Two Accounts Exists In AD With Same CN Except For Extra Whitespace, But OID DIP Sync Only Replaces or Modifies One Single / Same Account
Last updated on MARCH 08, 2017
Applies to:Oracle Internet Directory - Version 10.1.2 to 10.1.4 [Release 10gR2 to 10gR3]
Information in this document applies to any platform.
This problem can occur on any platform.
Using Active Directory (AD) DIP Synchronization to Oracle Internet Directory (OID).
Two distinct accounts exist in AD with essentially the same CN. Both accounts could either belong to the same user but must be kept separately for different functions (so cannot use the solution from <Note:578367.1>), or each account could belong to a unique user.
One AD account has one space in between the first and last name in the CN, ie "John Smith" while the other account has an extra whitespace, ie two / 2 spaces: "John Smith."
In OID however, only one of the two accounts is created via the sync process, and when the account with doublespace is modified in AD, OID does not create the separate account and instead replaces the account with one space in the CN. So OID sync is not keeping separated the two corresponding AD accounts as desired.
Looking for a least intrusive/non-outage way to fix such usernames so that both are sync'd to OID and kept/maintained separately in OID as they are in AD. (Any mapping or other more drastic changes would need to be tested/evaluated first for impact to all integrated applications.)
NOTE: Currently just having the sync profile skip on errors and continue (as per <Note:342648.1>), but continues to see the same sync profile trace errors for the problem entries, for group and user sync's on different attributes, as reported in <Note:578367.1>, i.e.:
javax.naming.directory.AttributeInUseException: [LDAP: error code 20 - <attribute name> attribute has duplicate value. VALUE: cn=John Smith,cn=users,dc=mycompany,dc=com]; remaining name 'cn=John Smith,cn=users,dc=mycompany,dc=com'
Also, in testing, after adding such a second account with double spaces for the same user in AD, the profile sync trace shows error:
Searching for entry in Naming context:
Directories are in a inconsistent state. Perform reconcile cn=john smith,cn=users,dc=mycompany,dc=com is inconsistent
Sign In with your My Oracle Support account
Don't have a My Oracle Support account? Click to get started
My Oracle Support provides customers with access to over a
Million Knowledge Articles and hundreds of Community platforms