Error: sm-Ldap-00880 SetUserProp Status 50 Insufficient access - SiteMinder

Products

• SITEMINDER
• CA Single Sign On Agents (SiteMinder)
• CA Single Sign On Federation (SiteMinder)
• CA Single Sign On Secure Proxy Server (SiteMinder)
• CA Single Sign On SOA Security Manager (SiteMinder)

Issue/Introduction

SiteMinder Policy Server logs (smps.log) show LDAP error code 50 (Insufficient access) during user property updates or authentication attempts.

Environment

• Product: SiteMinder (CA Single Sign-On) R12.8.x
• User Store: Active Directory (AD), LDAP-compliant directories

Cause

The 'service account' used by SiteMinder to connect to the LDAP/AD store does not have sufficient permissions to write to a specific user attribute (e.g., ssoApp13, password, or userAccountControl).

Error: The smps.log contains errors similar to the following: [ERROR][sm-Ldap-00880] (SetUserProp) DN: 'CN=User,OU=Users,DC=example,DC=com', PropName: 'ssoApp13'. Status: Error 50 . Insufficient access

 

Resolution

To resolve this issue, the LDAP/AD administrator must grant the SiteMinder 'service account' the necessary permissions.

1. Identify the 'service account' account configured in the SiteMinder User Directory settings.
2. In Active Directory (or relevant LDAP store), locate the attribute mentioned in the error (e.g., PropName: 'ssoApp13').
3. Grant the 'service account' Write permissions for that specific attribute for all users in the relevant OUs.
4. If the error occurs during password changes, ensure the account has "Reset Password" permissions.
5. Verify the update by attempting the login.

Additional Information

• For a complete list of common Active Directory bind errors, see Common Active Directory Bind Errors.
• If you need to speak with a customer representative or a Support Engineer, see Contact Support. Scroll to the bottom of the page and click on your respective region.