Return
-
Title
Sync error: "Could not save object Active Directory groups (Group Name)" -
Description
Getting an error when attempting to publish groups to IT Shop as a result of a full sync. It appears that the error is focused on dynamically generated Exchange groups, with this error:
"[810008] Could not save object Active Directory groups (Group Name). [810077] Active Directory groups: Recipient root container is a required field." -
Cause
"Recipient root container" (column ADSGroup.UID_ADSContainerDynDLBaseDN) is blank because the domain is specified in Exchange. Identity Manager will not allow you to enter the domain here, it will only accept an OU. However, Dynamic Distribution Groups cannot be managed via Identity Manager.The AD property "msExchDynamicDLBaseDN" defines the focus of the rules of a dynamic distribution list. It's a mandatory field in AD/Exchange and that's why it's a mandatory field in Identity Manager as well (column ADSGroup.UID_ADSContainerDynDLBaseDN).
In AD this field can contain any DistinguishedName, e.g. for a container or for the whole domain. In Identity Manager this field is a foreign key which points to ADSContainer - that means only a container is possible in Identity Manager.The purpose of the failed script "VI_AssignADSGroupsToITShop" is to add all AD groups to IT Shop (with some exceptions). During this an AccProduct will be created for the single groups and the UID_AccProduct will be saved back in the group. Due to the missing mandatory field it's not possible to update the objects.
BUT: In case of a dynamic distribtion list it doesn't make sense to add it to IT Shop because the members for such a group are defined by the filter only - it's not possible to add/delete members manually. This is a defect in the aforementioned script - we need an additional exception for dynamic distribution lists there. -
Resolution
WORKAROUND
None.
STATUS
Please contact Support for fix 21902 for this issue.