Messages

Messages are printed to the info and debug files. Messages which cause an abort may have additional information in the debug file.

Error: ActiveDirectory AddUserToGroup cannot find <group> in <server>

A Dynamic Group specified in the Identity Source cannot be found in the ActiveDirectory. Either it is miss-spelt or needs to be created.

Error: Active Directory Exception of type 'AMX.Library+CustomException' was thrown.

The identity schema does not define <column > either distinguishedName, CN or both.

Error: ActiveDirectory Extract A referral was returned from the server.

for LDAP:// dc1.example.com/DC=corpz,DC=example,DC=com

The AccountContainer was not recognised, the server does not manage this domain.

Error: ActiveDirectory ExtractAttribute for <attribute> Could not find a part of the path <path>

Images are written to subdirectories with the name of the attribute, eg thumbNailPhoto or jpegPhoto. The subdirectory must be manually created.

Error: ActiveDirectory ExtractAttribute for thumbnailPhoto Could not find a part of the path <path>

Check the directories in <path> and manually create any missing ones.

Error: ActiveDirectory ExtractMembers circular recursion of <group1> in <group2>

The memberNested Staging Attribute ExtractMembers has found group1 is a member of group2 and group2 is already a member of group1.

Error: ActiveDirectory LoadAttribute MoveToNewParent failed Unknown error (0x80005000)

See more details in the debug file, this will show the parent. This can be caused by a blank distinguishedName in the identity source, distinguished

name must be created in the Identity source. For example use:

,distinguishedName;concat:%CN%,ou=accounts,dc=corp,dc=example,dc=com

Error: ActiveDirectory Load Create Access is denied.

The account defined in the property ActiveDirectoryUser in identitySync.properties does not have administrative privileges in the domain.

Error: ActiveDirectory Load Create DN <DN> and CN <CN> cannot both be defined.

The metaverse contains both Distinguished Name <X> and Canonical Name <Y>, only one or the other is allowed.

Error: ActiveDirectory Load Create DN <DN> is not unique

The Distinguished Name <DN> found in the identity source and the SAMaccountName generated from the Template both must be unique. See the

Action file for the SAMaccount name and use the “unique” attribute modifier in the schema.

Error: ActiveDirectory Load Create The directory service cannot perform the requested operation on the RDN attribute of an object.

The account already exists in the Active Directory, perhaps in an unmanaged part of the OU structure, that is not extracted by identitySync.

Error: ActiveDirectory Load <name> Create Exception An invalid DN syntax has been specified.

See more details in the debug file. The DN is invalid, possible caused by a missing escape character “\” for a “,” in the CN

Error: ActiveDirectory Load <name> Create Exception The object already exists.

This can be caused by the extract not reading all the accounts in the Domain. The root of the search is defined by the property AccountContainer

and reported in the debug file as:

ActiveDirectory Extract root " + <path>

It can be a duplicate of something other than the DN such as the accountName. The DN is reported in the info file, use the ActionFile to identify the

accountName and try to find it in the ActiveDirectory using the MMC Users and Computers. Check that the unique attribute modifier is in place for

the attribute and that its container is in scope as above.

Error: ActiveDirectory Load Delete There is no such object on the server. For LDAP://<server>/<dn>

System.DirectoryServices.DirectoryServicesCOMException (0x80072030): There is no such object on the server.

See more details in the debug file. The OU defined in the identitySync property ActiveDirectoryDeletedContainer does not exist in the Active

Directory.

Error: ActiveDirectory Load <domain> Update of <name> Failed: A constraint violation occurred. For <DN>

Trying to update an Active Directory attribute that does not exist.

Error: ActiveDirectory Load <name> Create Exception There is no such object on the server

See more details in the debug file, this will show the distinguishedName of the object, this may specify an OU that doesn’t exist. If updating a

manager, the individual’s record does not exist.

Error: ActiveDirectory Load <name> Create Exception The server is unwilling to process the request.

Issue with the DN such as domain is not part of the Active Directory, debug file contains details. Can be caused by an error in the schema such as

the DN being used as a transform and not having the nosync attribute modifier.

Error: ActiveDirectory Load <domain> Update <action> suppressed ambiguous user <user> update suppressed <attributes => values>

Active Directory search for <user> found more than one object. None of them were updated. See debug file (debug > 1) for details of the search

pattern and the reason for the ambiguity.

Error: ActiveDirectory Load Update of <account> Failed: Access is denied.

The account defined in the property ActiveDirectoryUser in identitySync.properties does not have the privileges to update the ActiveDirectory. An

update of X was not processed.

Error: AMXlib CheckColumn properties file contains <Metaverse Attribute name> and Schema <Schemafile> does not

The identityAttributes in the properties file must match the Metaverse Attributes in the Schema file, schema including the case.

If the Logging Level property is >=2 the Metaverse Attributes found in the first Schema file are written to the debug file.

Error: AMXlib CheckUnique failed Object reference not set to an instance of an object.

CheckUnique has failed, the Metaverse attribute is identified in the debug file.

Error: AMXlib Concats Column <attribute1> does not belong to table for attribute <attribute2> %<attribute1>%

Concat refers to attribute1 that is not in the Metaverse when transforming attribute2

Error: AMXProperties GetPasswd password file <password file> is locked to a properties file

The password file has a properties file lock but the properties file does not have a Lock = true property.

Error: AMXProperties GetPasswd properties file has been tampered with. It does not match <password file>

Reset the password in the first line of password file.

Error: AMXProperties GetPasswd failed on <passwordFile> Invalid length for a Base-64 char array.

Incorrect format of the password file. Clear Text password in the first line, replaced by AMXlib by blank line and encrypted password in the second.

Error: CreateMessage Attribute <attribute> not found in Action Line <action line>

Attribute name in the message template must match case in the action line. The <action Line shows all the attributes and their values. The

attributes are defined in the CreateAccountMessageTemplate and CreateAccountMessageSubject as defined in the properties.

Error: CSV Extract. Attribute name <attribute> not in header of <file>

File does not contain CSV header with column names. Case sensitive.

More information in debug file, check debug file (Debug level >= 2) CSV Extract using delim= number columns found = 1. This indicates a bad

delimiter in the properties file.

Error: CSV Extract Read of <file> init The process cannot access the file <file>' because it is being used by another process.

File <file> is open in another application, probably Excel.

Error: CSV Extract Read of <file> init Index was outside the bounds of the array.

Bad delim in properties file

Error: CSV SplitLine zero length delim

Bad delim in properties file

Error: Database Extract ORA-00903: invalid table name

DatabaseIdentitySelectFrom property syntax error, found a reserved keyword where a table or view was expected. Reserved word such as from,

join, select, etc. The property is appended to Select * from, so a property beginning with “from” would cause this error. Check the debug file for

Database Extract from Container: to see the SQL select statement that was used.

Error: Database Extract ORA-00904: <attribute>: invalid identifier

The Staging Attribute defined in the AMX Schema file does not exist in the Database Table referenced in the DatabaseIdentitySelectFrom property.

Error: Database Extract ORA-00905: missing keyword

Expected a keyword such as from, join. Check typos such as joim.

Error: Database Extract ORA-00942: table or view does not exist

The user’s default session does not include the tables defined in the DatabaseIdentitySelectFrom property. Use dbVisualizer or similar to

investigate, login as the user defined in the property DatabaseIdentityUser and try to open the table. If not grant the user access or use another

account.

The Database Table or View defined in the DatabaseIdentitySelectFrom property does not exist.

Error: Database Extract ORA-01045: user <user> lacks CREATE SESSION privilege; logon denied

Users need at least Grant Create Session to <user> to logon.

Error: Database Extract ORA-12170: TNS:Connect timeout occurred

Cannot connect to host, check hostname.

Error: Database Extract ORA-12514: TNS:listener does not currently know of service requested in connect descriptor

Can be caused by an incorrect or undefined SID in DatabaseResource or DatabaseIdentityResource

Error: Database Extract ORA-12541: TNS:no listener

Can be caused by an incorrect port.

Error: Database Extract ORA-12545: Connect failed because target host or object does not exist

Can be caused by a port number with a non-numeric character

Error: Database Extract ORA-12546: TNS: permission denied

Admin account defined in property DatabaseIdentityUser has not been granted permission to access the table or view.

Error: Database Extract ORA-12569: TNS:packet checksum failure

Can be caused when the port is active but not an Oracle listener. Usually port 1521.

Error: Database Unknown column <staging attribute name> in 'field list'

Can be caused by the Database property SelectFrom either not being set, referencing the wrong table, or not joining additional tables. Check debug

file for database select statement and test it in dbVisualizer or similar.

Error: Excel Extract Exception Invalid index. (Exception from HRESULT: 0x8002000B (DISP_E_BADINDEX)) 0

ExcelWorksheet property defines a non-existent worksheet

Error: Excel Extract Integer Property Value <value> Exception. Input string was not in a correct format. 0

ExcelWorkSheet property must be integer.

Error: Exchange Extract Exception Connecting to remote server failed with the following error message: The server certificate on the destination computer

<Exchange Server> has the following errors:

The SSL certificate is signed by an unknown certificate authority.

In IIS Manager, locate the certificate in the servers certificates store, open it and in the Details tab, save it. This cannot be done in the Exchange

Management Server. Copy the saved certificate to the system running AMX and install it in the Local Machine’s trusted root certification authority.

Error: Exchange Extract Exception Connecting to remote server failed with the following error message: The WinRM client cannot process the request. The

authentication mechanism requested by the client is not supported by the server or unencrypted traffic is disabled in the service configuration. Verify the

unencrypted

Check the configuration of the winrm process, using winrm get winrm/config. Check negotiate is true. In ISS manager check the authentication of

the vSite Powershell. Basic and Windows Authentication must be enabled.

Error: Exchange Extract Exception Connecting to remote server failed with the following error message: The SSL connection cannot be established. Verify

that the service on the remote host is properly configured to listen for HTTPS requests.

Assuming Certificates are installed properly and port 443 is listening. Use netstat -a. The problem is likely to be a corrupted Exchange installation:

 In IIS Manager select PowerShell and use the action browse :443. A working system will display a blank page. Connection error represents

an error similar to AMX and confirms that the Echange installation is corrupted.

 Install another instance of Exchange.

 Move mailboxes, including arbitration mailboxes to new server.

 Use the new installation and uninstall original instance of Exchange.

Error: Exchange Extract Exception Processing data from remote server failed with the following error message:

<f:WSManFault xmlns:f="http://schemas.microsoft.com/wbem/wsman/1/wsmanfault" Code="2152992672" Machine="AMX2.corp.example.com">

<f:Message><f:ProviderFault provider="PowerShellplugin" path="%windir%\system32\pwrshplugin.dll"></f:ProviderFault></f:Message>

</f:WSManFault> For more information, see the about_Remote_Troubleshooting Help topic.

Check Event log on Exchange Server:

 RBAC authorization returns Access Denied for user. Add administrator account to Exchange Group “Organization Management”

Error: Homeshare Load <Staging Attribute> Not updateable.

The staging attribute in the schema is not updateable, only Caption can be updated. If this operation is being performed by the Remote adapter the

attribute may have been renamed in the local schema. This inevitably causes problems.

Error: HomeShare ExtractAttribute Not found for <AttributeName>

The Staging attribute <name> not found in the Win32_Share object. See https://msdn.microsoft.com/en-us/library/aa394435%28v=vs.85%29.aspx

Error: HomeShare SetDirPerms for <account> Invalid parameter

The account is not found in the ActiveDirectory.

Error: HomeShare WMIConnect to <resource> failed The RPC server is unavailable. (Exception from HRESULT: 0x800706BA)

The server <resource> does not exist or cannot be contacted. Server is defined in HomeShareResource property. Check DNS resolution for the

server.

Error: identityServer Method not found: '!!0[] System.Array.Empty()'. Inconsistent .NET Frameworks. System running identityServer will need upgrading.

Error: JSON Extract Authentication Data malformed <string>

The property JSONAuthenticationData may have quoted strings these must be comma separated – no spaces.

Error: JSON Extract webclient The underlying connection was closed: An unexpected error occurred on a send.

Diagnose with curl, the reporting is more complete.

Error: LDAP Extract Create Connection The LDAP server is unavailable. For <host>:<port>

This can be caused by many issues, such as unresolvable hostname, firewalls, incorrect port etc. Troubleshoot using an LDAP client such as Apache

LDAP Studio http://directory.apache.org/studio/ this will give better diagnostics concerning certificates and protocols.

Try using ldap:// on port 389 for attribute LdapServer1. This is not always available, but if this works:

 The server’s certificate may not be trusted by the system running identitySync. Try running with the ldap property CertificateTrust = Yes. If this

resolves the problem it is a certificate issue, try:

o Export the certificate from Apache Directory Studio and install the certificate in the Trusted Root CA store.

o Hostname must match the certificate and be resolvable with dns. Use nslookup to check.

Error: LDAP Extract. The object does not exist. For <adapterInstance>

Can be caused by a bad AccountContainer property value referring to a non-existent container.

Error: LDAP Extract. The server does not support the control. The control is critical. For <adapterInstance>

The AdapterInsatance does not support PagedRead. Set the PageSize property to 0.

Error: LDAP Load Exception The object does not exist.

Can be caused by a bad DeletedContainer property value referring to a non-existent container

Error: LDAP Load Create Exception The server cannot handle directory requests.

Can be caused by:

 Referencing a DN with the wrong DC.

 When modifying a DN with a move or delete, the server is configured to refuse to move entries. Default with Sun Directory Server, use

Oracle Service Control Centre to enable it.

Error: LDAP Load Create Exception The syntax is invalid.

Can be caused by an invalid objectClass defined in the property ObjectClasses

Error: LDAP LoadDNAttribute ModifyDNRequest failed. The object does not exist.

Can be a problem with OpenLDAP that can have multiple CN attributes. This will be extracted as a list. Check the Action file, locate the record for

the object being updated, if in the form of a list such as CN=Bill:William the current version of AMX cannot update the CN. This is a known issue.

Error: Transforms Lookup attribute transform syntax error strToken lookup=filename is xxx

The transform lookup token is malformed, it must have an = sign.

Error: Message SendMess Failed to send message to <email address>

The remote certificate is invalid according to the validation procedure.

The SMTP mail server certificate is invalid or SSL is not supported.

 Add the Exchange certificate so that the computer’s Trusted Root container so that certificate is trusted by the system running AMX. See

identitySync documentation.

 try property SMTPssl = false

Error: Message SendMess Failed to send message to <email address>

The SMTP server requires a secure connection or the client was not authenticated. The server response was: Authentication Required (VM401)

Use SMTPaccount and SMTPpasswd to authenticate with the mail server. Or SMTPssl = true is required. Or using the administrator account.

Error: Message CreateMessage unbalanced % characters in Template

The debug file will contain the offending line from the template when logging level >=2

Error: Database Extract Attempt to load Oracle client libraries threw BadImageFormatException. This problem will occur when running in 64 bit mode with

the 32 bit Oracle client components installed.

Error: Database Extract System.Data.OracleClient requires Oracle client software version 8.1.7 or greater.

Error: Homeshare Create undo cannot delete directory c:\<dir> Created <createdOn> Dates mismatch <today>

Create undo deletes the directory. This is a sanity check, the undo is more than a day later than the create. The delete is inhibited for safety

reasons.

Error: Remote Extract No connection could be made because the target machine actively refused it <ip>

identityServer is not running on the remote system <ip>

Error: Schema ReadSchema File <filename> attribute <attribute> has a bad modifier <attribute modifier>

Error: Schema ReadSchema File <filename> has no “active” metaName and LoadMode = D

The LoadMode is defined in the properties file as “Disable” and/or ”Delete” and this requires the “active” attribute to be synchronised.

Error: Schema ReadSchema File <filename> Metaindex attribute <attribute> already defined

The schema cannot define more than one MetaAttribute with the same name.

Error: Schema ReadSchema join modifier already defined <attribute1> and <attribute2>

Both attribute1 and attribute2 have join modifier flag. There can only be one join attribute.

Error: Schema ReadSchema malformed line <Line>

<Line> may not be of the form <Staging Attribute>,[<Metaverse Attribute>][;Metaverse Attribute Modifier]

Error: Server Extract A connection attempt failed because the connected party did not properly respond after a period of time, or established connection

failed because connected host has failed to respond <ip address>:<port>

identityServer not running

Firewall blocked connection. Check Firewall logs.

Error: Sforce Extract Sforce Login Exception LOGIN_MUST_USE_SECURITY_TOKEN:

Invalid username, password, security token; or user locked out. Are you at a new location? When accessing Salesforce--either via a desktop client or

the API--from outside of your company's trusted networks, you must add a security token to your password to log in. To receive a new security

token, log in to salesforce.com at http://login.salesforce.com and click Setup | My Personal Information | Reset Security Token.

Error: Transaction CheckAccounts <name> argument cannot be null.

Metaverse Attribute “resource” is not defined in the Schema.

Error: Transaction Deferred corrupt ActionFile does not contain <delim1>

Existing ActionFile.txt has a different <delim1> to the one defined in identitySync properties. Delete it.

Error: Transaction Deferred <ActionFile> has bad line

Existing ActionFile cannot be parsed may be blank, corrupt format, or wrong number of delims

Error: Transaction GetActions check <actionFile> has blank line or bad delim

The records in the Action file are inconsistent with delim1 defined in the properties. This is usually caused by the delims are being changed from a

simple “|” to a more complex one. The Action file must be deleted, the tamper process will reject an Action file that has been edited.

Error: Transforms MakeUniqueAccountName Metaverse does not contain <attribute>

The AccountNametemplate in the properties file refers to an attribute that is not defined in the schema.

Error: Transforms MakeUniqueName number of values <items in template> must equal number of format descriptions <items in format>

The properties AccountNameTemplate and AccountNameFormat have different number of items, they must match. This includes the descriminator

and constants. For example:

AccountNameTemplate = %lastName%%firstName%%*% AccountNameFormat = 7.7,1.1,0.2

AccountNameTemplate = "E%employeeID%-%lastName% AccountNameFormat = 1,6.6,1,6.6

AccountNameTemplate = "E%employeeID%-%lastName% AccountNameFormat = ,6.6,,6.6

Error: Transforms MakeUniqueAccountName Template is null

identitySync property AccountNameTemplate is not defined for this adapter

Error: Transforms Copy join attribute flag is null

The Resource schema has not defined the join attribute flag

Error: Transforms Copy Target table does not contain join key <key>

Check that the ID table has been successfully loaded

Error: Transforms UpdateIsaManager IsaManager attribute flag defined managerJoin null

When the IsaManager attribute flag is defined the managerJoin attribute flag must be defined also.

Error: Transforms UpdateManager ID schema does not contain ManagerMail mail

When the managerID attribute flag is defined the mail attribute must be defined in the Identity schema. It will be used during account create.

Error: Transforms UpdateManager Manager of <DisplayName> with name <ManagerID> not found in attribute <attribute>

The record of ManagerID cannot be found in the Identity table in the column <attribute>. When many of these errors are reported the search may

be looking in the wrong column. The column is defined by the ManagerJoin attribute flag.

Error: Unix Extract Auth fail

Bad username or password

Error: Unix Extract cannot find Linux Header of lastlogon

Error typically caused by running against a non Linux Unix system, for example SunOS

Error: Unix Extract ssh connection to < strServer> failed.

Connection was OK but ssh is aborting. Check with ssh client.

Error: Unix Load 5 UX: useradd: ERROR: Inconsistent password files.

/etc/shadow has entries that are not in /etc/passwd usually during a create.

Error: Unix Load 12 UX: useradd: ERROR: Unable to create the home directory: Operation not applicable.

Useradd default basedir inappropriate, reset it:

bash-3.00# useradd -D -b /export/home

group=other,1 project=default,3 basedir=/export/home

skel=/etc/skel shell=/bin/sh inactive=0

expire= auths= profiles= roles= limitpriv=

defaultpriv= lock_after_retries=

bash-3.00# useradd -D

group=other,1 project=default,3 basedir=/export/home

skel=/etc/skel shell=/bin/sh inactive=0

expire= auths= profiles= roles= limitpriv=

defaultpriv= lock_after_retries=

bash-3.00#

Error: Unix Load usermod: invalid user ID <accountName>

UID is blank or duplicate

Error: WinLocal Extract Unknown error (0x80005004) for <system>

This can be caused by a number of issues on the target system such as Windows Firewall is blocking File and Print Sharing

Error: WinLocal Extract Group for <Group Path> Unknown error (0x80005004)

A local account is attempting to extract group membership of a privileged group <group path> of a domain member system. Use a domain account

that is a member of the local administrators account.

Note that if an existing connection exists on the server that connection credentials will be used and can cause this error even when a domain

account is specified in the properties.

Error: WinLocal LoadAttribute MemberAdd/Del <group> Message: Exception has been thrown by the target of an invocation.

This can also be caused by a number of issues on the target system:

1. Missing Privileges, trying to use a non privileged account to add a member to an administrative group.

2. Adding an account to a group with the wrong case. For example trying to add an account to “users”, should be “Users” as defined in the Identity

resource.

3. Adding an account that is already a member of the group, perhaps by running identitySync redo after a do.

4. Adding an account to a non-existant group

5. The property WinLocalName is not defined or the NetBIOS name of the instance.

6. Undoing a memberAdd/Del of an account that has also had its name changed in the same Transaction. Repeat the operation after the name

change has been undone.

Error: WinLocal RemoteService Access is denied.

Username or password incorrect. Domain Usernames should be in the format Domain\Username, when Domain is omitted a local account is used..

Error: WinLocal RemoteService The RPC server is unavailable. (Exception from HRESULT: 0x800706BA) for AMX3.corp.example.com

Windows Firewall blocking Windows Management Instrumentation (WMI). Cannot start the remote registry service on the target instance.

Error: WinLocal.RemoteService User credentials cannot be used for local connections for <name>

Blank WindowsLocalUser when extracting accounts from the system that is also running AMX