LDAP Sync Warns "False-Positive" and "Cannot Be Deleted" After Updating an Existing User Store Connection in VIP Enterprise Gateway

Products

• VIP Service

Issue/Introduction

When an existing LDAP user store connection in VIP Enterprise Gateway is updated in-place (for example, changing the host to point to a different LDAP provider such as Ping DS), LDAP simulation and sync runs may produce persistent `WARN` log entries reporting false-positive deletions. This article explains why these warnings occur.

The simulation logs contain entries similar to the following:

DEBUG "2026-06-11 22:11:56.354 GMT-0800" <server-ip> LDAPSync 0 0 0

  "actor=LDAPSyncService,op=Synchronization,

   text=[LDAPSyncMgr:finalizeDeletedRecords] Checking if the user <username> is to be deleted in the cloud."

WARN  "2026-06-11 22:11:56.354 GMT-0800" <server-ip> LDAPSync 0 0 0

  "actor=LDAPSyncService,op=Synchronization,

   text=[LDAPSyncMgr:finalizeDeletedRecords] False-positive. User <username> has account in multiple stores. Cannot be deleted."

Environment

Product : VIP Enterprise Gateway (VIP EG)

Cause

VIP Enterprise Gateway assigns and stores a unique entry identifier (entryUUID/GUID) for every user, tied to the specific user store connection through which they were originally synced. This GUID is stored in the VIP cloud alongside the username and serves as the binding key between a user account and its originating user store.

When an existing user store connection is **updated in-place** rather than deleted and recreated:

1. The VIP EG console assigns a new internal connection identifier to the updated store.

2. However, the VIP cloud still holds the **original GUIDs** that were generated from the previous LDAP connection.

3. During a subsequent LDAP sync, the system reads users from the new LDAP backend (which generates different entry UUIDs) and cannot match them to the old GUIDs stored in the VIP cloud.

4. As a result, the sync engine treats users returned by the new LDAP as belonging to a different store, while the users associated with the old GUIDs appear as absent from their original store — triggering the false-positive deletion evaluation.

5. The deletion is ultimately blocked because those same user accounts are detected in another store record, producing the 'False-positive. User has account in multiple stores. Cannot be deleted.' warning.

Resolution

Follow these steps to safely migrate or update your LDAP user store connection within the VIP Enterprise Gateway (EG) console.

Step 1 — Document the Existing User Store Configuration

Before making any changes, record all settings of your current user store connection. Ensure you have documented:

• Connection Details: LDAP host, port, and SSL/TLS settings.

• Authentication: Bind DN and credentials.

• Scope: Base DN and User Filter.

• Mappings: Group mappings.

• Policies: Any associated policy or rule references.

Step 2 — Identify All References to the Existing User Store

Locate every configuration that references the current user store. Thoroughly check the following areas:

• Validation server configurations

• VIP Administrator configuration

• Console authentication settings

• Any policy or workflow that specifies the user store

Step 3 — Create a New User Store Connection

In the VIP EG console, create a new user store connection configured with your updated LDAP details.

💡 Tip: Mirror all settings recorded in Step 1, substituting only the changed values (e.g., the new host name for the new LDAP provider).

Step 4 — Update All References

Replace every reference to the old user store (identified in Step 2) with the newly created user store. Verify each configuration area to ensure no references to the old connection remain.

Step 5 — Delete the Old User Store Connection

Once all references have been updated and verified, delete the old user store connection from the VIP EG console.

Step 6 — Restart Applicable Services

Restart the relevant VIP EG services to apply the configuration changes globally.

Step 7 — Run LDAP Simulation and Verify

Run an LDAP simulation with the new user store. Before proceeding with a full sync, confirm that:

1. No false-positive deletion warnings are present in the simulation log.

2. All users are correctly matched with their new GUIDs.

3. The expected update and delete operations appear exactly as intended.

⚠️ Critical: Only proceed with the full, live LDAP sync once the simulation completes entirely without unexpected warnings.