Scanner stops processing messages, mail queues build up, and "Find User" fails with LDAP group loading error in Symantec Messaging Gateway (SMG)

Products

• Messaging Gateway

Issue/Introduction

 

• The SMG Scanner stops processing incoming and outgoing email messages.

• Messages accumulate in both the Inbound and Outbound queues.

• Navigating to Administration > Directory Integration > Address Resolution (or attempting to use Find User to verify Policy Group membership) fails with the following error:

  "Find user is temporarily unavailable because LDAP group loading in progress. Please try find user again in a few minutes. Note: Modifying your policy group or directory data source configurations may restart the group loading process."

Reviewing the dds (Directory Data Service) logs reveals errors similar to the following:

[pool-2-thread-4] [MembershipStoreFactory] ERROR - [building membership: <LDAP_Source_Name>] Failure while trying to resolve group membership 
com.symantec.sms.dds.api.exception.AddressNotUniqueException: Address [email protected] is not unique. The following entries share the same email address: cn=user1,ou=users,dc=example,dc=com; cn=user2,ou=sharedmailbox,ou=groups,dc=example,dc=com

[pool-2-thread-4] [EntryDAOSpringLdap] ERROR - [building membership: <LDAP_Source_Name>] [<LDAP_Source_Name>] unable to find unique resolvedRecipient for recipientEmail: [email protected]
   result1: cn=user1,ou=users,dc=example,dc=com
   result2: cn=user2,ou=sharedmailbox,ou=groups,dc=example,dc=com
   query: (proxyAddresses=smtp:[email protected])
   basedn: DC=example,DC=com

 

Cause

This issue occurs when duplicate email addresses or proxyAddresses attributes exist across multiple Active Directory (AD) / LDAP objects mapped to SMG for Policy Group building or Address Resolution.

When SMG attempts to cache and build LDAP group memberships, the Directory Data Service (DDS) expects each email address to map to a single unique LDAP entity. If two or more accounts share the same primary SMTP address or alias (proxyAddresses), the membership loading task fails with an AddressNotUniqueException. As a result:

1. The group membership loading process gets stuck in a perpetual loop or fails continuously.

2. SMG cannot complete policy group queries required to process mail flow, causing messages to queue.

Resolution

To resolve this issue, locate and remove the duplicate email address from Active Directory so that each address maps uniquely to a single object.

Step 1: Identify the Duplicate Entries in Active Directory

1. Note the duplicate email address identified in the dds logs (e.g., [email protected]).

Step 2: Correct the Duplicate Address

1. Inspect the objects returned by the search (e.g., a user object and a shared mailbox/distribution group object).

2. Update or remove the duplicate mail or proxyAddresses attribute on one of the entries to ensure every email address in Active Directory is unique to a single entity.

Step 3: Trigger LDAP Sync in Symantec Messaging Gateway

1. Log into the SMG Control Center.

2. Go to Administration > Settings > Directory Integration.

3. Select your active LDAP Data Source and click Clear Cache (or edit and save the data source settings to force a fresh cache reload).

4. Monitor the dds logs to confirm group membership building completes successfully without errors.

5. Verify that mail queues begin flushing and the "Find User" function works as expected.