Error with AD plugin

[radio]

Hi all,

I'm getting the error "Unable to execute 'fetchRelation' for type : ActiveDirectory : java.lang.NullPointerExeption

Played around with different configurations for the plugin without success. Any ideas?

[tschoergez]

Hi!

Have you set the proper AD-Settings in the plugin-configuration in the webbased Orchestrator configuration tool?

(you may copy it from the LDAP-settings, but you have configure it at least once)

In other plugins, you get comparable errors when something is going wrong with the config or the external system (here: The AD-Server) is not reachable from vCO and/or the configured credentials.

Regards,

Joerg

[radio]

The plugin configuration looks ok for me. I copied it from the LDAP config and it has a green status. I also played around with some settings like shared session and the port (ldap / global catalog). Unfortunately it does not change anything. The user also has also full browsing rights. I double checked this with our AD expert here, so I'm pretty sure that the settings are ok.

[tschoergez]

hm, ok.

Than I have two ideas:

1. Can you just try it with an user which has Domain Administrative rights?

2. check in $vco-install-dir/app-server/server/vmo/log the server.log file, if there are some "better" error messages.

Unfortunately, in the plugin-documentation there is not a lot of information about the requirements and troubleshooting 😞

Regards,

Joerg

[tschoergez]

next idea:

just try to start one workflow (e.g. the "Create an OU") to see if it works, maybe we also get some more terse LDAP-error messages then.

Cheers,

joerg

[radio]

Interesting...running that workflow works! It seems that just browsing in the inventory has a problem.

We have a lot of objects in our AD, could that be the cause?

Frank

[tschoergez]

Hi,

depending on your AD-structure: I can imagine that the user does not have proper rights allover the complete structure. And so the inventory-view brakes when it reaches a point of no access....

Also: I don't think the plugin supports trusted domains and forests, if you have some.

For the scalability: can you give a "house number", how many objects you have?

[ppanicherski]

Could you please provide the server log file. I want to investigate this to see if it is a bug or an issue with permissions/rights or a configuration issue

[cdecanini_]

The plug-in is supposed to support forest. This is one of the improvements over the previous Microsoft plug-in.

You should definitely open a support request to VMware Global Support Services to have this troubleshooted & fixed.

Christophe.

[tschoergez]

good to know, thanks for clarification 🙂

[radio]

Thank You all for your great responses...

I've attached the log file (just exchanged the original username with a placeholder). If I should open an official call, please let me know...

For the AD structure, I guess we have at least 200.000 objects, forests, trusts, everything... there are certainly bigger environments, but it has some complexity

But hopefully that's not the cause anyway.

Frank

[ppanicherski]

Hi again,

Thanks for the log file.

I investigated the stack trace and compared it with the source code of the AD plugin. It looks like the  MSPluginFactory of the AD plugin is working with a "DIFFERENT ?!?" version of Container class (I see in stacktrace that methods that do not exist in current version of AD plugin's Container class are called)

Is it possible that You have forgot to uninstall the Microsoft plugin?

Please make sure that you have completely removed the old Microsoft plugin + delete the microsoft DAR file from the plugins folder, and then please restart the VCO.

I'll continue digging into this and I'll keep you posted.

[radio]

Hi!

Wait, uninstall the Microsoft plugin? Did I miss something?

I've got the following plugins in the plugin directory:

o11nplugin-ad.dar

o11nplugin-enums.dar

o11nplugin-jakartacommonsnet.dar

o11nplugin-jdbc.dar

o11nplugin-library.dar

o11nplugin-mail.dar

o11nplugin-ssh.dar

o11nplugin-vmware-update-manager.dar

o11nplugin-vsphere41.dar

o11nplugin-weboperator.dar

o11nplugin-xml.dar

[ppanicherski]

In your case it is obvious you do not have Microsoft plugin...so you are not missing anything.

I'll let you know if I find something that migh help.

[ChrisMueller]

Is there allready a sollution found for this issue.

Currently I have the same problem on a fresh installed vCO. In weboperator browsing is possible. In the GUI inventory I got a error.

In the log there are not really hints. But in my log I nearly see the same errors as ratio. I noticed the following entry:

Plugin config file 'o11nplugin-ad.dar' : SAX parsing exception 'cvc-complex-type.3.2.2: Attribute 'invoker-mode' is not allowed to appear in element 'action'.'

[radio]

Chris, I've still no solution.

Cheers

Frank

[igorstoyanov]

Hi Chirs and Frank,

The issue does seem to be environment related and it took us time to investigate possible root causes. We are preparing a possible fix and will have a patch release soon. I will keep you updated.

Thanks for you feedback.

Regards,

Igor.

[mcssschaefer]

Hi,

today I encountered exactly the same problem. So, when you need log files from an other scenario, don't hesitate to contact me.

@ppanicherski:

Also I am a bit confused about your reply:

ppanicherski schrieb:

Hi again,

Thanks for the log file.

I investigated the stack trace and compared it with the source code of the AD plugin. It looks like the  MSPluginFactory of the AD plugin is working with a "DIFFERENT ?!?" version of Container class (I see in stacktrace that methods that do not exist in current version of AD plugin's Container class are called)

Is it possible that You have forgot to uninstall the Microsoft plugin?

Please make sure that you have completely removed the old Microsoft plugin + delete the microsoft DAR file from the plugins folder, and then please restart the VCO.

I'll continue digging into this and I'll keep you posted.

Does the Active Directory Plugin only work when the Microsoft plugin isn't installed? Does the new plugin have also exact the same functionality, so I can remove the old plugin without breaking any workflows that may use it? If so, it would be great if there's a hint in the next version of the documentation.

[ppanicherski]

Yes, old Microsoft plugin shouldn't be installed in order AD plugin to work.

[mcssschaefer]

ppanicherski schrieb:

Yes, old Microsoft plugin shouldn't be installed in order AD plugin to work.

Okay, thanks. Shoudl be mentinoed in the next version of the user guide.

Does the new plugin have also exact the same functionality, so I can  remove the old plugin without breaking any workflows that may use the functionality of the old plugin?