Changes Not Synchronized From Active Directory to OID, DIP Log Shows Error "Directories are in a inconsistent state" or "LDAP: error code 19 - Attribute Uniqueness Constraint Violation"
Last updated on MAY 02, 2018
Applies to:Oracle Internet Directory - Version 10.1.4.3 to 11.1.1 [Release 10gR3 to 11g]
Information in this document applies to any platform.
Changes made to specific Active Directory (AD) users are not being synchronized to Oracle Internet Directory (OID). DIP is reporting error "Directories are in a inconsistent state".
When the following synchronization is configured the problem occurs:
- Oracle HR -> OID synchronization (import)
- OID -> AD synchronization (export)
- AD -> OID synchronization (import)
1. New user created in Oracle Human Resources (HR).
2. DIP HR -> OID synchronization creates the new user in OID.
3. DIP OID -> AD synchronization creates the new user in AD
4. Same user is modified in AD.
5. DIP AD -> OID synchronization fails to modify the corresponding user in OID.
The AD -> OID synchronization trace shows message 'Directories are in a inconsistent state.'
Example entries from DIP 10g synchronization trace log with profile debug enabled:
DN : cn=user43,cn=users,dc=oracle,dc=com
Searching for entry in Naming context:
Directories are in a inconsistent state. The entry cn=user43,cn=users,dc=oracle,dc=com is inconsistent. Please delete the entry from both directories and recreate it with the value required.
Setting Change Success Count : 3282
Setting Change Failure Count : 6
Replacing Attribute orclodipLastSuccessfulExecutionTime in the Profile with value : 20100619113023
Removed Existing attribute
orclOdipSynchronizationStatus: Synchronization Successful
Ending Mapping execution
When the following is configured the problem occurs:
AD Global Catalog -> OID synchronization (import)
AD forest with multiple AD domains exists, DIP is configured to synchronize users from several AD domains via the Global Catalog or directly from the different AD domains
The DIP synchronization profile is configured to "flatten" the synchronized entries in OID, removing AD subcontainers from the corresponding OID DN and creating the user directly below a specific OID container e.g. cn=users,dc=oracle,dc=com
Multiple user entries having the same name (CN value) exist in the AD forest, they exist in different AD domains with different userPrincipalName and mail values
1. AD forest has 2 AD domains AD1.COM and AD2.COM.
2. User John Smith is created in AD1.COM, DN is CN=John.Smith,OU=StoreUsers,DC=ad1,DC=com, userPrincipalNameemail@example.com, firstname.lastname@example.org.
3. User John Smith is created in AD2.COM, DN is CN=John.Smith,OU=FieldSupport,DC=ad2,DC=com, userPrincipalNameemail@example.com, firstname.lastname@example.org.
4. DIP synchronization boostrap is performed via the AD Global Catalog hostname and port.
- DIP creates John Smith user in OID using the entry from AD1.COM because that is returned first in the search results from AD Global Catalog, due to profile DomainRules mapping DIP creates the OID user with DN cn=John.Smith,cn=users,dc=oracle,dc=com.
- DIP subsequently fails to bootstrap the John Smith user entry from AD2.COM to OID because this maps to the same OID DN cn=John.Smith,cn=users,dc=oracle,dc=com as the previously created AD1.COM user so [LDAP: error code 68 - Entry Already Exists] occurs. This error is overlooked or disregarded in the bootstrap log.
5. User John Smith is modified in AD1.COM: DIP successfully synchronizes the change to OID.
6. User John Smith is modified in AD2.COM: DIP fails to synchronize the change to OID and reports error "Directories are in a inconsistent state".
Example entry from DIP 11g (wls_ods1) log file:
Sign In with your My Oracle Support account
Don't have a My Oracle Support account? Click to get started
My Oracle Support provides customers with access to over a
Million Knowledge Articles and hundreds of Community platforms