Getting below error while creating user on AD:
AFX reports this item failed with code [-1] and message: 'LDAPException: Server refused to perform operation. Ensure that you are using a secure port (e.g. 636) for this operation'. If available, another handler will be used to fulfill this item.
We are curently on Verion 7.2
Yes , i have set port as 636 and checked use secure connection
If you are mainly creating an account or registering a user, you will need to use LDAPS instead of LDAP on your AD connector like Dipendra had stated.
Is there some changes in 7.2 due to which i am getting this error :
There are of course changes to RSA IG&L with every version. Depending on what version you were on before there are also likely huge changes in SSL security related to JAVA that could affect LDAP connections. I am not aware of anything specifically that would cause this to fail with this message. Normally if SSL is not working there would be connection error messages and no attempt would even be made to create the account.
Can you check the AFX logs and see if there is a log file message that corresponds to this message in the console that perhaps has more detail on the failure?
If you need a more detailed review of this issue I recommend you open an RSA Customer Support case so that we can have full access to all the log files.
There typically would be a more detailed LDAP error message associated with this failure corresponding to the actual Active Directory response code. I would expect to see this in the log file. This is likely a security exception so there may not be an exact reason provided in the response from AD as often these messages are obfuscated for security reasons. RSA IG&L may misinterpret the AD response because of this obfuscation so there could be several different types of AD failure resulting in the same RSA error.
Note that technically a secure connection over 636 is not actually required to create an AD account, but it is required to set the AD accounts password, which is always done when creating an account. Most likely the failure is related to creating the AD password and this failure may include, but not be limited to, attempts to create an AD password that does not meet AD password complexity requirements.
I recommend you open an RSA Customer Support case for this issue so that we can review all the log artifacts.
Are you using LDAPS protocol to connect to your AD server?