-
Title
Error message in Management Console for Unix when logging on as an Active Directory user -
Description
Error message in Management Console for Unix when logging on as an Active Directory user
One of the following error messages may be shown:
Communication error. [Error performing LDAP operation]
Communication error. [Login failed because user SID could not be resolved with AD.] -
Cause
Product Defect.
There is an empty object setting in the Safeguard Authentication Services Application Configuration container. -
Resolution
WORKAROUND:
--------------------------------------------
1. Open Active Directory users and Computers.
Ensure that 'Advanced Features' is selected under the 'View' menu.
2. Go to the following location to find the Safeguard Authentication Services Application Configuration container:
CN={786E0064-A470-46B9-83FB-C7539C9FA27C},CN=Authentication Services,CN=Quest Software,CN=Program Data,DC=your domain
3. Highlight the 'Schema' entry.Check the right hand pane for any entries that do not have a value under the 'Description' column.
- The following object entries will not show a 'Description' value if you have this issue:
ComputerName
OperatingSystem
Alternatively run the following command as root on a Unix/Linux client joined to the same domain as the Management Console for Unix server:
# /opt/quest/bin/vastool -u host/ search -b "`/opt/quest/bin/vastool schema list | grep CN=`" -s sub "cn=operatingsystem" description
If only the dn is shown (without a description) then this indicates that the description needs to be added.If nothing is shown then this entry does not exist in the schema.
4. Right click on 'OperatingSystem' and select properties- Go to the attribute Editor tab
- Select Edit
- Enter the following under description:
OperatingSystem
- Select OK and then OK again
5. Right click on 'ComputerName'- Go to the attribute Editor tab
- Select Edit
- Enter the following under description:
cn
- Select OK and then OK again
6. Try to logon to Management Console for Unix again.--------------------------------------------
As an alternative to steps 4 and 5 the description can be set for the above attributes by logging onto a client joined to the same domain.Then running the following commands as root:---------------------------------# location="`/opt/quest/bin/vastool schema list | grep CN=`"
# /opt/quest/bin/vastool -u setattrs -d "CN=OperatingSystem,CN=Schema,$location" description OperatingSystem
# /opt/quest/bin/vastool -u setattrs -d "CN=ComputerName,CN=Schema,$location" description cn---------------------------------
If any other entries do not have a description then please raise a support service request with One Identity Support for further investigation.
Please also review the following knowledge base article for a similar issue caused by the Starling attributes:
https://support.oneidentity.com/kb/312058/communication-error-login-failed-because-user-sid-could-not-be-resolved-with-ad
STATUS:
Issue ID # 276393 has been corrected in 5.0.3; from the 5.0.3 Release Notes:When the user is logging in as an Active Directory user, the ManagementConsole for Unix (MCU) displays either of the following error messages:Communication error. [Error performing LDAP operation]Communication error. [Login failed because user SID could not be resolvedwith AD.]This error is caused while updating the Safeguard AuthenticationConfiguration (SAC), because the "ComputerName" and the"OperatingSystem" entries may be added to the Active Directory Schema withempty descriptions. The MCU cannot handle items with empty descriptions,which causes MCU to break.The fix ensures that when updating the SAC, the "ComputerName" and the"OperatingSystem" entries always have a default description. -
Change Request
276393