ORA-28030 For EUS User During DB Login With OID Search Reporting LDAP Error 50 (Doc ID 436054.1)

Last updated on NOVEMBER 03, 2015

Applies to:

Advanced Networking Option - Version 10.2.0.1 to 10.2.0.3 [Release 10.2]
Oracle Internet Directory - Version 9.0.4 to 9.0.4.3 [Release 10gR1]
Information in this document applies to any platform.
Some of the abbreviations in this note are listed below
DB => Database
EUS => Enterprise User Security
ACL => Access Control List
DN => Distinguished Name

***Checked for relevance on 12-Jun-2013***


Symptoms

The EUS users receive ORA-28030 error when logging into DB server


+ Trace the registered DB server for event 28033, level 9

SQL> alter system set events '28033 trace name context forever, level 9'; 

+ The generated server trace file for 28033 event trace indicates the following error.
The returned ldap error 50 is "insufficient search privileges".

In the example considered here,

"dc=gcs,dc=com" is the default admin context for DB registration with OID,
"cn=OracleDBSecurity,cn=Products,cn=OracleContext,dc=gcs,dc=com" is the baseDN and
"cn=testdb,cn=OracleContext,dc=gcs,dc=com" is the database DN
which would be the bind user DN performing the search with respect to OID

*** SERVICE NAME:(SYS$USERS) 2007-06-13 05:09:48.238 
*** SESSION ID:(148.70) 2007-06-13 05:09:48.238 
KZLD_ERR: 0 
kzld_search -s sub -b cn=OracleDBSecurity,cn=Products,cn=OracleContext,dc=gcs,dc=com 
search filter: (&(objectclass=orcldbenterprisedomain_82)(uniqueMember=cn=testdb,cn=OracleContext,dc=gcs,dc=com)) 
KZLD_ERR: failed the search 50. 
KZLD_ERR: 50 
KZLD is doing LDAP unbind 

+ The command line ldapsearch with a similar subtree search on the baseDN by
cn=orcladmin (administrator DN) displays only entry level browse permission and
no attribute level access for the database DN.

ldapsearch -h <oid-host> -p <non-ssl OID port> -D cn=orcladmin -w <admin-passwd> 
-b "cn=OracleDBSecurity,cn=Products,cn=OracleContext,dc=gcs,dc=com" -s sub 
"(&(objectclass=orcldbenterprisedomain_82)(uniqueMember=cn=testdb,cn=OracleContext,dc=gcs,dc=com))" 

Cause

Sign In with your My Oracle Support account

Don't have a My Oracle Support account? Click to get started

My Oracle Support provides customers with access to over a
Million Knowledge Articles and hundreds of Community platforms