Errors attempting to add acid to group profile in LDAP
Article ID: 232819
Updated On:
Products
Issue/Introduction
User is attempting to add acid to group profile, but getting various errors. Unable to determine the LDAP syntax.
Tried this:
DN: tssprofile=profile,tssadmingrp=profiles,host=CALDAP,o=DST,c=US
changetype: modify
add: member
Member: Z11111
Get this in LDAP trace:
>>> dnPretty: <Z11111>
=> ldap_bv2dn(Z11111,0)
ldap_err2string
<= ldap_bv2dn(Z11111)=-4 Decoding error
send_ldap_result: conn=1045 op=2 p=3
send_ldap_result: err=21 matched="" text="member: value #0 invalid per syntax"
Thinking full member DN is required, tried this for member:
Member: tssacid=Z11111,tssadmingrp=acids,host=CALDAP,o=DST,c=US
Got this in LDAP trace:
(28929908)Modify_Tssacid_Object add/rep field(member),
value(tssacid=Z11111,tssadmingrp=acids,host=CALDAP,o=DST,c=US)
send_ldap_result: conn=1035 op=2 p=3
send_ldap_result: err=80 matched="" text="LDP2403E Modify unknown error for(member),
value(tssacid=Z11111,tssadmingrp=acids,
and this on the client:
LDAP error! Other: LDP24084 Modify of field(member) not supported.
Acid Z11111 is used in the above example.
Environment
Release : 15.1
Component : LDAP SERVER FOR Z/OS
Resolution
The LDAP doc calls the naming_mode = im
Web Administrator mode.
This is a mode to allow more attributes to be changed that weren't allowed to be changed before and the attribute names are different as well. The im comes from a product called Identity Manager that Broadcom has to administer the ESMs using naming_mode im.
If a user is trying to take existing IM commands, then im mode is needed.
There is no way to update profiles for an ACID in TSS naming mode.
CALDAP can run in both im mode and tss mode at the same time.
For example, in the slapd.conf:
database catss_utfsuffix "host=CALDAP,o=DST,c=US"naming_mode tss
To also have im naming just add:
database catss_utfsuffix "host=CALDAP_IM,o=DST,c=us"naming_mode im
Use this suffix for your dn when making requests to LDAP for im mode.
Feedback
