DIP Synchronization Fails with [Ldap: Error Code 68 - Entry Already Exists] When User is Moved in Active Directory (AD)

(Doc ID 1266944.1)

Last updated on MARCH 08, 2017

Applies to:

Oracle Internet Directory - Version 10.1.4 to 11.1.1 [Release 10gR3 to 11g]
Oracle Unified Directory - Version 11.1.1.5.0 and later
Information in this document applies to any platform.

Symptoms

Directory Integration and Provisioning (DIP) has been configured to synchronize entries from Active Directory (AD) to the Oracle backend directory.

DIP synchronization is failing with error [LDAP: error code 68 - Entry Already Exists] when a user is moved from one Organizational Unit (OU) in AD to another.

The DIP synchronization profile debug trace log shows entries similar to the following:

DN : cn=alan smith,ou=solihull,ou=england,dc=development,dc=oracle,dc=com
Searching for entry in Naming context:
Normalized DN : cn=alan smith,ou=solihull,ou=england,dc=development,dc=oracle,dc=com
may need to perform renaming DN
Original DN cn=alan smith,ou=reading,ou=england,dc=development,dc=oracle,dc=com
New DN cn=alan smith,ou=solihull,ou=england,dc=development,dc=oracle,dc=com
Changetype is ADDRMODIFY
originalDN: cn=alan smith,ou=reading,ou=england,dc=development,dc=oracle,dc=com
newDN: cn=alan smith,ou=solihull,ou=england,dc=development,dc=oracle,dc=com
Perform ModDN.
Exception Doing ModRDN operation : javax.naming.NameAlreadyBoundException: [LDAP: error code 68 - Entry Already Exists]; remaining name 'cn=alan smith,ou=reading,ou=england,dc=development,dc=oracle,dc=com'
Ignore modrdn.
[LDAP: error code 68 - Entry Already Exists]
javax.naming.NameAlreadyBoundException: [LDAP: error code 68 - Entry Already Exists]; remaining name 'cn=alan smith,ou=reading,ou=england,dc=development,dc=oracle,dc=com'
at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:2983)
at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2934)
at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2740)
at com.sun.jndi.ldap.LdapCtx.c_rename(LdapCtx.java:692)
at com.sun.jndi.toolkit.ctx.ComponentContext.p_rename(ComponentContext.java:693)
at com.sun.jndi.toolkit.ctx.PartialCompositeContext.rename(PartialCompositeContext.java:245)
at com.sun.jndi.toolkit.ctx.PartialCompositeContext.rename(PartialCompositeContext.java:236)
at javax.naming.InitialContext.rename(InitialContext.java:379)
at oracle.ldap.odip.gsi.LDAPWriter.performModDN(LDAPWriter.java:747)
at oracle.ldap.odip.gsi.LDAPWriter.writeChanges(LDAPWriter.java:347)
at oracle.ldap.odip.engine.AgentThread.mapExecute(AgentThread.java:656)
at oracle.ldap.odip.engine.AgentThread.execMapping(AgentThread.java:377)
at oracle.ldap.odip.engine.AgentThread.run(AgentThread.java:238)
DIP_LDAPWRITER_ERROR_MODRDN
Error in executing mapping DIP_LDAPWRITER_ERROR_MODRDN
DIP_LDAPWRITER_ERROR_MODRDN
at oracle.ldap.odip.engine.AgentThread.mapExecute(AgentThread.java:830)
at oracle.ldap.odip.engine.AgentThread.execMapping(AgentThread.java:377)
at oracle.ldap.odip.engine.AgentThread.run(AgentThread.java:238)
DIP_LDAPWRITER_ERROR_MODRDN



It is found that both of the entries named in the LDAP: error code 68 error stack have the same orclobjectguid value.

e.g.

$ORACLE_HOME/bin/ldapsearch -h HOST -p PORT -D "cn=orcladmin" -w PASSWORD -L -b "cn=alan smith,ou=reading,ou=england,dc=development,dc=oracle,dc=com" -s base "objectclass=*" orclobjectguid

cn=alan smith,ou=reading,ou=england,dc=development,dc=oracle,dc=com
orclobjectguid: uPsIWbXBCUWYadLEsBTkUA==


$ORACLE_HOME/bin/ldapsearch -h HOST -p PORT -D "cn=orcladmin" -w PASSWORD -L -b "cn=alan smith,ou=solihull,ou=england,dc=development,dc=oracle,dc=com" -s base "objectclass=*" orclobjectguid

cn=alan smith,ou=solihull,ou=england,dc=development,dc=oracle,dc=com
orclobjectguid: uPsIWbXBCUWYadLEsBTkUA==



Possibly, multiple entries with the same orclobjectguid attribute value may be found to exist in Oracle backend directory.


Workaround

Verify which of the duplicate entries should exist by checking which AD OU the user is currently located in, then deletes the other entry in Oracle backend directory using DAS (/oiddas) or other LDAP administration interface.

DIP Synchronization will then be able to continue until the next duplicate is encountered during MODDN operation.

Cause

Sign In with your My Oracle Support account

Don't have a My Oracle Support account? Click to get started

My Oracle Support provides customers with access to over a
Million Knowledge Articles and hundreds of Community platforms