UME & LDAP setting, Cannot add more UME MII users in NW7.1/MII 12.1.5

[Former Member]

We're using MII 12.1.5 (Build 85), configured with standard DB+LDAP authentication.

Data source: MicrosoftADS (Deep Hierarchy) + Database

Data Source File Name: dataSourceConfiguration_ads_deep_writable_db.xml

I need to a dd some users to the system, not existing in the Active Directory list (i.e. temporary access). When I try to add them to the UME database, the system is telling me I'm in trouble.

[LDAP: error code 50 - 00000005: SecErr: DSID-031521D0, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0 ]

Where should I look to elevate my rights, since I'm already logging in with the highest access on the system?

Regards,

paul.

[Former Member · Accepted solution]

Paul,

I am no UME expert (so far I've had only read only rights to UME ) but just googling your error tells me that this is coming from the Active Directory as in you are trying to create a user in AD (via UME) as opposed to in the UME itself.

May be this is what is going wrong in your case.

Just a thought, hope it helps.

Thanks

Udayan

[Former Member · Accepted solution]

Thanks Udayan,

If NW wants to add an user in AD, then the AD user specified in the configuration has to have enough rights to do that (which doesn't unfortunately, and won't have ever). I am looking to add more users in UME, not in AD.

In my case, the Active Directory structure extends on multiple levels. For example, there is an AD server for corporate and then another AD servers for plants. The users in the plants are able to connect to the plant MII using their local credentials, but they cannot authenticate to the corporate MII development box (not being visible from the corporate AD leaf). Therefore, being a handful of names, I was thinking to add them in UME and bypass the AD authentication in their case (not being an AD expert) for the development server.

Who said networking is easy? I can't remember ..

j/k

paul.

[florin_stoian · Accepted solution]

Hi Paul

go to /useradmin and get the xml configuration file of ume datasource.

Take the first lines where datasource ume is defined and posted here...

could be even if i never saw something like that for users that datasource ume is read-only.

Florin

[Former Member · Accepted solution]

Hi Florin,

Here we go,

 
<dataSources>
<dataSource id="PRIVATE_DATASOURCE" className="com.sap.security.core.persistence.datasource.imp.DataBasePersistence" isReadonly="false" isPrimary="true">

...

<dataSource id="CORP_LDAP" className="com.sap.security.core.persistence.datasource.imp.LDAPPersistence" isReadonly="false" isPrimary="true">

Looking at this cfg xml .. can be both primary?

paul.

[florin_stoian · Accepted solution]

Hi (Salut) Paul

Please search for a property like

<homeFor>

<principals>

<principal type="user"/>

</principals>

</homeFor>

If it's defined for both datasources then when you try to create a user, it doesn't know where to create it.

if it's not defined for none of the datasource, then just add in the datasource where you want to create the users.

you can get more details regarding your error from defaulttrace

Regards,

Florin

[Former Member · Accepted solution]

Sal'tare!

We've found something which might solve the issue .. eventually. The LDAP Groups were changed (i.e. in fact the server alltogether was changed, and now the MII groups settings do not reflect the reality). I'll let you know what happens after the LDAP communication is restored ..

many thanks

paul.

[Former Member · Accepted solution]

Hey Paul,

I am having the same issue as you. The MII DEV server that I am trying to create users for has LDAP set up but the checkbox "Use SSL LDAP access" is unchecked. But I was assured that it is not being used for the dev environment. Did you ever find a solution?

thanks,

Robert