LDAP query returned an entry with an objectclass that is not part of the schema. Entry: 'uid=11710,ou=people,dc=isbank' ObjectClass: 'organizationalPerson '. This is very likely a corrupted entry.

Hi,

it looks like there is a trailing space in the value of ObjectClass. Removing that trailing space should repair the broken entry.

best regards

Hi Andreas,

Your suggesstion is completely right. There is a space at the end of some objectclasses. When i clear them for an user the error is changed. LDAP source side needs to be fixed for all failing users. 

Thank you very much for your help,

BR

How can i skip these users? I tried to user uid<>11710 in object filter in Sync editor.. But it didn't make that user out of scope... I want to skip these users or make them out of scope all. Could you share any usage examples?

You need to use an system filter. An object filter will not help in this situation.

System filters are send to the target system (LDAP) when loading the list of objects. The LDAP will do the filtering and return the result without the "bad" items. An object filter is applied after a list result is parsed. In your situation parsing fails due to faulty data.

A system filter is a filter condition in the target systems own filter syntax. I'm not familiar with LDAP filter syntax and can not provide an example.

According to LDAP syntax reference

This should exclude all entries with 11710 or 12345 as uid
(&(!uid=11710)(!uid=12345))

This should exclude entries with "organizationalPerson " (note the trailing space) as objectClass
(!objectClass=organizationalPerson\ )

I tried to use lots of options for filtering but it is still getting same ObjectClass trailing space error. You can see some of my filtering queries below.

 Objectclass=organizationalPerson\20
 Objectclass=organizationalPerson\%20
 Objectclass='organizationalPerson '
 Objectclass='organizationalPerson\ '
 Objectclass:=b3JnYW5pemF0aW9uYWxQZXJzb24g

I think synchronization project behaviour is first it loads all target system schema and users and other object's data then use my filter. So it gets error during loading schema when it tries to get the user which has a space at the end of the objectclass. How can i skip these broken users from the beginning of synchronization.(loading all schema. ) There should be a way to skip these users or make them out of scope. 

That is the reason why I wrote:

Andreas Finsterbusch said:

You need to use an system filter. An object filter will not help in this situation.

Make sure to use the "System filter" tab when setting the filter as a scope condition.

The proper LDAP filter syntax is

Andreas Finsterbusch said:

(!objectClass=organizationalPerson\ )

I understand that "System filter" can solve my problem . But i am not sure about useage... Now i want to see getting an user who has correct objectclass. For example: uid=100083 has not any space in objectclass. I tried to fetch only this user and I used system Filter for this user like "(uid=100083)" on the "Target System - Scope - inetOrgPerson - System filter". I am not sure the syntax and scope is the right place? Because when I run synchronization I still face same error for same user. (uid=11710). There is something wrong in my filter. It doesn't work.. Maybe I should use filter in "Target system - Schema classes - myCustomInetOrgPerson - System filter" . (It doesn't allow to edit default schema. so i have to create custom one).

As a result correct filter usage would be very useful.

Enter "(!objectClass=organizationalPerson\ )" as  "Target System - Scope - inetOrgPerson - System filter". If you als have a reference scope defined, also enter the system filter there. Use the Target System Browser ("Browse..." ) to check if the filter is working properly. If this works, make sure to Commit to database.

You also can test filters in the Target System Browser by using the "Filter result list..." button at the top of the result list.

I tried a simple filter that is less complex than the other one ("(!objectClass=organizationalPerson\ )"). Because that did not work. I just want to filter one user who has no spaces his objectclasses. Therefore I use "(uid=100083)" in Target System Browser filter and I can get the user. You can see the related screenshots below. Now i understand that I can see the right users with rigth filters in browse section.

https://www.dropbox.com/s/511rxt34yyv2fuc/SystemFilter.jpg?dl=0

https://www.dropbox.com/s/40ohn9xy9z7oeed/uid%3D100083.jpg?dl=0 

But I run the schedule it is still getting the same error : LDAP query returned an entry with an objectclass that is not part of the schema. Entry: 'uid=11674,ou=people,dc=isbank' ObjectClass: 'person  '. This is very likely a corrupted entry.

I put the same filter in both System filter tab under  scope and reference scope. Please see the related ss below. But synchronization is still getting same objectclass error for  the user who is out of my filters and scopes..

https://www.dropbox.com/s/w92b0fod69ecypc/referenceScope%20systemFilter.jpg?dl=0

https://www.dropbox.com/s/kay8u4cbz31ajyo/scope%20systemFilter.jpg?dl=0