Problems when syncing AD with OID

Lately I've been doing some AD-OID synchronization.

Should be not that difficult, but as so often the devil is in the detail.

The AD admin created a user that is capable of reading the complete AD - as it is described in the documentation.

Then I tried to login. And tried, and tried. Password was reset, different password was used, etc.

No luck.

I tried a very easy ldapsearch and received the follwoing error:

80090308: LdapErr: DSID-0C09030B, comment: AcceptSecurityContext error, data 531, v893
HEX: 0x531 - not permitted to logon from this workstation
DEC: 1329 - ERROR_INVALID_WORKSTATION (Logon failure: user not allowed to log on to this computer.)
LDAP[userWorkstations: ]
NOTE: Returns only when presented with valid username and password/credential.

Aha, that gave me a clue. So the username and password seemed to be correct. Some googeling established the problem.

The user was created but the AD admin did not allow the user to login to the machine where the AD was running.

Comments

Different silent install files WLS 10.3.2 and 10.3.3

Today I tried to cut some corners and use a silent.xml file for WLS 10.3.3 for a silent installation of 10.3.2. To my amazement on a clean machine I received the following error: oracle@xxx001:/opt/oracle$ java -Djava.io.tmpdir=/opt/oracle/tmp -jar /nfsstage/wls1032_generic.jar -mode=silent -silent_xml=./silent/wls_silent.xml -log=/tmp/wls.log Extracting 0%....................................................................................................100% The local BEA product registry is corrupted. Please select another Middleware Home or contact Oracle Support I checked the wls_silent.xml file and found that it includes Coherence, which was not bundled with the 10.3.2 version. So I modified the 10.3.3 silent_xml file from value="WebLogic Server/Core Application Server|WebLogic Server/Administration Console|WebLogic Server/Configuration Wizard and Upgrade Framework|WebLogic Server/Web 2.0 HTTP Pub-Sub Server|WebLogic Server/WebLogic JDBC Drivers|WebLogic Server/Third ...

Unpacking Oracle cpio for AIX

When extracting a cpio file with Oracle software from OTN on AIX you might encounter the following problem: oracle@mymachine-app:/install/oracle/MRCA>cpio -idmv cpio: 0511-903 Out of phase! cpio attempting to continue... cpio: 0511-904 skipping 642010 bytes to get back in phase! One or more files lost and the previous file is possibly corrupt! Segmentation fault The solution is to use the option -idcmv oracle@mymachine-app:/install/oracle/MRCA>cpio -idcmv c Reads and writes header information in ASCII character form. If a cpio archive was created using the c flag, it must be extracted with c flag.

Add a user to the JavaSSO

In AS 10.1.3.x Oracle came up with the JavaSSO. Seems to be (from a high level perspective) a poor man's version of the SSO from the AS 10.1.2.x. Having said this it strikes me how little documentation is available for this feature. But we're explorers, aren't we? JavaSSO is based on a file based security provider. The two main files are: - jazn.xml - system-jazn-data.xml Both exist in the $OH/j2ee/ directory. This means that if you have more than one OC4J instance you need to edit both. The most basic task is to add a user. You can - of course try to do this by editing the xml files, but luckily Oracle provides the jazn.jar tool. Make sure that you use the correct java executable and start it: java -jar jazn.jar -adduser jazn.com andreas welcome1 You will be asked for the AbstractLoginModule username (oc4jadmin) and its password. Now we have a user but usually this has to be added to a role before it can do something useful: java -jar jazn.jar -grantrole users jazn.com an...

Andreas' Adventures

Search This Blog