AWA LDAPSync tool fails with LDAP group could not be found

Issue/Introduction:

LDAPSync tools fails with error:

LDAP group '<LDAP_GROUP>' could not be found. Please check spelling and schema settings, or check user permissions of the user used to search LDAP. If the group was deleted from LDAP, remove the mapping.

Investigation
Run the LDAPSync with option -I TRACE to verify what request is being sent to LDAP group '<LDAP_GROUP>'.

Example:

java -jar ldap-sync-2.1.1.jar -I TRACE -cl "100"

The output shows:
2018-06-25 12:18:21.900 [main] c.a.s.l.s.BaseSynchronizationStep        INFO   Load group mapping from the client config file:
2018-06-25 12:18:21.908 [main] c.a.s.l.s.BaseSynchronizationStep        INFO   | LDAP_ADMINS -> AE_ADMINS
2018-06-25 12:18:21.908 [main] c.a.s.l.s.AESynchronizationStep          INFO   ===== Start sync LDAP_ADMINS -> AE_ADMINS
2018-06-25 12:18:21.908 [main] c.a.s.l.l.LDAPService                    DEBUG Validate LDAP group exsiting LDAP_ADMINS
2018-06-25 12:18:21.910 [main] c.a.s.l.l.LDAPService                    TRACE LDAP, isGroupExist MessageType : SEARCH_REQUEST
Message ID : -1
    SearchRequest
        baseDn : 'dc=yournet,dc=global,dc=company,dc=com,dc=yournet,dc=global,dc=company,dc=com'
        filter : '(&(objectclass=group)(cn=LDAP_ADMINS))'
        scope : whole subtree
        typesOnly : false
        Size Limit : no limit
        Time Limit : 30
        Deref Aliases : deref Always
        attributes : 'cn'
[email protected]b700f4
2018-06-25 12:18:21.910 [main] c.a.s.l.l.LDAPService                    DEBUG Send request to LDAP server
2018-06-25 12:18:21.910 [main] o.a.d.l.c.a.LdapNetworkConnection        DEBUG Sending request
MessageType : SEARCH_REQUEST
Message ID : 6
    SearchRequest
        baseDn : 'dc=yournet,dc=global,dc=company,dc=com,dc=yournet,dc=global,dc=company,dc=com'
        filter : '(&(cn=LDAP_ADMINS)(objectclass=group))'
        scope : whole subtree
        typesOnly : false
        Size Limit : no limit
        Time Limit : 30
        Deref Aliases : deref Always
        attributes : 'cn'
[email protected]b7874b
2018-06-25 12:18:21.910 [main] o.a.d.l.c.a.LdapNetworkConnection        DEBUG Adding <6, org.apache.directory.ldap.client.api.future.SearchFuture>
2018-06-25 12:18:21.947 [NioProcessor-2] o.a.d.l.c.a.LdapNetworkConnection        DEBUG -------> MessageType : SEARCH_RESULT_DONE
Message ID : 6
    Search Result Done
       Ldap Result
            Result code : (NO_SUCH_OBJECT) noSuchObject
            Matched Dn : 'DC=adobenet,DC=global,DC=adobe,DC=com'
            Diagnostic message : '0000208D: NameErr: DSID-03100238, problem 2001 (NO_OBJECT), data 0, best match of:
       'DC=yournet,DC=global,DC=company,DC=com'
'
Message received <-------
2018-06-25 12:18:21.947 [NioProcessor-2] o.a.d.l.c.a.LdapNetworkConnection        DEBUG Getting <6, org.apache.directory.ldap.client.api.future.SearchFuture>
2018-06-25 12:18:21.947 [NioProcessor-2] o.a.d.l.c.a.LdapNetworkConnection        DEBUG Search failed : MessageType : SEARCH_RESULT_DONE
Message ID : 6
    Search Result Done
        Ldap Result
            Result code : (NO_SUCH_OBJECT) noSuchObject
            Matched Dn : 'DC=yournet,DC=global,DC=company,DC=com'
            Diagnostic message : '0000208D: NameErr: DSID-03100238, problem 2001 (NO_OBJECT), data 0, best match of:
       'DC=yournet,DC=global,DC=company,DC=com'
'
2018-06-25 12:18:21.947 [NioProcessor-2] o.a.d.l.c.a.LdapNetworkConnection        DEBUG Removing <6, org.apache.directory.ldap.client.api.future.SearchFuture>
2018-06-25 12:18:21.947 [main] c.a.s.l.l.LDAPService                    WARN   LDAP group 'LDAP_ADMINS' could not be found. Please check spelling and schema settings, or check user permissions of the user used to search LDAP. If the group was deleted from LDAP, remove the mapping.

Cause:

The trace output shows duplicate baseDn, where the userDN and groupDN are configured the same as the baseDn in the client_clientnumber.xml.

baseDn : 'dc=adobenet,dc=global,dc=adobe,dc=com,dc=adobenet,dc=global,dc=adobe,dc=com'
filter : '(&(objectclass=group)(cn=BAO_ADMINS))'

The userDN and groupDN are only configured to retrieve specific data within these nodes and the node located UNDER baseDN.

Environment:

Release: AOMAVA99000-2.1-Automic-Operations Manager-Avaloq Agent(3rd Party)
Component:

Resolution:

Remove the values from the userDN and groupDN in the client_clientnumber.xml (i.e. client_100.xml):

<?xml version="1.0" encoding="UTF-8"?>
<Configuration>
                <Schema baseDN="dc=yournet,dc=global,dc=company,dc=com"
                                userDN=""
                                groupDN=""
                                updateDn=""/>

                <AE userDomain="ADOBENET"
                                autoDeactivateUsers="false"
                />

                <GroupMappings> <map ae="AE_ADMINS" ldap="LDAP_ADMINS"/> </GroupMappings>
</Configuration>