Assign AD Group to users failing

[ravi_paul]

While we are adding AD privilege thru UI to user which is already activated in AD, we are getting error in 'AssignUserToADSGroup'.

Here is the destination value of the pass:

dn --> $FUNCTION.sap_core_getGroupACCOUNTFromPrivilege(%MSKEY%)$$

changetype --> modify

+member --> $FUNCTION.sap_core_checkAccountAttributeValueExists(%ACCOUNT%$rep.$NAME%%)$$

attached is error screenshot

[Steffi_Warnecke · Accepted solution]

Hello Ravi,

I'm a bit confused about the "value" for the member attribute:

$FUNCTION.sap_core_checkAccountAttributeValueExists(%ACCOUNT%$rep.$NAME%%)$$

The attribute "member" expects a distinguished name, not a username. The used function is not returning that for the account attribute, it's just checking, that the given attribute is not empty.

So you need another script, that returns the DN for the user you want to add to the group.

.

EDIT: Or do you use that attribute (ACCOUNT<ad_repo>) for the distinguished name of the ad-user and not the samaccountname?

.

Regards,

Steffi.

[ravi_paul · Accepted solution]

Hi Steffi, Many Many Many and more Many Thanks.

that solution worked out for me

$FUNCTION.sap_core_checkAccountAttributeValueExists(%ACCOUNT%$rep.$NAME%%)$

I was passing MSKEYVALUE at %ACCOUNT%$rep.$NAME%% , assuming that would work, once I passed DN to %ACCOUNT%$rep.$NAME%% it worked out.

Thanks Again!!!

[alexanderbrietz]

Hi Ravi,

how many members do you have in the group at question? Are there more than 1500 members in it?

AD causes problems with membership within large groups because there is a special mechanism how this is handled in AD. The LDAP way would be to add a memberOf attribute for the person to the group in question instead of adding a member attribute to a person for the group. This would help for groups with more than 1500 members (1500 being the first threshold IIRC).

Additionally I would recommend the link Richard posted. WILL NOT PERFORM is the AD way of stating something went wrong. Could be password issue (which you already excluded), protocol issue, server issue, etc. My interpretation of the error codes means MS Error Code 0x54F equals ERROR_INTERNAL_ERROR meaning "An internal error occurred." which is not quite helpful... Please find https://docs.microsoft.com/de-de/windows/win32/debug/system-error-codes--1300-1699-.

Hope that helps.

Regards,

Alex

[ravi_paul]

Not much, its a test group we have created. As of now only 2 members.

Also its not an issue with one group, any group I'm trying to add to user, I'm getting same error.

-RP

[richard_pietsch]

Hi, LDAP code 53 with problem 5003 indicates a password issue.. see https://ldapwiki.com/wiki/WILL_NOT_PERFORM
Regards, Richard

[ravi_paul]

It doesn't seem to be, as IDM Service account is able to create user in ADS from IDM, problem is only when assigning AD group from IDM.

I tried logging to AD mmc with IDM service account and was able to add users manually in mmc, which means IDM service account has access to add user account.