Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision 		Previous revision
Next revision Both sides next revision
tutorial:adm:manage_ad [2020/03/25 06:46]
kucerar link to cross domain membership 		tutorial:adm:manage_ad [2020/08/13 11:22]
apeterova special characters
Line 96: Line 96:
   * **Base contexts for user entry searches** - usually the same as "Root suffixes".   * **Base contexts for user entry searches** - usually the same as "Root suffixes".
   * **Group members reference attribute** - usually "member", use this if you want to manage group membership of user accounts   * **Group members reference attribute** - usually "member", use this if you want to manage group membership of user accounts
-  * **pageSize** - this option is only available if you use connector that is customizes by BCV Solutions. Leave it at default (100), if you ask for more than the limit for AD is, you will get an error.+  * **pageSize** - this option is only available if you use connector that is customizes by BCV Solutions. Set it to default (100), if you ask for more than the limit for AD is, you will get an error.
   * **Uid Attribute** - this is one of the most important option. It defines the primary key/UID of the account. Attribute values will be stored in CzechIdM for each account. Must be unique and should not change. **It is strongly advised to use "sAMAccountName", since connId connector has some problem with returning this specific attribute if mapped by other means.**   * **Uid Attribute** - this is one of the most important option. It defines the primary key/UID of the account. Attribute values will be stored in CzechIdM for each account. Must be unique and should not change. **It is strongly advised to use "sAMAccountName", since connId connector has some problem with returning this specific attribute if mapped by other means.**
   * **Object classes to synchronize** - usually the same as "Entry object classes"   * **Object classes to synchronize** - usually the same as "Entry object classes"
Line 242: Line 242:
  
 the likely cause is that some groups have many members. AD has a property MaxPageSize which is probably set to lower than necessary (default is 1000). Increasing the value to an arbitrary large number (30000) helped in our case but only AD admin can change this. the likely cause is that some groups have many members. AD has a property MaxPageSize which is probably set to lower than necessary (default is 1000). Increasing the value to an arbitrary large number (30000) helped in our case but only AD admin can change this.
 +
 +===== SvcErr: DSID-031007E5 - unsupported special characters in DN =====
 +
 +The AD connector doesn't support containers (OU) that contain some special characters in their names, namely the forward slash ("/"). When you try to update some user, whose DN contains this character (even when updating only some other attributes), then the provisioning fails with the following exception:
 +<code>
 +javax.naming.NamingException: [LDAP: error code 1 - 000020D6: SvcErr: DSID-031007E5, problem 5012 (DIR_ERROR), data 0
 +</code>
 +
 +Please rename your containers so they don't contain special characters.
 +
 +See more about this known issue here: https://redmine.czechidm.com/issues/2294.
  
 ===== Failover ===== ===== Failover =====
  • by neznajf