[389-users] AD Sync Fails with: R00002105: LdapErr: DSID-0C0907C9, comment: Error processing control, data 0, vece.

[Rich Megginson]

On 07/19/2011 08:55 PM, Josh Miller wrote:
> On 7/12/2011 7:33 AM, Rich Megginson wrote:
>
> Hi Rich, thanks for the response.
>
>> On 07/11/2011 09:31 PM, Josh Miller wrote:
>>> Using:
>>> - 389 DS 8.1
>> 8.1???? Platform? rpm -qi 389-ds-base
>
> Name        : centos-ds-base               Relocations: (not relocatable)
> Version     : 8.1.0                             Vendor: CentOS
> Release     : 0.14.el5.centos.2             Build Date: Thu 14 May 
> 2009 06:38:31 AM PDT
> Install Date: Thu 03 Feb 2011 12:15:02 PM PST      Build Host: 
> builder10.centos.org
> Group       : System Environment/Daemons    Source RPM: 
> centos-ds-base-8.1.0-0.14.el5.centos.2.src.rpm
> Size        : 5117970                          License: GPLv2 with 
> exceptions
> Signature   : DSA/SHA1, Tue 26 May 2009 03:33:09 PM PDT, Key ID 
> a8a447dce8562897
> URL         : http://www.centos.org/
> Summary     : CentOS Directory Server (base)
> Description :
> CentOS Directory Server is an LDAPv3 compliant server.  The base 
> package includes
> the LDAP server and command line utilities for server administration.
32-bit or 64-bit?
>
>>> - AD 2003/2008
>>>
>>>
>>> I am trying to sync from AD (one way) to 389 DS and getting the
>>> following error:
>>>
>>> R00002105: LdapErr: DSID-0C0907C9, comment: Error processing control,
>>> data 0, vece.
>>>
>>> A tcpdump does not appear to reveal anything in the way of errors
>> Could you post an excerpt from it?
>
> I've attached the portion of the package capture between the 3-way 
> hand-shake between the domain controller and when the directory server 
> begins sending it's entries back to the domain controller.
I know tshark has a mode that can produce a hex dump along with a 
"printable" view.  I need to see the hex dump.

Can you also provide your centos-ds windows sync agreement entry?
>
>>> and I
>>> got the above error from the packet capture.
>>>
>>> Any idea how to continue troubleshooting or resolve this issue?
>>>
>>> I can query AD via ldapsearch using the AD credential set that I have
>>> configured in the sync agreement.
>> 389 uses the AD DirSync Control for reading the list of changes. The
>> bind DN you are using to connect to AD must have Replicator rights in
>> order to use this control.
>
> I believe this has been done already, although I have no access to the 
> domain to verify this other than through LDAP.  I have confirmed this 
> with the windows admin twice now to be sure.
There is a python-ldap script you can use for testing.  See 
https://github.com/richm/scripts/blob/master/dirsyncctrl.py

You will have to edit the script to provide your windows sync DN, 
hostname, port, password, and suffix.  Then run it like

python dirsyncctrl.py
>
>>> Thanks,
>>
>
> Thanks a lot,