Group search failure with findGroupsAdminCanManageInScope error during Modify User task

Products

• CA Identity Manager
• CA Identity Suite

Issue/Introduction

When administrators attempt to search for groups to add to a user within a "Modify User" task, the search fails with a specific scope-related exception. This typically indicates a data inconsistency within the user store regarding group administrative ownership.

The Identity Manager (IM) user interface or server logs display the following error during a group search: findGroupsAdminCanManageInScope

Environment

 Identity Manager

Cause

This error occurs when a group object contains a "well-known" attribute pointer (typically imGroupAdminGroup or %GROUP_ADMIN_GROUP%) that references a group DN (Distinguished Name) that no longer exists in the directory. The system fails when it attempts to validate the administrative scope against this missing object.

Resolution

1. Identify the Corrupt Data Enable debug logging to identify which specific group object is causing the failure:

1. Set the IM Server log level to DEBUG for the following category: ims.llsdk.directory.jndi
2. Reproduce the error in the User Console.
3. Examine the server.log. Locate the last LDAP search request performed immediately before the findGroupsAdminCanManageInScope exception. This search will reveal the DN of the group with the invalid pointer.

2. Remediate the Inconsistency Once the problematic group(s) are identified, use one of the following methods to resolve the error:

• Option A (Data Correction): Use a directory tool (such as JXplorer or ADSI Edit) to locate the group and remove the value from the imGroupAdminGroup attribute.
• Option B (Object Restoration): Recreate the missing group in the directory using the exact DN found during the log analysis.