Dce 7.8.0.47 - Ad Group Issue

[Gianluca]

Hi All

im trying to add an AD Group 

Bind is ok but

Dce server log says 

9/22/20 15:20:00.549 WARN - Group apcdcim_users does not exist.

(com.netbotz.server.services.usergroup.impl.JdbcGroupDao)

Tried other group same result also i cannot add a single user

Logs anc CaptureLogs ready

[Anonymous user]

Hi Gianluca,

Can you confirm that the DCE server has full access to the AD server on port 389?

The client will let you add AD groups if it has access to the AD server but it doesn't check if the server has access until you try to log in.

-Gavan 

[Gianluca]

hi

dce is having full access.

i did the same to ITA server and it works

[Anonymous user]

I presume you've checked that the bind account isn't locked and that there is no IP/logon restrictions or anything like that?

Can you also confirm if the bind user is a domain admin or just has delegated rights, if it's just delegated can you use with a domain admin for testing?  

You say adding a user fails, what happens when you try?

[Gianluca]

Hi

bind is ok

Domain user is ok

the same user is using to add AD groups to IT advisor server

in Dce, when i check users after binding and press OK, i cannot see user in the list

[Anonymous user]

I know you said everything is okay but it sounds like a permissions issue, try it with a domain admin account for testing.

[Gianluca]

Hi

tried it same result.

i have capture logs

[Anonymous user]

If you'd like you can upload the logs here, but the AD server's logs and a wire-shark of both the discovery and a log in attempt might be more useful.

https://schneider-electric.app.box.com/f/9eb2a0a65ead4f40991eada42446358d

-Gavan

[Anonymous user]

Hi,

I received that DCE logs but they're a bit ambiguous, any luck getting the AD servers logs or a wireshark?

-Gavan 

[Gianluca]

i have asked to customer

waitinig

[maxamis]

any updates on this, i might be running into the same issue ?

[APC_Steve]

Hi @maxamis ,

I had hoped this would have made it into the 7.8.1 release notes but we did find an issue that was created in 7.8.0 where Active Directory users would work fine but Active Directory groups would not. If they had ben working in 7.7.x and stopped working in 7.8.0, this would potentially be the issue.  This was noted in k-base FA400486. There was a patch that support would have had to put on the system to upgrade to 7.8.0.47 if you had 7.8.0.46. 7.8.0.47 was later released on it's own. 

If you do have the 7.8.0.46 version, the resolution is to upgrade to 7.8.1. If you're at 7.8.0.47 or at 7.8.1, this is not the issue and the issue needs to be troubleshot at a more indepth level. I suggest working through the following k-base:

https://www.apc.com/us/en/faqs/FA366078/

There's a notes section near the bottom that has some helpful information that may assist with your issue.

Steve