Adding Profile with LDAP No Longer Work with LDAP r14.0
search cancel

Adding Profile with LDAP No Longer Work with LDAP r14.0


Article ID: 51282


Updated On:


ACF2 ACF2 - DB2 Option ACF2 for zVM ACF2 - z/OS ACF2 - MISC 24X7 High-Availability Manager for DB2 for z/OS Batch Processor Compile QQF Data Compressor for DB2 for z/OS CA Unicenter NSM RC/Update for DB2 for z/OS DB2 TOOLS- DATABASE MISC Top Secret Top Secret - LDAP


Using the same LDAP command with the same LDIF file to add a profile to an acid works with CA LDAP r12.0 and fails with CA LDAP r14.0

The LDAP command is as follows:

ldapmodify -x -D cn=User_Authorized -w Password -v -h Ip_Address p Port_Number -f Ldif_File

The LDIF file is as follows:

changetype: add
Profile-Names: #PROFID




Component: TSSLDP


A number of changes to CA LDAP Server in r14 have been made in order to better conform to the LDAP protocol specifications.
The LDAP protocol requires that the following characters be escaped when they appear in DNs:

, \ # + < > ; " =

In LDAP r12 we largely ignored this requirement, so the LDIF, while technically invalid, was accepted without complaint.
LDAP r14 does much stricter checking on the content of the DN, and so it rejects this request.

You can escape special characters by prefixing them with the \ character.
LDIF file needs to be changed from:

dn: tssproflist=#PROFID,tssacidgrp=proflist,... (snipped)


dn: tssproflist=\#PROFID,tssacidgrp=proflist,... (snipped)