Error: "Failed Sync Action Exception Info: Could not sync resource to Horizon". While syncing Directory with VIDM

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

• Failed to sync Active Directory users with VIDM. 
  
  
• When navigating to the administrative console under Identity and Access Management > Directories, selecting the configured Active Directory, and executing 'Sync Now', the task fails with: 
  Failed Sync Action Exception Info: Could not sync resource to Horizon


• Los vIDM located at /opt/vmware/horizon/workspace/logs/connector-dir-sync.log shows entries related to "Invalid base DN":

YYYY-MM-DDThh:mm:ss INFO  (resourceSyncTaskExecutor-4) [;;;] com.vmware.horizon.directory.ldap.LdapGroupService - getLdapGroups: ldapQuery is "CN=xxxxxx,OU=xxxxxxx,DC=xxxxxx,DC=xxxxxx"
YYYY-MM-DDThh:mm:ss ERROR (resourceSyncTaskExecutor-4) [;;;] com.vmware.horizon.directory.ldap.LdapNameUtil - Invalid base DN
javax.naming.InvalidNameException: Invalid name: "CN=xxxxxx,OU=xxxxxxx,DC=xxxxxx,DC=xxxxxx"
        at javax.naming.ldap.Rfc2253Parser.parseAttrType(Rfc2253Parser.java:155) ~[?:1.8.0_352]
        at javax.naming.ldap.Rfc2253Parser.doParse(Rfc2253Parser.java:108) ~[?:1.8.0_352]
        at javax.naming.ldap.Rfc2253Parser.parseDn(Rfc2253Parser.java:70) ~[?:1.8.0_352]
        at javax.naming.ldap.LdapName.parse(LdapName.java:785) ~[?:1.8.0_352]
        at javax.naming.ldap.LdapName.<init>(LdapName.java:123) ~[?:1.8.0_352]
        at com.vmware.horizon.directory.ldap.LdapNameUtil.getDCsFromDn(LdapNameUtil.java:61) ~[adapter-ldap-0.1.jar:3.3.7.0 Build 21173100]
        at com.vmware.horizon.directory.ldap.LdapCrossRefService.getCrossRefBasedOnQuery(LdapCrossRefService.java:313) ~[adapter-ldap-0.1.jar:3.3.7.0 Build 21173100]
        at sun.reflect.GeneratedMethodAccessor993.invoke(Unknown Source) ~[?:?]
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_352]
        at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_352]
        at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:344) ~[spring-aop-5.2.22.RELEASE.jar:5.2.22.RELEASE]
        at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:198) ~[spring-aop-5.2.22.RELEASE.jar:5.2.22.RELEASE]  
        
        

Environment

VMware Identity Manager 3.3.X

Cause

This issue occurs because the Distinguished Name structure selected for a synchronized Active Directory group contains illegal syntax, such as trailing or leading white spaces, or invalid escaping characters.

Resolution

To resolve this issue, you must remove the invalid formatting characters from the directory sync settings:

1. Log in to the VMware Identity Manager Administrative Console.

2. Select Identity & Access Management from the primary menu tabs.

3. Navigate to Setup > Sync Settings and click on the Groups tab.

4. In the group sync search field, locate the target group showing syntax errors in the log.

5. Inspect and clean the group DN parameters to remove unescaped double quotes or non-standard spaces that violate string guidelines. 

6. Save the corrected synchronization layout. 

7. Restart horizon service on vIDM
   service horizon-workspace restart


8. Select 'Sync Now' to complete directory parsing successfully.