[Fedora-directory-users] Password synchronization error

[Jeff Gamsby]

David Boreham wrote:
> Jeff Gamsby wrote:
>
>> Has anyone ever come across this error:
>>
>> [15/Jun/2006:21:54:25 -0700] NSMMReplicationPlugin - agmt="cn=AD" 
>> (ad:636): Received error [0000216C: AtrErr: DSID-031D0AC0, #1:       
>> 0:0000216C: DSID-031D0AC0, problem 1005 (CONSTRAINT_ATT_TYPE), data 
>> 0, Att 9005a (unicodePwd) ] when attempting to modify entry
>> [<GUID=e873f710d5b9394db14c701cf5f11821>]: Please correct the 
>> attribute specified in the error message.  Refer to the Windows 
>> Active Directory docs for more information.
>> [15/Jun/2006:21:54:25 -0700] NSMMReplicationPlugin - agmt="cn=AD" 
>> (ad:636): windows_replay_update: update password returned 1
>> [15/Jun/2006:21:54:25 -0700] NSMMReplicationPlugin - agmt="cn=AD" 
>> (ad:636): Consumer failed to replay change (uniqueid
>> 3783a101-1dd211b2-802fd24c-a4ed0000, CSN 4492399a000000010000): 
>> Constraint violation. Skipping.
>>
> The obvious first guess would be that the password fails the AD 
> password policy check.
>
> What happens if you try to change that same user's password to the 
> same value on the
> AD side ? Does it work ?
Yes.

I think what is happening is that when the user account's userpassword 
attribute gets imported into FDS, it gets base64 encoded, which the FDS 
understands but AD does not. I have an OpenLDAP server that I am 
migrating from and when I export the database, add some attributes, then 
upload into FDS, some attributes get base64 encoded, including 
userpassword. It happens to some attributes like "cn", so those users 
don't get synced into AD ( I guess AD gets confused ). If I just retype 
the "cn" attribute, then it gets synced just fine, but I'm not sure what 
to do about userpassword. In my OpenLDAP server the passwords are 
{SSHA}, and I think FDS supports this, I just have to figure out how to 
format that attribute.

I verified this by adding a user via the admin console, and it seems to 
work fine.

I tried the LdapImport perl script, but that didn't work. I also tried 
the other script on the OpenLDAP migration Howto, but that didn't work 
either.

Thanks
>
>
> -- 
> Fedora-directory-users mailing list
> Fedora-directory-users at redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users