PAM-LDAP-0018: Error Adding user and PAM-CMN-0234: User add failed error during LDAP group refresh

Products

• CA Privileged Access Manager (PAM)
• CA Privileged Access Manager - Server Control (PAMSC)
• CA Privileged Identity Management Endpoint (PIM)
• CA Threat Analytics for PAM

Issue/Introduction

Refreshing a previously imported LDAP (Active Directory) user group fails to add a new group member to PAM, showing the following error:

PAM-LDAP-0018: Error Adding user CN= ... PAM-CMN-0234: User add failed

Environment

CA Privileged Access Manager (PAM) integrated with an LDAP or Active Directory (AD) server.

Cause

The affected user was configured with an incorrectly formatted email address in Active Directory. 

Resolution

After fixing the email address on the Active Directory side, the user was added successfully to PAM during the next user group refresh.

Additional Information

An invalid email address is just one problem that can cause a user import failure. If you see such error messages, but conclude that the affected user is configured correctly on the AD or LDAP server side, contact Support.