Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision Both sides next revision
tutorial:adm:manage_ad [2019/11/20 12:16]
doischert [Distinguished Name (DN), Common Name (CN)] 		tutorial:adm:manage_ad [2020/01/07 11:38]
doischert
Line 225: Line 225:
  
 If you are running on a Windows server, the 'ldapGroups' in 'Specified attributes to be returned' has the wrong value 'ldapGroups\r' (this is only visible in Audit). The solution is to remove the value in 'Specified attributes to be returned' and write it again manually. If you are running on a Windows server, the 'ldapGroups' in 'Specified attributes to be returned' has the wrong value 'ldapGroups\r' (this is only visible in Audit). The solution is to remove the value in 'Specified attributes to be returned' and write it again manually.
 +
 ===== Connection via SSL not working ===== ===== Connection via SSL not working =====
 If you just imported root certificate to IdM truststore, but SSL connection to AD is still not working try following method to find which server hostname you should use. If you just imported root certificate to IdM truststore, but SSL connection to AD is still not working try following method to find which server hostname you should use.
Line 230: Line 231:
 {{:tutorial:adm:trust.png?400|}} {{:tutorial:adm:trust.png?400|}}
 click on View certificate -> tab General -> field Issued To -> Common name(CN) and use this value as server hostname. click on View certificate -> tab General -> field Issued To -> Common name(CN) and use this value as server hostname.
 +
 +===== LdapErr: DSID-0C0907C5 =====
 +If you see this error when reconciliating AD groups:
 +<code>org.identityconnectors.framework.common.exceptions.ConnectorException: javax.naming.OperationNotSupportedException: [LDAP: error code 12 - 00000057: LdapErr: DSID-0C0907C5, comment: Error processing control, data 0, v1db1]; remaining name 'OU=BohemiaEnergy,DC=bohemiaenergy,DC=local'</code>
 +
 +the likely cause is that some groups have many members. AD has a property MaxPageSize which is probably set to lower than necessary (default is 1000). Increasing the value to an arbitrary large number (30000) helped in our case but only AD admin can change this.
  
 ===== Video Guide ===== ===== Video Guide =====
 [[https://www.youtube.com/watch?v=ZbQCH_BYd-k&list=PLBeAQt3pe3EcdVE8QpCDEJcDsi_jtNQUb&index=7|How to create role for AD group]] - czech language [[https://www.youtube.com/watch?v=ZbQCH_BYd-k&list=PLBeAQt3pe3EcdVE8QpCDEJcDsi_jtNQUb&index=7|How to create role for AD group]] - czech language
  • by neznajf