How to escape comma in LDAP DN string

[Former Member]

Hi

I ran into situation that I should create AD cn as Lastname,  Firstname.

I am concatenating it with JavaScript..

I have tested several amounts of \ characters in front of comma but not found working solution

var addn = "CN=" + LastName + "\\, " + FirstName + "," + buUserDN + "," + buBaseDN

Error with \\ in Javascript also tried \\\, \\\\, \\\\\\ and \\\\\\\\

putNextEntry failed storingCN=Test21\, Vellu,OU=Users,OU=business,OU=DEV,OU=IdentityManagement,dc=global,dc=company,dc=net

Exception from Add operation:javax.naming.directory.InvalidAttributeValueException: [LDAP: error code 21 - 00000057: LdapErr: DSID-0C090C3E, comment: Error in attribute conversion operation, data 0, v1db1]; remaining name 'CN=Test21\, Vellu,OU=Users,OU=business,OU=DEV,OU=IdentityManagement,dc=global,dc=company,dc=net'

Exception from Modify operation:javax.naming.directory.InvalidAttributeValueException: [LDAP: error code 21 - 00000057: LdapErr: DSID-0C090B8A, comment: Error in attribute conversion operation, data 0, v1db1]; remaining name 'CN=Test21\, Vellu,OU=Users,OU=business,OU=DEV,OU=IdentityManagement,dc=global,dc=company,dc=net'

[Former Member · Accepted solution]

Well

Shouldn't make many changes same time - error wasn't due to excaping the name. Error came from invalid value os country code.

And answer to my question is

var addn = "CN=" + LastName + "\\, " + FirstName + "," + buUserDN + "," + buBaseDN

So there should be two escape characters in front of comma in Javascript code.

[former_member2987 · Accepted solution]

Been there, done that!  Glad it's figured out!

M

[Former Member]

Hi ,

Could you please let me know how did you resolve the error. I'm working on IDM 7.2 SP5 and I receive following error when "Create AD user" task is executed.

Exception from Add
operation:javax.naming.directory.InvalidAttributeValueException: [LDAP: error
code 21 - 00000057: LdapErr: DSID-0C090C3E, comment: Error in attribute
conversion operation, data 0, v1db1]; remaining name
'CN=anuj0240n,OU=Security,OU=User,DC=ABCD,DC=sg'

Exception from Modify
operation:javax.naming.directory.InvalidAttributeValueException: [LDAP: error
code 21 - 00000057: LdapErr: DSID-0C090B8A, comment: Error in attribute
conversion operation, data 0, v1db1]; remaining name
'CN=anuj0240n,OU=Security,OU=User,DC=CHCS,DC=sg'

Thanks,

Anuj

[former_member2987]

Anuj.

LDAP 21 is usually a badly formatted attribute or illegal value. Are all of the elements of your dn correct? Is there an 8 character limit on cn?  Have you checked the other attributes? 

Matt

[Former Member]

Matt,

All the attributes of DN are correct. I have copied an existing DN and changed the CN."SAP ModifyAD user" task is working as expected , the problem is only with "SAP Create AD user".

I have tried with following DN , but nothing works. Everytime I get the same exception:

1.CN=anuj0240n,OU=Security,OU=User,DC=ABCD,DC=sg

2.CN=TESTABCDNEW,OU=Security,OU=User,DC=ABCD,DC=sg

3.CN=ANUJ,OU=Security,OU=User,DC=ABCD,DC=sg

Everytime I get the same error.

Is there any setting on AD where we specify the naming standards for CN?

Interesting point to note is that I'm able to perform all Modify AD operation using provisioning framework "Modify AD user" task. I can even create users with above mentioned DNs manually in AD ,but only "Create AD user" in IDM fails while creating user

Thanks,

Anuj

[former_member2987]

Anuj,

Have you checked permissions?  Can you login as the user and create an account in ADUC? Or if you don't have login permissions for that account, can you change the credentials on the job to a user that can create users and run it successfully then?

Thanks,

Matt

[Former Member]

Thanks for your help Matt.

Attribute countryCode (%MX_ADDRESS_COUNTRY%) was not supported by our MS
AD. I've disabled the attribute in "Create AD User" pass and provisioning task works as expected.

Regards,

Anuj