0

I am using WSO2 identity server 5.7.0 with embedded LDAP as the user store. On creating new role from the WSO2 IS management console as well as from the scim2/group API I get the following error when I try to create a new role`. Any help in resolving this would be highly appreciated.

TID: [-1234] [] [2019-11-29 14:24:27,938] ERROR {org.wso2.carbon.identity.account.suspension.notification.task.handler.AccountSuspensionNotificationHandler} -  Error occurred while updating last login claim for user:  
org.wso2.carbon.user.core.UserStoreException: Profile information could not be updated in LDAP user store for user : admin
    at org.wso2.carbon.user.core.ldap.ReadWriteLDAPUserStoreManager.handleException(ReadWriteLDAPUserStoreManager.java:2132)
    at org.wso2.carbon.user.core.ldap.ReadWriteLDAPUserStoreManager.doSetUserClaimValues(ReadWriteLDAPUserStoreManager.java:945)
    at org.wso2.carbon.user.core.common.AbstractUserStoreManager.setUserClaimValues(AbstractUserStoreManager.java:2440)
    at org.wso2.carbon.identity.account.suspension.notification.task.handler.AccountSuspensionNotificationHandler.handleEvent(AccountSuspensionNotificationHandler.java:72)
    at org.wso2.carbon.identity.event.services.IdentityEventServiceImpl.handleEvent(IdentityEventServiceImpl.java:56)
    at org.wso2.carbon.identity.governance.listener.IdentityMgtEventListener.handleEvent(IdentityMgtEventListener.java:604)
    at org.wso2.carbon.identity.governance.listener.IdentityMgtEventListener.handleEvent(IdentityMgtEventListener.java:572)
    at org.wso2.carbon.identity.governance.listener.IdentityMgtEventListener.doPostAuthenticate(IdentityMgtEventListener.java:119)
    at org.wso2.carbon.user.core.common.AbstractUserStoreManager.authenticateInternal(AbstractUserStoreManager.java:704)
    at org.wso2.carbon.user.core.common.AbstractUserStoreManager.access$100(AbstractUserStoreManager.java:85)
    at org.wso2.carbon.user.core.common.AbstractUserStoreManager$4.run(AbstractUserStoreManager.java:532)
    at org.wso2.carbon.user.core.common.AbstractUserStoreManager$4.run(AbstractUserStoreManager.java:529)
    at java.security.AccessController.doPrivileged(Native Method)
    at org.wso2.carbon.user.core.common.AbstractUserStoreManager.authenticate(AbstractUserStoreManager.java:529)
    at org.wso2.carbon.user.core.common.AbstractUserStoreManager$3.run(AbstractUserStoreManager.java:512)
    at org.wso2.carbon.user.core.common.AbstractUserStoreManager$3.run(AbstractUserStoreManager.java:504)
    at java.security.AccessController.doPrivileged(Native Method)
    at org.wso2.carbon.user.core.common.AbstractUserStoreManager.authenticate(AbstractUserStoreManager.java:504)
    at org.wso2.carbon.identity.auth.service.handler.impl.BasicAuthenticationHandler.doAuthenticate(BasicAuthenticationHandler.java:126)
    at org.wso2.carbon.identity.auth.service.handler.AuthenticationHandler.authenticate(AuthenticationHandler.java:60)
    at org.wso2.carbon.identity.auth.service.AuthenticationManager.authenticate(AuthenticationManager.java:106)
    at org.wso2.carbon.identity.auth.valve.AuthenticationValve.invoke(AuthenticationValve.java:78)
    at org.wso2.carbon.ui.valve.XSSValve.invoke(XSSValve.java:94)
    at org.wso2.carbon.tomcat.ext.valves.CompositeValve.continueInvocation(CompositeValve.java:99)
    at org.wso2.carbon.tomcat.ext.valves.CarbonTomcatValve$1.invoke(CarbonTomcatValve.java:47)
    at org.wso2.carbon.webapp.mgt.TenantLazyLoaderValve.invoke(TenantLazyLoaderValve.java:57)
    at org.wso2.carbon.tomcat.ext.valves.TomcatValveContainer.invokeValves(TomcatValveContainer.java:47)
    at org.wso2.carbon.tomcat.ext.valves.CompositeValve.invoke(CompositeValve.java:62)
    at org.wso2.carbon.tomcat.ext.valves.CarbonStuckThreadDetectionValve.invoke(CarbonStuckThreadDetectionValve.java:159)
    at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:962)
    at org.wso2.carbon.tomcat.ext.valves.CarbonContextCreatorValve.invoke(CarbonContextCreatorValve.java:57)
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116)
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:445)
    at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1115)
    at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:637)
    at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1775)
    at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1734)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
    at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
    at java.lang.Thread.run(Thread.java:748)
Caused by: javax.naming.NamingException: [LDAP: error code 80 - OTHER: failed for     Modify Request
        Object : 'mail=admin,ou=Users,dc=wso2,dc=org'
            Modification[0]
                Operation :  replace
                Modification
    lastLoginTime: 1575037467638
            Modification[1]
                Operation :  replace
                Modification
    lastModifiedDate: 2019-11-29T14:24:27Z
: ERR_333 Unexpected exception.]; remaining name 'mail=admin'
    at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3198)
    at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:3100)
    at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2891)
    at com.sun.jndi.ldap.LdapCtx.c_modifyAttributes(LdapCtx.java:1408)
    at com.sun.jndi.toolkit.ctx.ComponentDirContext.p_modifyAttributes(ComponentDirContext.java:257)
    at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.modifyAttributes(PartialCompositeDirContext.java:167)
    at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.modifyAttributes(PartialCompositeDirContext.java:156)
    at org.wso2.carbon.user.core.ldap.ReadWriteLDAPUserStoreManager.doSetUserClaimValues(ReadWriteLDAPUserStoreManager.java:941)
    ... 39 more

On the other,I am successfully able to create a new role under the Internal domain.

4
  • Did you change any default userstore configs in user-mgt.xml?
    – Bee
    Dec 2, 2019 at 4:08
  • No changes done in the user-mgmt.xml. I cross-verified with another file running on another successful setup. Dec 2, 2019 at 9:51
  • Did you change/ add local claim configuration?
    – senthalan
    Dec 2, 2019 at 14:15
  • @senthalan we did not change local claim configuration but we performed an activity to remove a role attached to some users using scim2/groups api. Dec 3, 2019 at 8:51

1 Answer 1

0

The reason for this behaviour could be, the attribute mapped with the claim 'http://wso2.org/claims/lastLoginTime' is not supported by the configured user store.

To solve this is, follow the below steps

  1. Log in to the management console
  2. Click on 'List' under claims
  3. Click on the local claim dialect 'http://wso2.org/claims'
  4. Locate the claim 'Last Login'
  5. Check whether the mapped attribute is supported by your LDAP user store
  6. If not click on 'Edit' to change the attribute
  7. Change the attribute which is supported by your LDAP user store (Make sure that attribute is not used by any other claim) and update the claim.

Check out the documentation on Editing Claim Mapping for more details.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.