Medium Steps to reproduce:
- Create a LDAP directory with read and write permission
- Turn on manage user Locally option
- Deactivate any user from the directory
Expected Result
The user has been deactivated without error, and the change is not propagated to the backing directory. See https://confluence.atlassian.com/display/CROWD/Deleting+or+Deactivating+a+User.
End result:
Error message :
org.springframework.ldap.NoPermissionException: [LDAP: error code 50 - 00002098: SecErr: DSID-03150BB9, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0]; nested exception is javax.naming.NoPermissionException: [LDAP: error code 50 - 00002098: SecErr: DSID-03150BB9, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0]; remaining name 'SOME USER DN'
Cause:
I suspect this issue was caused by the Configured Bind DN user have insufficient permission to write on AD, as when you click on update, it will prompt to check user's detail as below:
Managing user locally should not update anything to the LDAP/AD
![[Extranet] Page](/images/icons/generic_link_16.png "[Extranet] Page"){kind=icon}
[CWD-4311] Unable to manage user status locally LDAP: error code 50 - 00002098
Hi,
This error is very disabling if company policy does not allow for changes in the directory.
Can you plan this issue for the next release please.
Yes, I believe the problem here is that Crowd attempts to set all fields, rather than just storing the status locally. Examining the rest of the exception would confirm that, and show specifically what's failing to be set.
Although I appreciate that this is a major problem in this deployment, I've reduced the priority from 'critical' as this isn't a regression or production issue for an existing installation.
If the user Bind DN have not write permission, user's statuses cannot be edited.
If I edit the user, an error occurs:
Whereas no action should be made on to the remote directory.
As workaround it's possible to manage the user's statuses locally by direct update the database.
Modifications are kept and immediately diffused to all clients connected to Crowd.
NB: Only the column 'active' has been tested with Crowd 2.7.2