Home.... | log in.... | Pub my question! | Sign-up....
Java-index >> E-Mail, Calendar, & Collaboration >> Sun Java System Messaging Server

cannot add users to new domains anymore

I got messaging server and delegated admin to work just fine recently until I tried getting LDAP authentication to work so LDAP users could log into Sunrays.

I used idsconfig and saw that it added a bunch of stuff to the directory so I deleted that stuff after I realized I couldn't add users to a new domain anymore. It just says "cannot create user - unknown error". I can still add users to old domains just fine.

And I tried both DA and commadmin, neither work. Heres my Messaging server and DA version:

Sun Java(tm) System Messaging Server 6.2-3.04 (built Jul 15 2005)

libimta.so 6.2-3.04 (built 01:43:03, Jul 15 2005)

SunOS testy.i-n-control.com 5.10 Generic_118822-25 sun4u sparc SUNW,Sun-Fire-V440

Delegated Administrator 6.3-0.09

I turned on debugging for DA and heres the output:

TRACE [Wed Aug 02 10:10:47 MDT 2006] Default people container = ou=People,o=domain,dc=mail,dc=example,dc=com

TRACE [Wed Aug 02 10:10:47 MDT 2006] ServerPushThread: setting stop flag

TRACE [Wed Aug 02 10:10:47 MDT 2006] commTaskManager: progress thread stopped

TRACE [Wed Aug 02 10:10:47 MDT 2006] com.iplanet.am.sdk.AMException: Unable to create entry.

at com.iplanet.am.sdk.ldap.DirectoryManager.processInternalException(DirectoryMana ger.java:433)

at com.iplanet.am.sdk.ldap.DirectoryManager.createUser(DirectoryManager.java:1046)

at com.iplanet.am.sdk.ldap.DirectoryManager.createEntry(DirectoryManager.java:1525 )

at com.iplanet.am.sdk.AMDirectoryManager.createEntry(AMDirectoryManager.java:651)

at com.iplanet.am.sdk.AMCacheManager.createEntry(AMCacheManager.java:337)

at com.iplanet.am.sdk.AMObjectImpl.create(AMObjectImpl.java:1009)

at com.iplanet.am.sdk.AMPeopleContainerImpl.createUser(AMPeopleContainerImpl.java: 285)

at sun.comm.cli.server.servlet.CreateUser.create(CreateUser.java:677)

at sun.comm.cli.server.servlet.CreateUser.doTask(CreateUser.java:91)

at sun.comm.cli.server.servlet.commTaskManager.execute(commTaskManager.java:196)

at sun.comm.cli.server.servlet.commServlet.doPost(commServlet.java:90)

at javax.servlet.http.HttpServlet.service(HttpServlet.java:807)

at javax.servlet.http.HttpServlet.service(HttpServlet.java:908)

at org.apache.catalina.core.StandardWrapperValve.invokeServletService(StandardWrap perValve.java:771)

at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java: 322)

at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:509)

at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java: 212)

at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:509)

at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:209)

at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:509)

at com.iplanet.ias.web.connector.nsapi.NSAPIProcessor.process(NSAPIProcessor.java: 161)

at com.iplanet.ias.web.WebContainer.service(WebContainer.java:580)

TRACE [Wed Aug 02 10:10:47 MDT 2006] After AM Exception , msg being sent is Unable to create entry.^324^NONE

TRACE [Wed Aug 02 10:10:47 MDT 2006] in CLIPageData constructor:status = 1

TRACE [Wed Aug 02 10:10:47 MDT 2006] commTaskManager - execute => generateOutput

TRACE [Wed Aug 02 10:10:47 MDT 2006] In CLIPageGenerator ....

TRACE [Wed Aug 02 10:10:47 MDT 2006] CLIPageGenerator - generateOutput : cliData.status = 1

TRACE [Wed Aug 02 10:10:47 MDT 2006] CLIPageGenerator - generateOutput : CLIPageData.OK = 0

TRACE [Wed Aug 02 10:10:47 MDT 2006] CLIPageGenerator - generateOutput : CLIPageData.FAIL = 1

TRACE [Wed Aug 02 10:10:47 MDT 2006] Failed: Unable to create entry.^324^NONE

TRACE [Wed Aug 02 10:10:47 MDT 2006] CLIPageGenerator - generateOutput - Printing successfull results

TRACE [Wed Aug 02 10:10:47 MDT 2006] CLIPageGenerator - generateOutput - status => FAIL

TRACE [Wed Aug 02 10:10:47 MDT 2006] CLIPageGenerator - generateOutput - message => Unable to create entry.^324^NONE

TRACE [Wed Aug 02 10:10:48 MDT 2006] ServerPushThread: done

TRACE [Wed Aug 02 10:10:48 MDT 2006] ServerPushThread: done

TRACE [Wed Aug 02 10:10:49 MDT 2006] ServerPushThread: done

TRACE [Wed Aug 02 10:10:58 MDT 2006] sun.comm.cli.server.servlet.commLDAPAuth: shutting down. Total access count = 1

Message was edited by:

nate.wheeler

[4528 byte] By [nate.wheeler] at [2007-11-26 9:12:58]
«« accessing attributes sent from servlet
»» ZipException running sconadm register on Solaris 10 1/06
# 1

recently until I tried getting LDAP authentication to work so LDAP users could log into Sunrays.

Hm. so something changed, and broke your DA ability.

I'd start by looking at what changed..............

It looks like your DA user (amadmin, perhaps) no longer has rights to write to ldap.

jay_plesset at 2007-7-6 23:35:11 > top of Java-index,E-Mail, Calendar, & Collaboration,Sun Java System Messaging Server...
# 2

Frankly, I'm new to LDAP so I don't know really what changed. Its weird, I can do some things, but not others. Like I can assign service packages, but not change the login id or password of a user. So it doesn't look like amadmin can't change things.

The password encryption seemed to have changed from {SSHA} to {CRYPT}. Although I have no idea how to switch it back or where to look to see if it did.

Message was edited by:

nate.wheeler

natewheeler at 2007-7-6 23:35:11 > top of Java-index,E-Mail, Calendar, & Collaboration,Sun Java System Messaging Server...
# 3

> Frankly, I'm new to LDAP so I don't know really what

> changed.

No time like the present to start learning.

> Its weird, I can do some things, but not

> others. Like I can assign service packages, but not

> change the login id or password of a user. So it

> doesn't look like amadmin can't change things.

LDAP provides "ACI", or Access Control settings that can be changed, and create exactly the kinds of things you're looking at.

The Directory Console can view ACI

>

> The password encryption seemed to have changed from

> {SSHA} to {CRYPT}. Although I have no idea how to

> switch it back or where to look to see if it did.

Unlikely to have made any difference. That should be transparent to the application using DS.

Most of our applications don't compare the password entry, but attempt a BIND for that very reason.

Again, I'd be looking at your LDAP access logs for a clue to what's happening.

>

> Message was edited by:

> nate.wheeler

jay_plesset at 2007-7-6 23:35:11 > top of Java-index,E-Mail, Calendar, & Collaboration,Sun Java System Messaging Server...
# 4

> LDAP provides "ACI", or Access Control settings that

> can be changed, and create exactly the kinds of

> things you're looking at.

>

> The Directory Console can view ACI

I looked at the ACIs, its not easy to tell whats going on, but the ACIs on the new domain don't look much different than the ones on the old domains

> Again, I'd be looking at your LDAP access logs for a

> clue to what's happening.

Heres a log from the access log when I try to create a user. Its the only one with an 'err' number for the RESULT.

[03/Aug/2006:11:09:15 -0600] conn=30662 op=655 msgId=794 - ADD dn="uid=user,ou=People,o=domain,dc=server,dc=example,dc=com" authzid="dn:uid=amAdmin,ou=People,dc=server,dc=example,dc=com"

[03/Aug/2006:11:09:15 -0600] conn=30662 op=655 msgId=794 - RESULT err=19 tag=105 nentries=0 etime=0

I don't know what the error means, but there it is :P

natewheeler at 2007-7-6 23:35:11 > top of Java-index,E-Mail, Calendar, & Collaboration,Sun Java System Messaging Server...
# 5
Well,the good news is that I know what err=19 is.LDAP_CONSTRAINT_VIOLATIONI'd be looking at what's not "much different" in particular. .. .
jay_plesset at 2007-7-6 23:35:11 > top of Java-index,E-Mail, Calendar, & Collaboration,Sun Java System Messaging Server...
# 6
haha, ok I guess I'll take a closer look. Thanks!
natewheeler at 2007-7-6 23:35:11 > top of Java-index,E-Mail, Calendar, & Collaboration,Sun Java System Messaging Server...
# 7

> LDAP_CONSTRAINT_VIOLATION

Jay, you're freaking awesome! I looked at what the error code meant exactly and saw:

The server is configured to check the password syntax, and the length of the new password is less than the minimum password length.

I rememebered seeing something about the password length requirement changing with idsconfig. I just added a user successfully. If I wasn't poor, I'd pay you :P I should know to check error codes like that, oh well, nice reminder.

Thanks again.

natewheeler at 2007-7-6 23:35:11 > top of Java-index,E-Mail, Calendar, & Collaboration,Sun Java System Messaging Server...
# 8
I think there's documentation for ldap error codes in the ldap doc. I keep a link to that stuff....I use it all the time.
jay_plesset at 2007-7-6 23:35:11 > top of Java-index,E-Mail, Calendar, & Collaboration,Sun Java System Messaging Server...
E-Mail, Calendar, & Collaboration
Sun Java System Messaging Server

E-Mail, Calendar, & Collaboration New Topic

E-Mail, Calendar, & Collaboration Hot Topic

E-Mail, Calendar, & Collaboration

All Classified