Problems with Connectivity

Indication:

The logging of the SharePoint Connector, which is contained in the Java server log file if run inside a workflow, states that even though a connection to the SharePoint server was made successfully, the search on the specified site fails with the above error code.

Reason:

The reason for this error code is an incorrect server URL (property "Site URL" of the SharePoint Provisioning ClusterTarget System "Server Connection" tab).

Solution:

Depending on your Windows domain DNS configuration it is important that you specify the server URL in the appropriate form, which can be either a short server name form, like

http://shp_server1/sites/SiteCollection/SC_SiteA

or a fully qualified server name form, like

http://shp_server1.mydomain.com/sites/SiteCollection/SC_SiteA

or just a form without any server name, like

http://DXI_TestSiteCollection/SC_SiteA

You must try and find out which form fits with your environment.

Indication:

The logging of the SharePoint Connector, which is contained in the Java-based server log file if run inside a workflow, states that even though a connection to the SharePoint server was built up successfully, the search on the specified site fails with the error code above.

Reason:

The reason for this error code is an incorrect password (property "bind account" of the SharePoint Provisioning ClusterTarget System "Server Connection" on a clustered SharePoint target system or the password of the Bind Profile of the Connected Directory on a non-clustered target system).

Solution:

Specify the correct password.

Indication:

The SharePoint Connector log, which is contained in the Java-based Server log file if run inside a workflow, states that the connection during a validation or synchronization workflow has been reset due to a java.net.SocketException and the workflow was aborted.

Reason:

The reason for this error is that the "Unlimited Strength Java Cryptography Extension Policy Files" JRE extension has been installed in the JRE the Java-based Server runs with.

Solution:

If JRE version 8 is used, the Unlimited Strength Java Cryptography Extension (JCE) package should not be installed.Only the limited JCE should be installed; this version is installed by default when installing a JRE.If JRE version 7 is used, both limited and unlimited variants of JCE can be used.

Indication:

When you set the Use Secure Authentication flag in the bind profile, you can set user passwords, but binding to the deleted objects container fails if the agent runs on a Windows NT machine.

Reason:

Due to a Microsoft bug in the ADSI Version on Windows NT, a bind to the deleted objects container fails when the Use Secure Authentication flag is set.

Solution:

If you want to be able to set user passwords and also get deleted objects, use different bind profiles for ADS Import and Export when running on Windows NT. Set the flag in the bind profile used for import (note that if you set this flag, the username must be specified in the form domainname*\*username on Windows NT) and do not set it in the bind profile used for export.

Indication:

When a mailbox is deleted, the stored resources are not deleted and become orphaned.

Reason:

Due to a Microsoft bug, the stored resources are not deleted if an Exchange 5.5 mailbox is deleted using the ADSI/LDAP API. They are only deleted using the DAPI API or the Exchange Administrator Tool.

Solution:

Indication:

During workflow execution, a metacp job exits with exit code 4, and no further information or not enough information about the reason for the problem is visible in the report, trace, or process info file of the related status entry.

Reason:

There is a serious syntax error in a Tcl script involved in the job, for example, a missing opening brace in a script.

Solution 1:

Run the workflow again. If this action does not provide more information, try solution 2.

Solution 2:

Solution 3:

Set debug_scripts = 1 in the central control script, rerun the workflow and view the file workpath/workflowDisplayName/activityDisplayName*/dump.txt*.

If the error output in this file is related to the DirX Identity default scripts rather than to your customizations, inform your DirX Identity support service about the problem. Otherwise, fix the problem in your scripts.

Don’t forget to reset the debug_scripts switch in the central control script after you have fixed the problem.

Solution 4:

If none of methods just described provide enough information, you need to insert additional debug statements (like puts…​, meta writetrace…​, trace_out…​) in order to find and fix the problem.

Indication:

During GUID generation (adding an entry) this message is displayed:

Reason:

The start value to generate the next GUID value is not set.

Solution:

Specify the attribute dxmActualGUIDvalue at the target connected directory to the required value. (Specify 1 if this is the first entry, otherwise specify the highest number + 1 of existing GUIDs in the directory.)

Indication:

During execution of metacp jobs in Tcl-based workflows, metacp does not recognize additional attribute names if the number of attributes to be synchronized is greater than 64. In this case, LDAP attributes which have been defined in the schema so that they have not only a primary name but additional attribute names are not handled in a correct way.

Reason:

In order to tune performance, metacp simply requests all attributes instead of specifying longer attribute lists explicitly. The search result contains the primary LDAP attribute names which are not necessarily identical to related additional attribute names.

Solution:

Use primary LDAP attribute names (attribute configuration, mapping) in these jobs instead of additional attribute names. As a short-term workaround in a production environment, perform the following change in the file init.metacp: set the Tcl variable _md_req_attr_limit to the value -1 instead of 64. The file is located in install_path/bin (Windows) or install_path/client/conf (UNIX), respectively. Remember to check this setting again whenever you repeat the installation of the release or a related service pack.

Indication:

During execution of metacp jobs in Tcl-based workflows, metacp does not recognize operational attribute names if the number of attributes to be synchronized is greater than 64.

Reason:

In order to tune performance, metacp requests simply all attributes instead of specifying longer attribute lists explicitly. Therefore, the search result doesn’t contain operational attributes.

Solution:

As a short-term workaround in a productive environment perform the following change in the file init.metacp: set the Tcl variable _md_req_attr_limit to the value -1 instead of 64. The file is located in install_path/bin (Windows) or install_path/client/conf (UNIX), respectively. Remember to check this setting again whenever you repeat the installation of the release or a related service pack.

Indication:

The initial configuration hangs in one of the steps:

or when running Tcl workflows in the MSS, the workflow hangs.

Reason:

When running metacp using a Tcl script, metacp hangs if the meta controller flushes messages either to stdout or stderr by means of a fprintf operation. Such an fprintf operation conflicts with the native Tcl I/O handling by means of puts. This situation appears if certain environment variables are set to enforce metacp to output trace information on stderr.

Solution:

Run metacp in a DOS box or UNIX shell and check whether metacp flushes messages to stderr. If true, then you should unset the environment variables. Check all the environment variables that start with prefix DIRX_ and unset those that are not absolutely necessary.

Indication:

Sometimes people find that Tcl behaves differently than they expect (often because of the way some other language acts in a similar situation). They then think this unexpected behavior is a bug. Probably the most common occurrence of this is in regard to comments.

Reason:

In Tcl, everything passed to the parser must have proper list structure, even comments (and comments are passed to the parser, unlike in some languages, where they are stripped at an earlier stage). Generally, this means you need to make sure your braces are evenly matched, even though they may be on a line that is commented out.

Solution:

Indication:

Warnings are not logged at all.

Reason:

Logging of warnings is dependent on the trace level Variable trace.

Solution:

Select a trace level that comprises Variable trace.

Indication:

The meta controller activity, especially import workflows, seems to run very slowly compared with the amount of entries to be produced.

Reason:

A possible reason can be searches for attributes that are not indexed.

Solution:

Indication:

A 'parse error' message is displayed when the meta controller (metacp) reads an XML file.

Reason:

The export parser has detected an incorrect XML file.

Solution:

Use an XML editor or viewer to check the file before you read it with the meta controller. For example, use Microsoft Internet Explorer.

Indication:

Running an import operation with the Windows NT meta agent on a Windows 2000 or Windows XP machine generates the error message:
Error 87: Invalid Parameter

Reason:

The AccountType in the initialization (*.ini) file is set to 1. This functionality is not supported on Windows 2000 and Windows XP.

Solution:

Set the AccountType in the initialization file to 0.

Indication:

Error message in the file report.log:

The RPC server is unavailable

Reason:

This error will occur if your machine has a different host and machine name.

Solution:

Indication:

Lotus Notes / Domino Agent shall read the password automatically from a file.

Reason:

Administrative requirement.

Solution:

Perform this administrative step:

Specify the extension manager by extending the section [Notes] in the file notes.ini:

[Notes]
EXTMGR_ADDINS=nextpwd.dll

The location of notes.ini depends on the version of your Lotus Notes client:

Indication:

ODBC Agent enhancements may cause errors in old ODBC workflows

Reason:

In older versions it was sometimes necessary to specify column specification using tablename*.*columnname format. Using abbreviations was not possible. The new version of the agent provides full support of abbreviations.

If you have used SQL columnnames identical to an abbreviation this might result in strange SQL error messages. The columname is interpreted as abbreviation and the long form of the abbreviation is inserted in the SQL statement. If you turn on SQL tracing you will see the generated SQL statement.

Solution:

Use abbreviations in your configuration.

Example:

Indication:

The error occurs during export of data from the ODBC database. A ODBC Microsoft Access Driver is used. The following message is logged:

Reason:

The SQL query requests a field that is not present in the database. The field is defined in the attribute configuration of the ODBC database object and used in the source selected attributes.

Solution:

Define the necessary field(s) in the ODBC database.

Indication:

Activating the menu action 'Extras/Copy Export' on an R/3 release 4.7 system results in a pop-up info box that has to be confirmed.

Reason:

The info states that the SAP R/3 HR agent uses an old but otherwise still supported R/3 download functionality. Nevertheless, the Copy Export function works.

Solution:

You can ignore this message. This is an R/3 issue.

Indication:

Languages other than English or German the export of the text description of profiles or roles in a CUA environment does not work correctly. The default workflow does not export this attribute.

Reason:

Incomplete implementation.

Solution:

Change the workflow to export this attribute if you work with English or German texts.

Indication:

In DirX Identity 7.0B and 7.0B service packs, the handling for setting and modifying a user password in SAP EP through the “Ident_SAPEPUM_Sync” workflow (setting a password on account creation) and the “setPassword in SAP EP UM” workflow (modifying a password) is not easy.If not handled correctly you can get the error message:
“could not update user WRONG_PASSWORD” in the java servers logfile.

Reason:

In SAP EP, a password can only be modified when the old password is also passed in the modify request.Therefore the setPassword workflow for a password modification passes the password value the Sync workflow has set when creating the ts account as old password.This is not easy because, in 7.0B and patches, the Sync workflows for all target systems use the account attribute “dxrPassword” to set the password on account creation in the target systems.On the other hand the setPassword workflows use the dxmPassword attribute of the account for password modification.Starting from version 7.0C, the Sync workflows also use the dxmPassword attribute.

Solution:

When an account is created for a user in Identity through for example an assigned privilege, ensure that the dxrPassword, which is calculated through a java script on account creation, has the same value or is set afterwards to the same value as the dxmPassword attribute of account and user is set to.Then start the Sync workflow which creates the account in SAP EP with the password in dxrPassword.If then the user password is requested to be changed, for example by the WebCenter, an event is generated with the old password taken from dxmPassword of the user - matching the password now existing in SAP EP - and the newly requested password, which results in a correct update of the users password in SAP EP.