LDAP Error Code 65: Object Class Violation During User Creation - Identity Manager

Products

• CA Identity Manager
• CA Identity Governance
• CA Identity Portal
• CA Identity Suite

Issue/Introduction

When attempting to create a user in Identity Manager, you encounter LDAP: error code 65 - Object Class Violation. This error typically occurs when the user object requires custom object classes that are not properly defined in the Identity Manager schema, even when all required attributes are provided in the UI.

Environment

Identity Manager 14.5

Cause

This error indicates a mismatch between the schema definition in the Identity Manager Management Console and the requirements of the underlying LDAP directory. The ImsManagedObject definition for the 'User' object within the Directory.xml file lacks the necessary custom object classes, causing the directory to reject the creation request as an object class violation.

Resolution

To resolve this violation, you must update the Identity Manager schema definition and migrate existing user data to include the required object classes.

Phase 1: Update Identity Manager Schema

1. Log in to the Identity Manager Management Console.
2. Export the current Directory.xml file for the Corporate User Store.
3. Locate the ImsManagedObject line for the User: <ImsManagedObject name="User" objectclass="top,imUser" ...>
4. Add the necessary custom object classes to the objectclass attribute (e.g., objectclass="top,imUser,imUserAux").
   
   
   
5. Save the file and import it back into the Management Console using the Update button.

Phase 2: Migrate User Store Data You must update existing user entries in your LDAP directory to reflect the new schema requirements.

1. Export your User Store data to an LDIF file.
2. Edit the LDIF file to include the new object class for all user entries (e.g., add objectClass: imUserAux to each user entry).
3. Stop the User Store DSA (or relevant directory service).
4. Load the updated LDIF file into the directory.
5. Start the User Store DSA.

Note: For Virtual Appliance (vApp) environments, use the dxdumpdb and dxloaddb commands to perform these operations.

Additional Information

Extending the User Store with imUserAux Object Class, see documentation Extend the User Store with the User Auxiliary Object Class - 14.5 or User/Group Auxiliary Schema - v15

To speak with a customer representative or a Support Engineer see Contact Support. Scroll to the bottom of the page and click on your respective region.