RAS Attributes

Question

Hi community.

I've got a problem while creating ADS Account. I have two domains connected to Q1IM and for one domain creating users works fine. But for the second domain not. I have checked attributes mapping and it seems OK. I have also checked permissions on AD. I don't see any differences in configuration. So, where/what else should I check?

The connection mode of the provider was set to Default.

The access to RAS attributes was set with the value True.

The access to terminal properties was set with the value True.

[854003] Processing task ADSAccount Insert failed.

[997030] Cannot publish object LDAP://MYSERVER:389/CN=My Commonname,OU=Users,OU=MyOU,OU=myOU,DC=mySubDomain,DC=mydomain,DC=mydomain (Message : Cannot save RAS settings of object LDAP://MYSERVER:389/CN=My Commonname,OU=Users,OU=MyOU,OU=myOU,DC=mySubDomain,DC=mydomain,DC=mydomain.).

[997021] Cannot save RAS settings of object LDAP://MYSERVER:389/CN=My Commonname,OU=Users,OU=MyOU,OU=myOU,DC=mySubDomain,DC=mydomain,DC=mydomain.

[System.Exception] RAS properties not written (Error reading RAS properties of account my.commonname using server MYSERVER

at StdioProcessor.StdioProcessor._Execute(Job job)

at VI.JobService.JobComponents.ADSComponent.Activate(String Task)

---- Start of Inner Exception ----

at VI.JobService.JobComponents.ADSComponent.Activate(String Task)

at VI.JobService.JobComponents.ADSComponent._ADSACCOUNT_INSERT()

at VI.JobService.NSProvider.ADSProvider.PutObject()

---- Start of Inner Exception ----

at VI.JobService.NSProvider.ADSProvider.PutObject()

---- Start of Inner Exception ----

at VI.JobService.NSProvider.ADSProvider.PutObject()

at VI.JobService.NSProvider.RAS.SET(String ServerName, String UserName)

Thanks for help.

Best regards,

Evgen

Steffen.Einert · Accepted Answer

Hi Evgen, for the access to the RAS properties NOT the login credentials from the parameters of the job are used (LDAPLogin and LDAPLoginPassword) BUT the account which is used for the Q1IM Jobservice: If your Jobservice is responsible for only one domain you should change this user. But it's not possible if ONE Jobservice is responsible for more than one domain. In this case you could find a way to permit the user from the 1st domain in the 2nd domain too. Or install a 2nd Jobservice. It's possible on the same machine too. I hope it helps. Regards, Steffen

Markus Weiss-Ehlers · Answer

Check the documentation https://support.oneidentity.com/technical-documents/identity-manager/8.0/administration-guide-for-connecting-to-active-directory/2#TOPIC-851785 and search for Allow read and write access to Remote Access Service (RAS) properties.