LDAP - Distinguished Name changed -- duplicate user

bmeyns

We are using LDAP to let our users authenticate to our Aware IM applications (create Aware IM user automatically).
This is working fine, but we've noticed problems when the "Distinguised Name" of a user has been modified on our Active Directory:

The user can not login anymore and we get this error:

2011-12-14 11:43:13,465 ERROR  -Unable to login due to system error
com.bas.basserver.executionengine.ExecutionException: User with this login name already exists. Please choose a different name
	at com.bas.basserver.executionengine.a.d.void(Unknown Source)
	at com.bas.basserver.executionengine.a.d.goto(Unknown Source)
	at com.bas.basserver.executionengine.a.f.a(Unknown Source)
	at com.bas.basserver.executionengine.a.f.do(Unknown Source)
	at com.bas.basserver.executionengine.a.f.e(Unknown Source)
	at com.bas.basserver.executionengine.a.f.a(Unknown Source)
	at com.bas.basserver.executionengine.a.f.execute(Unknown Source)
	at com.bas.basserver.executionengine.ExecutionEngine.a(Unknown Source)
	at com.bas.basserver.executionengine.ExecutionEngine.startChildProcess(Unknown Source)
	at com.bas.basserver.executionengine.b.e.a(Unknown Source)
	at com.bas.basserver.executionengine.b.g.a(Unknown Source)
	at com.bas.basserver.executionengine.b.g.a(Unknown Source)
	at com.bas.basserver.executionengine.b.g.a(Unknown Source)
	at com.bas.basserver.executionengine.b.h.for(Unknown Source)
	at com.bas.basserver.executionengine.b.h.execute(Unknown Source)
	at com.bas.basserver.executionengine.ExecutionEngine.a(Unknown Source)
	at com.bas.basserver.executionengine.ExecutionEngine.a(Unknown Source)
	at com.bas.basserver.executionengine.ExecutionEngine.a(Unknown Source)
	at com.bas.basserver.executionengine.ExecutionEngine.createEntity(Unknown Source)
	at com.bas.basserver.executionengine.ExecutionEngine.createEntity(Unknown Source)
	at com.bas.basserver.session.SessionManager.a(Unknown Source)
	at com.bas.basserver.session.SessionManager.a(Unknown Source)
	at com.bas.basserver.session.SessionManager.a(Unknown Source)
	at com.bas.basserver.session.SessionManager.login(Unknown Source)
	at com.bas.basserver.channels.ChannelManager.handleSocketLoginRequest(Unknown Source)
	at com.bas.basserver.bsmanager.k.run(Unknown Source)
	at java.lang.Thread.run(Thread.java:662)

The problem is Aware is creating a second user with the same username, but with the new modified Distinguised Name. As a result, the user can not login anymore.

Does anyone has a solution for this problem?

Regards, Benny

bmeyns

Just to notify you how I fix these problems now:
The user is created twice (old and new DN) in the LDAP mapping-table ("<BO>m"-table).

Lookup the new created distinghuised name mapping-record and switch the DN-string with the content of the old DN-record.
Remove the last created DN-record and try to login again.

So, avoid changing DN's in your LDAP-repo 😉

RLJB

On the rare chance someone else gets this error (we did); our fix is similar to the one above but slightly different:

Go to the LDAP mapping-table ("<BO>m"-table). For the new entry copy the new string for the Distinguished name.
Paste that string into the OLD entry for that user in the same table.
Delete the new entry from the LDAP mapping-table ("<BO>m"-table) i.e delete the row from the table.
Delete the user (Reg User table) that was created when the new entry was created

Using this method, the login stays connected to the OLD user record (thus keeping the history) rather then the new one.

bmeyns

We're still experiencing this problem.
When a "distinguished name" get changed (e.g. when a user simply changes to another Organisational Unit "OU"), Aware creates a new RegularUser object with that new "distinguished name" mapping (login options set to "create Aware IM user automatically").
How could this be avoided? We would like to get the "distinguished name" original user updated to the new "distinghuised name".
Or can we configure the Aware LDAP authentication to map to the Active Directory "GUID" of "SID" property instead to map to the "distinguished name"?