OID Attributes with Integer Match Unsearchable
Last updated on SEPTEMBER 14, 2016
Applies to:Oracle Internet Directory - Version 10.1.4.3 and later
Information in this document applies to any platform.
LDAP search with a filter on an "Integer" type attribute fails with LDAP Error Code 53, DSA is unwilling to perform. In this case the uidNumber attribute.
The uidNumber attribute (posixAccount objectclass) is required for OS/PAM Authentication; searches for the user account are done based on the uidNumber attribute.
The error in the server when the OS Authentication attempt (SSH) is made is similar to the following:
2 12:29:07 eek sshd: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=localhost.localdomain user=user01
Feb 2 12:29:07 eek sshd: Accepted password for user01 from 127.0.0.1 port 37064 ssh2
Feb 2 12:29:07 eek sshd: pam_unix(sshd:session): session opened for user user01 by (uid=0)
Feb 2 12:29:07 eek sshd: nss_ldap: could not search LDAP server - Server is unavailable
Feb 2 12:29:07 eek sshd: fatal: login_get_lastlog: Cannot find account for uid 9506
Feb 2 12:29:07 eek sshd: pam_unix(sshd:session): session closed for user user01
The same search was failing using a command line ldapsearch.
$ORACLE_HOME/bin/ldapsearch -D cn=orcladmin -w PASSWORD -L -s sub -b "cn=users,dc=au,dc=oracle,dc=com" uidnumber=9506
ldap_search: DSA is unwilling to perform
ldap_search: additional info: Function Not Implemented
OID has been upgraded from version 10.1.4.0.1 to version 10.1.4.3
Sign In with your My Oracle Support account
Don't have a My Oracle Support account? Click to get started
My Oracle Support provides customers with access to over a
Million Knowledge Articles and hundreds of Community platforms