Errors attempting to add acid to group profile in LDAP
search cancel

Errors attempting to add acid to group profile in LDAP

book

Article ID: 232819

calendar_today

Updated On:

Products

Top Secret - LDAP

Issue/Introduction

User is attempting to add acid to group profile, but getting various errors.   Unable to determine the LDAP syntax.

Tried this:
DN: tssprofile=profile,tssadmingrp=profiles,host=CALDAP,o=DST,c=US
changetype: modify
add: member
Member: Z11111

Get this in LDAP trace:
>>> dnPretty: <Z11111>
=> ldap_bv2dn(Z11111,0)
ldap_err2string
<= ldap_bv2dn(Z11111)=-4 Decoding error
send_ldap_result: conn=1045 op=2 p=3
send_ldap_result: err=21 matched="" text="member: value #0 invalid per syntax"

Thinking full member DN is required, tried this for member:
Member: tssacid=Z11111,tssadmingrp=acids,host=CALDAP,o=DST,c=US

Got this in LDAP trace:
(28929908)Modify_Tssacid_Object add/rep field(member),
value(tssacid=Z11111,tssadmingrp=acids,host=CALDAP,o=DST,c=US)
send_ldap_result: conn=1035 op=2 p=3
send_ldap_result: err=80 matched="" text="LDP2403E Modify unknown error for(member),
value(tssacid=Z11111,tssadmingrp=acids,

and this on the client:
LDAP error! Other: LDP24084 Modify of field(member) not supported.

Acid Z11111 is used in the above example.

Environment

Release : 15.1

Component : LDAP SERVER FOR Z/OS

Resolution

The LDAP doc calls the naming_mode = im 

Web Administrator mode.

This is a mode to allow more attributes to be changed that weren't allowed to be changed before and the attribute names are different as well.  The im comes from a product called Identity Manager that Broadcom has to administer the ESMs using naming_mode im.

If a user is trying to take existing IM commands, then im mode is needed.

There is no way to update profiles for an ACID in TSS naming mode.  
CALDAP can run in both im mode and tss mode at the same time.
For example, in the slapd.conf:

database           catss_utfsuffix             "host=CALDAP,o=DST,c=US"naming_mode        tss

To also have im naming just add:

database           catss_utfsuffix             "host=CALDAP_IM,o=DST,c=us"naming_mode        im

 

 Use this suffix for your dn when making requests to LDAP for im mode.