IBM Verify

IBM Verify

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Identity Manager - RACF Adapter - manage group members doesn't work

    Posted 11/28/25 11:43 AM

    I'm working with ISIM 10.0 and IDS 6.4 with the RACF adapter installed (among many others). (Yes, I know the environment needs to be upgraded).

    When I try to manage the members of a group, I get an error in the GUI:

    LDAP error 92

    In debugging this, I can see that the error occurs because the system is trying to do a substring search on the erracconxml LDAP attribute, which is defined as a BINARY attribute. Everything I can find online states that substring searches are absolutely not possible on BINARY attributes in IBM Directory Server. So I don't believe that this has ever worked, and I don't think it can work due to this restriction. I've even reproduced it with other BINARY attributes. For example, doing a simple ldapsearch with the filter "erxml=*foo*" gives the same error code.

    My questions are:

    1. Is this supposed to work?
    2. If so, what do I need to configure to get it to work?

    Thanks,

    Frank



    ------------------------------
    Frank Tate
    Gulfsoft Consulting
    https://www.gulfsoft.com
    AIOps Experts. Contact us for implementation help.
    ------------------------------


  • 2.  RE: Identity Manager - RACF Adapter - manage group members doesn't work

    Posted 11/29/25 04:31 AM

    Get a case out of the door - that sounds like an attribute definition that is wrong.

    The challenge here may be that the length of the erraconxml attribute can be longer than what a varchar can accommodate. This is why you will see a short msg and a msg in the process tables where XML data is stored.

    You COULD delete all RACF accounts (or just the erraconxml attributes) and try to change it to varchar and see if that fixes your problm (do not do this on a production system...)

    HTH



    ------------------------------
    Franz Wolfhagen
    WW IAM Solution Architect - Certified Consulting IT Specialist
    IBM Expert Labs
    ------------------------------



  • 3.  RE: Identity Manager - RACF Adapter - manage group members doesn't work

    Posted 11/29/25 04:34 AM

    I forgot one thing - the RACF Adapter is dependent on a complex attribute handler - can you see if the logs indicates anything about that ? 

    The problem on IVIG 11 was fixed recently - I believe it was related to the a build problem on the new Liberty platform. 



    ------------------------------
    Franz Wolfhagen
    WW IAM Solution Architect - Certified Consulting IT Specialist
    IBM Expert Labs
    ------------------------------

    Original Message


  • 4.  RE: Identity Manager - RACF Adapter - manage group members doesn't work

    Posted 11/29/25 10:13 AM

    Thanks for the replies, Franz. I already looked at the Complex Attribute Handler, and this is unrelated. That Java class builds (and reads) the XML that is stored in the erracconxml attribute for some parts of the product, but it is not involved in Manage Group Members. The error I'm seeing is definitely because it's a BINARY attribute. I just checked in the latest adapter, and it is still defined as a BINARY attribute. I'm guessing no one has tested this particular part of the product. 

    I am going to open a call with support.

    Thanks again.



    ------------------------------
    Frank Tate
    Gulfsoft Consulting
    https://www.gulfsoft.com
    AIOps Experts. Contact us for implementation help.
    ------------------------------

    Original Message


  • 5.  RE: Identity Manager - RACF Adapter - manage group members doesn't work

    Posted 11/30/25 02:59 PM

    It's funny. I see this comment in the schema.dsml file for the latest adapter:

    2017-11-22 J. Ruijter  Changed erracconxml to directory string

    (This is the most recent comment about this attribute).

    But the change wasn't made. The attribute is still defined as BINARY (syntax 1.3.6.1.4.1.1466.115.121.1.15) with length 2048:

      <attribute-type single-value = "false" >
         <name>erRacConXML</name>
         <description>User Group Connection Group Name</description>
         <object-identifier>1.3.6.1.4.1.6054.3.127.2.200</object-identifier>
         <syntax>1.3.6.1.4.1.1466.115.121.1.15{2048}</syntax>
       </attribute-type>

    So I do think that changing it as you suggested will work. 

    Thanks again!



    ------------------------------
    Frank Tate
    Gulfsoft Consulting
    https://www.gulfsoft.com
    AIOps Experts. Contact us for implementation help.
    ------------------------------

    Original Message


  • 6.  RE: Identity Manager - RACF Adapter - manage group members doesn't work

    Posted 12/01/25 01:27 AM

    The reason it is not changed during load of the new profile is because there are attributes with values in the system - and Directory Server does not allow a change of the schema if there are...

    You can remove all account/group values in the ldap and then it MAY work - but doing it directly in the Web Admin Tool is the best option....

    WARNING : do NOT change it in v3.modifiedschema if you did not do the attribute cleanup - that is is sure way of giving you troubles....



    ------------------------------
    Franz Wolfhagen
    WW IAM Solution Architect - Certified Consulting IT Specialist
    IBM Expert Labs
    ------------------------------

    Original Message


  • 7.  RE: Identity Manager - RACF Adapter - manage group members doesn't work

    Posted 12/01/25 02:07 AM

    Hello, 

    These situations occured more than once to us, during AD adapter upgrades for example. Once or twice our old adapter guid naming matched IBM's new fields.Then we stopped using numbers :) On one switch from 5.1 to 6 I think, every boolean was string (example: forcepasswordchange)  but made boolean in next adapter. Anyway, we had written SDI AL's to remove ( set null ) to these attributes only on ISIM's ldap.

    You can give a filter (&(objectclass=racfaccount)(erracconXML=*)), clear everything. Then re-import the profile. A reconciliation after brings every data. However during this period, ISIM should not attempt to update that field ( policy mark mode may help but it may not be enough) because that will gave an error. You should consider if modify / change password operations will affect your field. 

    Thanks, 



    ------------------------------
    Ali Malik Gürbüz
    Bilgibirikim A.S - Turkey/EMEA
    IBM Business Partner
    13+ Years with ISIM/ISVG etc.
    5.2.5 Certified Exam Developer *I* - 2019
    IBM Champion 2025
    ------------------------------

    Original Message


  • 8.  RE: Identity Manager - RACF Adapter - manage group members doesn't work

    Posted 12/11/25 11:25 AM

    Thank you very much for the replies, @Franz Wolfhagen and Ali Malik Gürbüz (Ali, somehow your name doesn't show up when I search for it with an "@" mention).

    I'm certain your suggestions will work, but we are leaving this alone for the moment. It has been deemed a very low priority.



    ------------------------------
    Frank Tate
    Gulfsoft Consulting
    https://www.gulfsoft.com
    AIOps Experts. Contact us for implementation help.
    ------------------------------



Related Content