Return
-
Title
Intermittent failure of the Daily Sync job from One Identity Manager to AD for Account Users in a Load Balanced AD environment -
Description
A load balancer for Active Directory authentication implemented along with the Synchronization workflow in the direction of the AD target system which is created in the Synchronization project. However, the scheduled daily synchronization which updates the User accounts in One Identity Manager (e. ADSAccount) to AD target system fails intermittently with this error message:
system.DirectoryServices.DirectoryServicesCOMException There is no such object on the server
-
Cause
When running a FullSync in Identity Manager the system loads an object list (reduced sized) for Identity Manager and the target system as a first step. Next, the objects of both sides are matched based on the reduced properties list that are read from the first step.The sync will handle every single object individually next. For example compare it with the properties that need to be updated, removed, etc. In this case as the system tries to update the objects, it proves that the objects were contained in the LIST read from the first step. However, during the single object handling the Jobserver is unable to find the objects.The difference between list and object processing is in the AD search:While reading the key terms and indexed properties of an AD object (for the LIST), every DC and GC are able to answer the search query. However a DC is needed to process aa specific update. The error messages show that the DC is unable to process the updates of the object (Object processing). The DC processing this update is unknown to Identity Manager. This is due to the option "ServerBind" in the connection settings being inactive which means AD can forward every request to any available DC. -
Resolution
RESOLUTION:
To resolve the intermittent failure, enable "Server Bind" to enforce that every request must be processed by the defined DC in the synchronization project's connection setting. The DC defined in the connection settings in the sync project is only used for the authentication if "Server Bind" is not set.This is also the DC where the Jobserver is connected which does not mean that every request is answered by this particular DC. After the authentication, it depends on the options of the connection and on the configuration in AD regarding which DC will answer the request.If the option "Server Bind" is not set, there is no control or information from Identity Manager regarding which DC in a load balanced AD environment is answering such requests.