Active Directory User Creation Failure: Constraint Violation rc: 0x0013 and Operations Error rc: 0x0001

Products

• CA Identity Manager
• CA Identity Governance
• CA Identity Portal

Issue/Introduction

Identity Manager (IDM) successfully creates users in the user and provisioning stores, but the operation fails when synchronized to Active Directory (AD).

This occurs when the LDAP endpoint rejects the request due to attribute constraints or service-level permission issues.

Environment

Identity Manager 14.x

Cause

1. LDAP Constraint Violation: The endpoint rejects the operation because an attribute value violates size or content constraints (e.g., sending binary data to a string-only field).
2. Service Permissions: The IM_CCS (Connector Server) service may be running as "Local System" instead of a service account with specific permissions to create objects or home directories on the target AD endpoint.
3. The following errors are reported in the Provisioning logs:

• CreateAcct: FAILURE: Child CreateAcct (eTADSDirectoryName=[endpoint name]) CreateAcct F: rc: 0x0013 (Constraint violation)
• FAILURE: Child Add (eTInclusionID=1) 2
• rc: 0x0001 (Operations error)
• rc: 0x0046 (Results too large)

Resolution

1. Verify Service Account Permissions:
   • Ensure the IM_CCS service is using a dedicated service account rather than Local System.
   • Confirm this account has manual permissions to create folders/objects on the designated AD path.
2. Identify Faulty Attributes:
   • Enable trace logging on the endpoint to capture the specific attribute causing the 0x0013 error.
   • Refer to Adjusting logging levels in Identity Manager for detailed steps on endpoint logging.
3. Correct Attribute Data:
   • Review the trace logs for size or content mismatches and update the user object in IDM to comply with AD requirements.