" valign="top">
<td>
<div style="position: relative; margin-right: 12px; height: 134.974px; overflow: hidden; width: 240px;" id="LPImageContainer747949">
<a href="https://claude.ai/share/67073561-d22d-43fe-8423-df33ad26cbf4" id="LPImageAnchor747949" target="_blank"><img width="240" height="134" style="display: block;" alt="" id="LPThumbnailImageId747949" src="https://claude.ai/images/claude_ogimage.png"></a></div>
</td>
<td style="width: 100%;">
<div style="font-size: 21px; font-weight: 300; margin-right: 8px; font-family: "wf_segoe-ui_light", "Segoe UI Light", "Segoe WP Light", "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; margin-bottom: 12px;" id="LPTitle747949">
<a style="text-decoration: none; color: var(--themePrimary);" href="https://claude.ai/share/67073561-d22d-43fe-8423-df33ad26cbf4" id="LPUrlAnchor747949" target="_blank">midPoint AD LDAP Connector Configuration</a></div>
<div style="font-size: 14px; max-height: 100px; color: rgb(102, 102, 102); font-family: "wf_segoe-ui_normal", "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; margin-bottom: 12px; margin-right: 8px; overflow: hidden;" id="LPDescription747949">
Shared via Claude, an AI assistant from Anthropic</div>
<div style="font-size: 14px; font-weight: 400; color: rgb(166, 166, 166); font-family: "wf_segoe-ui_normal", "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif;" id="LPMetadata747949">
claude.ai</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> midPoint <midpoint-bounces@lists.evolveum.com> on behalf of Wang, Eugene Mr. (Fed) via midPoint <midpoint@lists.evolveum.com><br>
<b>Sent:</b> Friday, June 20, 2025 3:26 PM<br>
<b>To:</b> midpoint@lists.evolveum.com <midpoint@lists.evolveum.com><br>
<b>Cc:</b> Wang, Eugene Mr. (Fed) <yujin.wang@nist.gov>; Jiang, Scott Zhihua (Fed) <scott.jiang@nist.gov>; Wei, Jingfang (Jenny) (Fed) <jingfang.wei@nist.gov><br>
<b>Subject:</b> [midPoint] insufficientAccessRights.</font>
<div> </div>
</div>
<style>
<!--
@font-face
{font-family:Wingdings}
@font-face
{font-family:"Cambria Math"}
@font-face
{font-family:Aptos}
p.x_MsoNormal, li.x_MsoNormal, div.x_MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Aptos",sans-serif}
span.x_EmailStyle17
{font-family:"Aptos",sans-serif;
color:windowtext}
.x_MsoChpDefault
{font-size:11.0pt}
@page WordSection1
{margin:1.0in 1.0in 1.0in 1.0in}
div.x_WordSection1
{}
ol
{margin-bottom:0in}
ul
{margin-bottom:0in}
-->
</style>
<div lang="EN-US" link="#467886" vlink="#96607D" style="word-wrap:break-word">
<div class="x_WordSection1">
<p class="x_MsoNormal">Dear midPoint Support Team:<br>
I am testing the provisioning and account sync functionalities of the midPoint AD LDAP connector. We deployed the midPoint version 4.9.9 application and set up the resource connector:<br>
com.evolveum.polygon.connector.ldap.ad.AdLdapConnector</p>
<p class="x_MsoNormal"> </p>
<p class="x_MsoNormal">The connector successfully loads the AD user’s account data to the midPoint application, but it fails the provisioning tasks. The midPoint logger shows the “insufficientAccessRights” error message below:</p>
<p class="x_MsoNormal"> </p>
<p class="x_MsoNormal">com.evolveum.midpoint.util.exception.SystemException: Got unexpected exception: org.identityconnectors.framework.common.exceptions.PermissionDeniedException: LDAP error during DirSync search: insufficientAccessRights: 00002105: LdapErr:
DSID-0C090CC1, comment: Error processing control, data 0, v4563? (50)</p>
<p class="x_MsoNormal"> at com.evolveum.midpoint.provisioning.ucf.impl.connid.ConnectorInstanceConnIdImpl.fetchCurrentToken(ConnectorInstanceConnIdImpl.java:1435)</p>
<p class="x_MsoNormal"> at com.evolveum.midpoint.provisioning.impl.resourceobjects.ResourceObjectConverter.fetchCurrentToken(ResourceObjectConverter.java:278)</p>
<p class="x_MsoNormal"> at com.evolveum.midpoint.provisioning.impl.shadows.sync.LiveSynchronizer.fetchAndRememberCurrentToken(LiveSynchronizer.java:202)</p>
<p class="x_MsoNormal"> </p>
<p class="x_MsoNormal"> </p>
<p class="x_MsoNormal">We confirmed with our AD owner that the account used for the connection is in the “Domain Admin” group and has full create/update/delete permissions. We also confirmed that using Apache Studio, we can successfully modify any user’s attribute.
</p>
<p class="x_MsoNormal"> </p>
<p class="x_MsoNormal">We confirmed with our AD owner that our system is running on a Windows 2019 Server with a full implementation of AD DS, and it reports a functionality level of 2016. The midPoint docs state that it supports “Active Directory Domain Services
(AD DS), Windows Server 2019“, so our AD system fulfills the midPoint application.
</p>
<p class="x_MsoNormal"> </p>
<p class="x_MsoNormal">My question is: In order to set up a midPoint provisioning connector, is there any special feature to be configured (turned on) in the AD DS system?</p>
<p class="x_MsoNormal"> </p>
<p class="x_MsoNormal">Thanks, </p>
<p class="x_MsoNormal"> </p>
<p class="x_MsoNormal">Eugene (<i>Yujin</i>) Wang</p>
<p class="x_MsoNormal">(301)975-3621 (office)</p>
<p class="x_MsoNormal">(240)386-9234 (mobile)</p>
<p class="x_MsoNormal">IT Specialist <span style="font-size:10.0pt; color:black">
- Application Systems Division</span></p>
<p class="x_MsoNormal"><b>Office of Information Management (OISM), NIST</b></p>
<p class="x_MsoNormal"> </p>
</div>
</div>
</body>
</html>