AFX: Output parameters failing for AD

Discussion created by Gunpreet Singh on Sep 17, 2017
Latest reply on Sep 17, 2017 by Boris Lekumovich

Like • Show 0 Likes0
Comment • 3

Hi,

I hve configured AD with AFX & the request is successfully fulfilled through AFX . But fails to update the parameters defined in Output_Parameters section with the error:-

[WARN] com.aveksa.AFX.server.runtime.esb.ldap.OutputParameterComponent:265 - No LDAP entry found for search (CN=********) within search base DC=***,DC=**- can't set any output parameters

Even though the search string is correct, AFX is unable to find the user

I am using 7.0.2 version.

Any suggestions?

P.S : This issue comes only when we map the parent domain in the 'Account Suffix for DN' connector setting & provision user in multiple child OUs

Outcomes

Boris Lekumovich

Sep 17, 2017 8:50 PM

As far as I know, out of the box the output parameter functionality is performing a search base on the value of CN and it's performing a one level search (not subtree) in the level which is configured in Account DN Suffix

As you can see in the log message:

No LDAP entry found for search (CN=********) within search base DC=***,DC=**

If you are creating all your accounts in 1 specific OU, then consider changing the Account DN suffix to the value of that OU.

1 person found this helpful

Actions

Gunpreet Singh @ Boris Lekumovich on Sep 17, 2017 9:45 PM

Hi Boris,

We need to provision users in multiple child OUs based on their department hierarchy.

Any idea what can be done here?

Thanks,

Sent from my iPhone

Actions

Boris Lekumovich

@ Gunpreet Singh on Sep 17, 2017 9:56 PM

To stay within the limits of configuration, consider creating the new accounts in 1 OU (so that the output parameter will work) and then moving the account to the correct OU.

If that will be your approach, then you should give some thought to where you are going to place the provisioning node (to move the account) in your fulfillment workflow.

2 people found this helpful

Actions

Incoming Links

Re: Issue with output parameter

3 Replies

Boris Lekumovich Sep 17, 2017 8:50 PM
As far as I know, out of the box the output parameter functionality is performing a search base on the value of CN and it's performing a one level search (not subtree) in the level which is configured in Account DN Suffix
As you can see in the log message:
No LDAP entry found for search (CN=********) within search base DC=***,DC=**

If you are creating all your accounts in 1 specific OU, then consider changing the Account DN suffix to the value of that OU.
1 person found this helpful
Like • Show 0 Likes0
Actions
- Gunpreet Singh @ Boris Lekumovich on Sep 17, 2017 9:45 PM
  Hi Boris,
  
  We need to provision users in multiple child OUs based on their department hierarchy.
  
  Any idea what can be done here?
  
  Thanks,
  
  Sent from my iPhone
  Like • Show 0 Likes0
  Actions
  - Boris Lekumovich @ Gunpreet Singh on Sep 17, 2017 9:56 PM
    To stay within the limits of configuration, consider creating the new accounts in 1 OU (so that the output parameter will work) and then moving the account to the correct OU.
    If that will be your approach, then you should give some thought to where you are going to place the provisioning node (to move the account) in your fulfillment workflow.
    2 people found this helpful
    Like • Show 0 Likes0
    Actions