vIDM Directory Sync Fails with "java.net.URISyntaxException: Illegal character at index 76"

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

When attempting to perform a background directory synchronization in VMware Identity Manager (vIDM), the synchronization process aborts unexpectedly.

A detailed review of the /opt/vmware/horizon/workspace/logs/connector-dir-sync.log file isolates the exact point of failure to a fatal syntax error:

java.net.URISyntaxException: Illegal character in path at index 76

This exception halts the background connector worker process, preventing the successful evaluation and synchronization of directory objects.

Environment

VMware Identity Manager (vIDM) 3.3.7

Cause

The root cause of this failure is a Data Type Mismatch and Encoding Failure within the vIDM persistence layer.

In the vIDM architecture, the background synchronization engine executes internal REST API calls against the local Tomcat application to construct the membership array mapping between users and groups. The URISyntaxException is triggered because a binary Active Directory attribute (such as objectGUID or objectSid) is ingested by the sync worker and stored in the database as a literal, unencoded string, rather than being properly serialized into a hexadecimal format.

When the Tomcat service attempts to use this raw binary string to dynamically construct the HTTP request path (for example: https://localhost:443/.../sync/groups/ =Dk@ Z f /memberswithdirectness), the unescaped binary characters break the standard URL format constraints. The Java runtime encounters these illegal characters exactly at index 76 of the constructed string, throwing the URISyntaxException and immediately aborting the synchronization controller.

Resolution

Implement Manual User Addition

To avoid the URISyntaxException caused by the group membership evaluation phase, you must bypass the automated group synchronization.

1. Halt Group Synchronization: Remove the affected Active Directory groups from the sync scope, as attempting to sync them will repeatedly trigger the URI syntax crash.

2. Add Users by DN: Manually add the specific, required users directly into the vIDM directory by specifying their full Distinguished Name (DN) path.

3. Validate: By adding users via their explicit DN, the platform skips the group membership mapping REST call that relies on the corrupted URI path, allowing the individuals to sync and authenticate successfully.