User Import failed due to Invalid LDAP User record with error "Title cannot exceed 64 characters"

Products

• Data Loss Prevention Endpoint Prevent

Issue/Introduction

We have in some issues with User Import in the Enforce Console as it is failing numerous times.

 

Environment

Release : 15.8

Component : Default-Sym

Cause

Looking at the Enforce Tomcat localhost log it shows there are invalid records where the number of characters for the Title are exceeding the expected size.

File: Enforce\logs\tomcat\localhost.2022-05-08.log
Date: 08/05/2022 08:00:04
Thread: 441
Level: FINE
Source: com.vontu.enforce.domainlayer.datauser.source.ad.LdapUserListValidatingFilter
Message: Invalid LDAP User record : DN=CN=Smith\, David,OU=Employees,OU=Users,OU=US,OU=Americas,OU=Users and Groups,DC=XXXXX,DC=com; errors: Title cannot exceed 64 characters.

File: Enforce\logs\tomcat\localhost.2022-05-08.log
Date: 08/05/2022 08:00:04
Thread: 441
Level: FINE
Source: com.vontu.enforce.domainlayer.datauser.source.ad.LdapUserListValidatingFilter
Message: Invalid LDAP User record : DN=CN=Smith\, Aaron,OU=Okta Enabled,OU=Staging-1234,OU=Staging,OU=Users and Groups,DC=XXXXX,DC=com; errors: Title cannot exceed 64 characters.

File: Enforce\logs\tomcat\localhost.2022-05-08.log
Date: 08/05/2022 08:00:04
Thread: 441
Level: FINE
Source: com.vontu.enforce.domainlayer.datauser.source.ad.LdapUserListValidatingFilter
Message: Invalid LDAP User record : DN=CN=Wang\, Louise, OU=Employees,OU=Users,OU=US,OU=Americas,OU=Users and Groups,DC=XXXXX,DC=com; errors: Title cannot exceed 64 characters.

 

In the Enforce configuration the AD source only allowed 10 characters but more than that was being sent from AD which caused a failure as the size expected is exceeded. 

The HR team enter the title details for each user and there is no limits in AD that restrict their size being entered. 

 

Resolution

In the Enforce console go to System > Users > Data Sources and select your AD Data source. 

In the Advanced Options go and modify the AD custom Filter title to increase the number of characters from 10 by adding more '?'. 

From

(&(sAMAccountName=*)(givenName=*)(sn=*)(title=??????????))

to 63 or higher

(&(sAMAccountName=*)(givenName=*)(sn=*)(title=???????????????????????????????????????????????????????????????))

This resolves the User Import failure.