Active Directory Endpoint Connection Error ADS Directory Add Can't get object category attribute
search cancel

Active Directory Endpoint Connection Error ADS Directory Add Can't get object category attribute

book

Article ID: 216856

calendar_today

Updated On:

Products

CA Identity Manager CA Identity Suite

Issue/Introduction

Identity Manager fails to open or provision to Active Directory endpoints, returning a "Can't get object category attribute" error. This typically occurs when mandatory metadata attributes for the Active Directory endpoint type become missing or corrupted within the Provisioning Directory (IMPD).

Symptoms

  • Provisioning Manager displays: Active Directory read failed: ADS Directory Add: Can't get object category attribute.
  • Error code ETA_E_0020 or ETA_E_0019 when viewing Active Directory account properties.
  • Explore and Correlate (E&C) results are incomplete (e.g., only "BuiltIn" and "Groups" containers are visible).
  • Inability to create new duplicate AD Endpoints (ETA_E_0003).
  • Issue often surfaces following Windows security patching or Provisioning Server restarts.

Environment

Identity Manager 14.x

Cause

The eTADSObjectCategory and eTADS-DefaultContext attributes for an acquired Active Directory endpoint have become empty or corrupted in the Provisioning Directory (IMPD). Even if only one endpoint is corrupted, it can impact the retrieval logic for all Active Directory endpoints.

20210608:050107:TID=xxxxxx:Search  :xxxx:xxxxx:I:+me=ActiveDirectory,dc=im] => GRANTED
20210608:050107:TID=xxxxxx:Search  :xxxxx:xxxx:S: DB Search (eNamespaceName=ActiveDirectory) Requested by User etaadmin - TenantNo
20210608:050107:TID=xxxxxx:Search  :xxxxx:xxxx:S:+tSet
20210608:050107:TID=xxxxxx:Search  :xxxxx:xxxx:P:   URL: ldaps://xyzxyzxyz:20391
20210608:050107:TID=xxxxxx:Search  :xxxxx:xxxx:P:   base-dn: eNamespaceName=ActiveDirectory,dc=im
20210608:050107:TID=xxxxxx:Search  :xxxxx:xxxx:P:   scope : ONE-LEVEL
20210608:050107:TID=xxxxxx:Search  :xxxxx:xxxx:P:   filter : (&(objectClass=eTADSDirectory)(objectClass=eTADSDirectory))
20210608:050107:TID=xxxxxx:Search  :xxxxx:xxxx:P:   attrs : eTADSObjectCategory, eTADS-DefaultContext, eTADSPrimaryServer, objec
20210608:050107:TID=xxxxxx:Search  :xxxxx:xxxx:P:+  tClass
20210608:050107:TID=xxxxxx:Search  :xxxxx:xxxx:F: SUCCESS: DB Search (eNamespaceName=ActiveDirectory), entry-count: 3, attributes:
20210608:050107:TID=xxxxxx:Search  :xxxxx:xxxx:F:+ objectClass,eTADSPrimaryServer
20210608:050107:TID=xxxxxx:Search  :xxxx:xxxxx:I: FINAL SEARCH FILTER:
20210608:050107:TID=xxxxxx:Search  :xxxx:xxxxx:I: objectClass=eTADSDirectory
20210608:050107:TID=xxxxxx:Search  :xxxx:xxxxx:F: SUCCESS: Child Search (eNamespaceName=ActiveDirectory), entry-count: 3, attribut
20210608:050107:TID=xxxxxx:Search  :xxxx:xxxxx:F:+es: objectClass,eTADSPrimaryServer
20210608:050107:TID=xxxxxx:SyncQuery :xxxxx:xxxx:I: Connector Initialization FAILED
20210608:050107:TID=xxxxxx:SyncQuery :xxxxx:xxxx:I:
20210608:050107:TID=xxxxxx:SyncQuery :xxxxx:xxxx:I: Intermediate Sync Entry:
20210608:050107:TID=xxxxxx:SyncQuery :xxxxx:xxxx:I: ---------------------------
20210608:050107:TID=xxxxxx:SyncQuery :xxxxx:xxxx:I: dn: eTADSAccountName=xxxxxxx,eTADSOrgUnitName=xxxxxxxxxxxx,eTADSOrgUnitNam
20210608:050107:TID=xxxxxx:SyncQuery :xxxxx:xxxx:I:+e=xx,eTADSOrgUnitName=xxxxx,eTADSOrgUnitName=xxxx,eTADSDirectoryName=Ac

Resolution

  1. Identify the Missing Data:

    • Use a tool like JXplorer to connect to the IMPD (typically Port 20394 for vApp or 20389 for On-Premise).
    • Navigate to the affected Active Directory endpoint and check the attributes eTADSObjectCategory and eTADS-DefaultContext.
    • Compare these values with a working Active Directory endpoint if available.

  2. Restore the Attributes:

    • Stop the Provisioning Server and Connector Server (CCS) services.
    • In JXplorer, manually populate the missing values.
      • Example eTADSObjectCategory: CN=Domain-DNS,CN=Schema,CN=Configuration,DC=yourdomain,DC=com
      • Example eTADS-DefaultContext: DC=yourdomain,DC=com (or .com depending on your specific schema context).
    • Note: Consult your Active Directory Administrator to ensure the Category string matches your domain schema exactly.

  3. Restart and Verify:

    • Restart the Provisioning Server and Connector Server services.
    • If containers are still missing during E&C, update the AD endpoint password in Identity Manager and restart the CCS service again.

Additional Information

  • Check all acquired AD endpoints. Data corruption in a single endpoint can block provisioning tasks for the entire endpoint type.
  • For persistent issues, verify connectivity between the Provisioning Server and the Connector Server on ports 20411 (JCS) or 20410 (CCS).
Powered by Wolken Software