IAM: [LDAP: error code 50 - You do not have sufficient privileges to perform an unindexed search]; remaining name 'ou=###,ou=###,o=###'

Products

• Service Virtualization

Issue/Introduction

Getting below error in IAM after upgrading to 10.9.1:

Caused by: org.keycloak.models.ModelException: Querying of LDAP failed org.keycloak.storage.ldap.idm.query.internal.LDAPQuery@7ae50421
  at org.keycloak.storage.ldap.idm.store.ldap.LDAPIdentityStore.fetchQueryResults(LDAPIdentityStore.java:292)
  at org.keycloak.storage.ldap.idm.query.internal.LDAPQuery.getResultList(LDAPQuery.java:186)
  ... 31 more
Caused by: javax.naming.NoPermissionException: [LDAP: error code 50 - You do not have sufficient privileges to perform an unindexed search]; remaining name 'ou=###,ou=###,o=###'
  at java.naming/com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3268)
  at java.naming/com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:3206)
  at java.naming/com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2997)
  at java.naming/com.sun.jndi.ldap.LdapCtx.searchAux(LdapCtx.java:1875)
  at java.naming/com.sun.jndi.ldap.LdapCtx.c_search(LdapCtx.java:1798)
  at java.naming/com.sun.jndi.toolkit.ctx.ComponentDirContext.p_search(ComponentDirContext.java:392)
  at java.naming/com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(PartialCompositeDirContext.java:358)
  at java.naming/javax.naming.directory.InitialDirContext.search(InitialDirContext.java:305)
  at org.keycloak.storage.ldap.idm.store.ldap.LDAPOperationManager$4.execute(LDAPOperationManager.java:310)
  at org.keycloak.storage.ldap.idm.store.ldap.LDAPOperationManager$4.execute(LDAPOperationManager.java:301)
  at org.keycloak.storage.ldap.idm.store.ldap.LDAPOperationManager.execute(LDAPOperationManager.java:742)
  at org.keycloak.storage.ldap.idm.store.ldap.LDAPOperationManager.searchPaginated(LDAPOperationManager.java:301)
  at org.keycloak.storage.ldap.idm.store.ldap.LDAPIdentityStore.fetchQueryResults(LDAPIdentityStore.java:274)

Environment

DevTest 10.9.1

Cause

Root cause: the coupling flaw in the lisa repo, and the unindexed-LDAP-search defect in the keycloak repo.

Resolution

Open a support case and refer to this defect DE681973:

Patches.

patch_DE681973_10.9.1_GA.jar

api-10.9.1-DE681973.war

ldap-extension.jar

 

Steps to Apply the Patch:

Go to IAM Machine:

1. Stop IAM Service
2. Take a backup of the file IAM_HOME/providers/ldap-extension.jar
3. Place the latest ldap-extension.jar at the folder: IAM_HOME/providers/ldap-extension.jar
4. Start IAM Service
5. Check IAM log file. With this patch in place, the earlier errors about unindexed search shouldn't appear anymore

 

On Registry Machine:

1. Stop Registry Service
2. Place the file 'api-10.9.1-DE681973.war' at LISA_HOME/webserver/patches folder (create the patches folder if it doesn't exist)
3. Place the file 'patch_DE681973_10.9.1_GA.jar' at LISA_HOME/lib/patches folder (create the patches folder if it doesn't exist)
4. Start Registry Service