topic 2008R2 AD-LDAP and Alfresco: SvcErr: DSID-031401E0, problem 5010 (UNAVAIL_EXTENSION) in Alfresco Archive https://connect.hyland.com/t5/alfresco-archive/2008r2-ad-ldap-and-alfresco-svcerr-dsid-031401e0-problem-5010/m-p/292765#M245895 <HTML><HEAD></HEAD><BODY><SPAN>Hello all.</SPAN><BR /><BR /><SPAN>I have configured Alfresco 4.0.d running on CentOS 5 and am successfully authenticating with AD LDAP.&nbsp; I did this several months ago.&nbsp; When I checked my logs recently I noticed that the nightly scheduled LDAP sync's were failing.&nbsp; People who were in AD when this was originally configured can login.&nbsp; I cannot see people in Alfresco who have recently been added to AD.</SPAN><BR /><BR /><SPAN>After troubleshooting the issue, here is the latest state of the logs:</SPAN><BR /><BR /><SPAN>2013-03-23 00:00:42,735&nbsp; ERROR [quartz.core.JobRunShell] [DefaultScheduler_Worker-5] Job DEFAULT.ldapPeopleJobDetail threw an unhandled Exception:</SPAN><BR /><SPAN> org.alfresco.error.AlfrescoRuntimeException: 02231303 User and group import failed</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; at org.alfresco.repo.security.sync.ldap.LDAPUserRegistry.processQuery(LDAPUserRegistry.java:1141)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; at org.alfresco.repo.security.sync.ldap.LDAPUserRegistry.getGroups(LDAPUserRegistry.java:667)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; at org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer.syncWithPlugin(ChainingUserRegistrySynchronizer.java:632)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; at org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer.synchronize(ChainingUserRegistrySynchronizer.java:435)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; at org.alfresco.repo.security.sync.UserRegistrySynchronizerJob$1.doWork(UserRegistrySynchronizerJob.java:51)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; at org.alfresco.repo.security.authentication.AuthenticationUtil.runAs(AuthenticationUtil.java:519)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; at org.alfresco.repo.security.sync.UserRegistrySynchronizerJob.execute(UserRegistrySynchronizerJob.java:47)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; at org.quartz.core.JobRunShell.run(JobRunShell.java:216)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:563)</SPAN><BR /><SPAN>Caused by: javax.naming.OperationNotSupportedException: [LDAP: error code 12 - 00002040: SvcErr: DSID-031401E0, problem 5010 (UNAVAIL_EXTENSION), data 0</SPAN><BR /><SPAN>^@]; remaining name 'DC=example,DC=com'</SPAN><BR /><BR /><SPAN>Here is the contents of ldap-ad-authentication.properties:</SPAN><BR /><BR /><SPAN># This flag enables use of this LDAP subsystem for authentication. It may be</SPAN><BR /><SPAN># that this subsytem should only be used for synchronization, in which case</SPAN><BR /><SPAN># this flag should be set to false.</SPAN><BR /><SPAN>ldap.authentication.active=true</SPAN><BR /><BR /><SPAN>#</SPAN><BR /><SPAN># This properties file brings together the common options for LDAP authentication rather than editing the bean definitions</SPAN><BR /><SPAN>#</SPAN><BR /><SPAN>ldap.authentication.allowGuestLogin=true</SPAN><BR /><BR /><SPAN># How to map the user id entered by the user to taht passed through to LDAP</SPAN><BR /><SPAN># In Active Directory, this can either be the user principal name (UPN) or DN.</SPAN><BR /><SPAN># UPNs are in the form &lt;sAMAccountName&gt;@domain and are held in the userPrincipalName attribute of a user</SPAN><BR /><SPAN><A class="jive-link-email-small" href="https://migration33.stage.lithium.com/" rel="nofollow noopener noreferrer">ldap.authentication.userNameFormat=%s@example.com</A></SPAN><BR /><BR /><SPAN># The LDAP context factory to use</SPAN><BR /><SPAN>ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory</SPAN><BR /><BR /><SPAN># The URL to connect to the LDAP server</SPAN><BR /><SPAN>ldap.authentication.java.naming.provider.url=ldap://1.2.3.4:389</SPAN><BR /><BR /><SPAN># The authentication mechanism to use for password validation</SPAN><BR /><SPAN>ldap.authentication.java.naming.security.authentication=simple</SPAN><BR /><BR /><SPAN># Escape commas entered by the user at bind time</SPAN><BR /><SPAN># Useful when using simple authentication and the CN is part of the DN and contains commas</SPAN><BR /><SPAN>ldap.authentication.escapeCommasInBind=false</SPAN><BR /><BR /><SPAN># Escape commas entered by the user when setting the authenticated user</SPAN><BR /><SPAN># Useful when using simple authentication and the CN is part of the DN and contains commas, and the escaped \, is</SPAN><BR /><SPAN># pulled in as part of an LDAP sync</SPAN><BR /><SPAN># If this option is set to true it will break the default home folder provider as space names can not contain \</SPAN><BR /><SPAN>ldap.authentication.escapeCommasInUid=false</SPAN><BR /><BR /><SPAN># Comma separated list of user names who should be considered administrators by default</SPAN><BR /><SPAN>ldap.authentication.defaultAdministratorUserNames=admin,user1,user2</SPAN><BR /><BR /><SPAN># This flag enables use of this LDAP subsystem for user and group</SPAN><BR /><SPAN># synchronization. It may be that this subsytem should only be used for</SPAN><BR /><SPAN># authentication, in which case this flag should be set to false.</SPAN><BR /><SPAN>ldap.synchronization.active=true</SPAN><BR /><BR /><SPAN># The authentication mechanism to use for synchronization</SPAN><BR /><SPAN>ldap.synchronization.java.naming.security.authentication=simple</SPAN><BR /><BR /><SPAN># The default principal to bind with (only used for LDAP sync). This should be a UPN or DN</SPAN><BR /><SPAN>ldap.synchronization.java.naming.security.principal=CN=Alfresco LDAP,OU=Service Accounts,DC=example,DC=com</SPAN><BR /><BR /><SPAN># The password for the default principal (only used for LDAP sync)</SPAN><BR /><SPAN>ldap.synchronization.java.naming.security.credentials=supersecret</SPAN><BR /><BR /><SPAN># If positive, this property indicates that RFC 2696 paged results should be</SPAN><BR /><SPAN># used to split query results into batches of the specified size. This</SPAN><BR /><SPAN># overcomes any size limits imposed by the LDAP server.</SPAN><BR /><SPAN>#former entry #ldap.synchronization.queryBatchSize=1000</SPAN><BR /><SPAN>ldap.synchronization.queryBatchSize=100</SPAN><BR /><BR /><SPAN># If positive, this property indicates that range retrieval should be used to fetch</SPAN><BR /><SPAN># multi-valued attributes (such as member) in batches of the specified size.</SPAN><BR /><SPAN># Overcomes any size limits imposed by Active Directory.</SPAN><BR /><SPAN>#former entry #ldap.synchronization.attributeBatchSize=1000</SPAN><BR /><SPAN>ldap.synchronization.attributeBatchSize=100</SPAN><BR /><BR /><SPAN># The query to select all objects that represent the groups to import.</SPAN><BR /><SPAN>ldap.synchronization.groupQuery=(objectclass\=group)</SPAN><BR /><BR /><SPAN># The query to select objects that represent the groups to import that have changed since a certain time.</SPAN><BR /><SPAN>ldap.synchronization.groupDifferentialQuery=(&amp;(objectclass\=group)(!(modifyTimestamp&lt;\={0})))</SPAN><BR /><BR /><SPAN># The query to select all objects that represent the users to import.</SPAN><BR /><SPAN>ldap.synchronization.personQuery=(&amp;(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512))</SPAN><BR /><BR /><SPAN># The query to select objects that represent the users to import that have changed since a certain time.</SPAN><BR /><SPAN>ldap.synchronization.personDifferentialQuery=(&amp;(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512)(!(modifyTimestamp&lt;\={0})))</SPAN><BR /><BR /><SPAN># The group search base restricts the LDAP group query to a sub section of tree on the LDAP server.</SPAN><BR /><SPAN>ldap.synchronization.groupSearchBase=DC\=example,DC\=com</SPAN><BR /><BR /><SPAN># The user search base restricts the LDAP user query to a sub section of tree on the LDAP server.</SPAN><BR /><SPAN>ldap.synchronization.userSearchBase=DC\=example,DC\=com</SPAN><BR /><BR /><SPAN># The name of the operational attribute recording the last update time for a group or user.</SPAN><BR /><SPAN>ldap.synchronization.modifyTimestampAttributeName=whenChanged</SPAN><BR /><SPAN>#previous entry #ldap.synchronization.modifyTimestampAttributeName=modifyTimestamp</SPAN><BR /><BR /><SPAN># The timestamp format. Unfortunately, this varies between directory servers.</SPAN><BR /><SPAN>ldap.synchronization.timestampFormat=yyyyMMddHHmmss'.0Z'</SPAN><BR /><BR /><SPAN># The attribute name on people objects found in LDAP to use as the uid in Alfresco</SPAN><BR /><SPAN>ldap.synchronization.userIdAttributeName=sAMAccountName</SPAN><BR /><BR /><SPAN># The attribute on person objects in LDAP to map to the first name property in Alfresco</SPAN><BR /><SPAN>ldap.synchronization.userFirstNameAttributeName=givenName</SPAN><BR /><BR /><SPAN># The attribute on person objects in LDAP to map to the last name property in Alfresco</SPAN><BR /><SPAN>ldap.synchronization.userLastNameAttributeName=sn</SPAN><BR /><BR /><SPAN># The attribute on person objects in LDAP to map to the email property in Alfresco</SPAN><BR /><SPAN>ldap.synchronization.userEmailAttributeName=mail</SPAN><BR /><BR /><SPAN># The attribute on person objects in LDAP to map to the organizational id&nbsp; property in Alfresco</SPAN><BR /><SPAN>ldap.synchronization.userOrganizationalIdAttributeName=company</SPAN><BR /><BR /><SPAN># The default home folder provider to use for people created via LDAP import</SPAN><BR /><SPAN>ldap.synchronization.defaultHomeFolderProvider=largeHomeFolderProvider</SPAN><BR /><BR /><SPAN># The attribute on LDAP group objects to map to the authority name property in Alfresco</SPAN><BR /><SPAN>ldap.synchronization.groupIdAttributeName=cn</SPAN><BR /><BR /><SPAN># The attribute on LDAP group objects to map to the authority display name property in Alfresco</SPAN><BR /><SPAN>ldap.synchronization.groupDisplayNameAttributeName=displayName</SPAN><BR /><BR /><SPAN># The group type in LDAP</SPAN><BR /><SPAN>ldap.synchronization.groupType=group</SPAN><BR /><BR /><SPAN># The person type in LDAP</SPAN><BR /><SPAN>ldap.synchronization.personType=user</SPAN><BR /><BR /><SPAN># The attribute in LDAP on group objects that defines the DN for its members</SPAN><BR /><SPAN>ldap.synchronization.groupMemberAttributeName=member</SPAN><BR /><BR /><SPAN># If true progress estimation is enabled. When enabled, the user query has to be run twice in order to count entries.</SPAN><BR /><SPAN>ldap.synchronization.enableProgressEstimation=true</SPAN><BR /><BR /><SPAN>So based on this error:</SPAN><BR /><SPAN>[LDAP: error code 12 - 00002040: SvcErr: DSID-031401E0, problem 5010 (UNAVAIL_EXTENSION), data 0</SPAN><BR /><SPAN>^@]; remaining name 'DC=example,DC=com'</SPAN><BR /><BR /><SPAN>I found this article:</SPAN><BR /><A href="http://support.microsoft.com/kb/977180" rel="nofollow noopener noreferrer">http://support.microsoft.com/kb/977180</A><BR /><BR /><SPAN>I don't have access to the Windows environment.&nbsp; So here is the question for the community:</SPAN><BR /><BR /><SPAN>Am I doing something wrong or is something mis-configured somewhere?&nbsp; If no to those, is there a workaround?&nbsp; Or is the only solution to get the Windows team to apply the update mentioned in the microsoft article?</SPAN><BR /><BR /><SPAN>Thanks!</SPAN></BODY></HTML> Sat, 23 Mar 2013 17:51:04 GMT locutus 2013-03-23T17:51:04Z 2008R2 AD-LDAP and Alfresco: SvcErr: DSID-031401E0, problem 5010 (UNAVAIL_EXTENSION) https://connect.hyland.com/t5/alfresco-archive/2008r2-ad-ldap-and-alfresco-svcerr-dsid-031401e0-problem-5010/m-p/292765#M245895 Hello all.I have configured Alfresco 4.0.d running on CentOS 5 and am successfully authenticating with AD LDAP.&nbsp; I did this several months ago.&nbsp; When I checked my logs recently I noticed that the nightly scheduled LDAP sync's were failing.&nbsp; People who were in AD when this was originally configured c Sat, 23 Mar 2013 17:51:04 GMT https://connect.hyland.com/t5/alfresco-archive/2008r2-ad-ldap-and-alfresco-svcerr-dsid-031401e0-problem-5010/m-p/292765#M245895 locutus 2013-03-23T17:51:04Z Re: 2008R2 AD-LDAP and Alfresco: SvcErr: DSID-031401E0, problem 5010 (UNAVAIL_EXTENSION) https://connect.hyland.com/t5/alfresco-archive/2008r2-ad-ldap-and-alfresco-svcerr-dsid-031401e0-problem-5010/m-p/292766#M245896 <HTML><HEAD></HEAD><BODY><SPAN>It is possible you are hitting this issue: </SPAN><A href="https://issues.alfresco.com/jira/browse/MNT-5897" rel="nofollow noopener noreferrer">https://issues.alfresco.com/jira/browse/MNT-5897</A><BR /><SPAN>Just adapt your queries and try again.</SPAN></BODY></HTML> Sat, 23 Mar 2013 22:50:21 GMT https://connect.hyland.com/t5/alfresco-archive/2008r2-ad-ldap-and-alfresco-svcerr-dsid-031401e0-problem-5010/m-p/292766#M245896 michaelböckling 2013-03-23T22:50:21Z Re: 2008R2 AD-LDAP and Alfresco: SvcErr: DSID-031401E0, problem 5010 (UNAVAIL_EXTENSION) https://connect.hyland.com/t5/alfresco-archive/2008r2-ad-ldap-and-alfresco-svcerr-dsid-031401e0-problem-5010/m-p/292767#M245897 <HTML><HEAD></HEAD><BODY><SPAN>I had restarted Alfresco after making your suggested changes but I still could not see the ldap user in Alfresco.&nbsp; I tried again the next day (after the scheduled sync job ran) and I can see the user now.</SPAN><BR /><BR /><SPAN>Saw this in catalina.out - thanks!</SPAN><BR /><SPAN> 2013-03-26 00:01:11,822&nbsp; WARN&nbsp; [security.sync.ChainingUserRegistrySynchronizer] [ldap-ad1 User Creation and Association2] Updating user 'dmcneill'. This user will in future be assumed to originate from user registry 'ldap-ad1'.</SPAN><BR /></BODY></HTML> Tue, 26 Mar 2013 13:56:24 GMT https://connect.hyland.com/t5/alfresco-archive/2008r2-ad-ldap-and-alfresco-svcerr-dsid-031401e0-problem-5010/m-p/292767#M245897 locutus 2013-03-26T13:56:24Z