Corruption of ThumbnailPhoto if more than one VI_ADS_ADSAccount_Update_JPegPhoto processes run serially in the same stdioprocessor (4326510)

Corruption of ThumbnailPhoto if more than one VI_ADS_ADSAccount_Update_JPegPhoto processes run serially in the same stdioprocessor

If several VI_ADS_ADSAccount_Update_JPegPhoto processes run serially in the same stdioprocessor, the provider encodes only the first ThumbnailPhoto correctly as octet-string. The provider then incorrectly encodes subsequent transmissions of ThumbnailPhoto with base64. This causes a corrupted ThumbnailPhoto property in the AD.

WORKAROUND

Since a newly spawned stdioprocessor will always transmit the correct value, a possible workaround is to limit the reuse count of the stdioprocessor in the jobservice config. Please note, this may cause an overhead due to schema validation, which may require more consideration, for example, running the VI_ADS_ADSAccount_Update_JPegPhoto process in a dedicated jobservice or disabling schema validation by setting TargetSystem\ADS\NoMappingValidation to 1.

STATUS

Development has acknowledged bug #23900. A hotfix for 6.1.3 is available through a support service request. The hotfix is not compatible with earlier versions of One Identity Manager. The bug did not occur in tests with version 7.