Oracle ZFS Storage Appliance: LDAP Configuration: Cannot map both posixAccount and shadowAccount to user.

Asset ID:	1-72-2395667.1
Update Date:	2018-05-08
Keywords:

Solution Type Problem Resolution Sure

Solution 2395667.1 : Oracle ZFS Storage Appliance: LDAP Configuration: Cannot map both posixAccount and shadowAccount to user.

Applies to:

Oracle ZFS Storage Appliance Racked System ZS5-4 - Version All Versions and later
Oracle ZFS Storage ZS3-4 - Version All Versions and later
Sun ZFS Storage 7420 - Version All Versions and later
Oracle ZFS Storage ZS4-4 - Version All Versions and later
Oracle ZFS Storage ZS3-2 - Version All Versions and later
7000 Appliance OS (Fishworks)

Symptoms

Customer is configuring LDAP service and maps both posixAccount and shadowAccount to user :

CLI:configuration services ldap> set user_mapobjclass="posixAccount=user","shadowAccount=user"

LDAP service is in Maintenance Mode :

svc:/network/ldap/client:default (LDAP Name Service Client)
State: maintenance since Fri Apr 27 13:10:33 2018
Reason: Start method failed repeatedly, last exited with status 1.
See: http://support.oracle.com/msg/SMF-8000-KS
See: man -M /usr/share/man -s 1M ldap_cachemgr
See: /var/svc/log/network-ldap-client:default.log
Impact: This service is not running.

LDAP errors seen in debug.sys:

ldap_cachemgr[1938]: [ID 293258 daemon.error] libsldap: Status: 0 Mesg: Unable to set value: schema map already existed for (user, shadowAccount).
ldap_cachemgr[1924]: [ID 703877 daemon.error] ldap_cachemgr: failed (rc = 255).
svc.startd[127]: [ID 652011 daemon.warning] svc:/network/ldap/client:default: Method "exec /lib/svc/method/ldap-client start" failed with exit status 1.
svc.startd[127]: [ID 748625 daemon.error] network/ldap/client:default failed: transitioned to maintenance (see 'svcs -xv' for details)

Changes

Cause

Currently on the ZFS Storage Appliance, we cannot set object class mappings of both posixAccount and shadowAccount to user.

Solution

Map posixAccount to user and shadowAccount to person.

CLI:configuration services ldap> set user_mapobjclass="posixAccount=user","shadowAccount=person"

References

<NOTE:1402353.1> - Sun Storage 7000 Unified Storage System: How to Troubleshoot Active Directory Issues
<BUG:16357292> - UNABLE TO MAP BOTH POSIXACCOUNT AND SHADOWACCOUNT TO USER IN LDAP CONFIGURATION

Attachments

This solution has no attachment