Solutions

The operation attempted to assign a zero-length value to an attribute with the directory string syntax error in IDM/OpenIDM (All versions)

Last updated Jul 9, 2018

The purpose of this article is to provide assistance if you receive a "The operation attempted to assign a zero-length value to an attribute with the directory string syntax" error in IDM/OpenIDM when syncing data to DS/OpenDJ. This error is Caused by: "javax.naming.directory.InvalidAttributeValueException: [LDAP: error code 21" and causes the synchronization to fail.


Symptoms

Errors similar to the following are shown when the data synchronization to DS/OpenDJ fails, where the attribute causing issues in this example is called Team:

Caused by: org.identityconnectors.framework.common.exceptions.ConnectorException: javax.naming.directory.InvalidAttributeValueException: [LDAP: error code 21 - Entry "employeeId=user10,ou=Users,dc=example,dc=com" contains a value "" for attribute Team that is invalid according to the syntax for that attribute: The operation attempted to assign a zero-length value to an attribute with the directory string syntax]; remaining name 'employeeId=user10,ou=Users,dc=example,dc=com'
Caused by: javax.naming.directory.InvalidAttributeValueException: [LDAP: error code 21 - When attempting to modify entry cn=John,ou=People,dc=example,dc=com to replace the set of values for attribute Team, value "" was found to be invalid according to the associated syntax: The operation attempted to assign a zero-length value to an attribute with the directory string syntax]; remaining name 'cn=John,ou=People,dc=example,dc=com'

This error is not seen if the attribute has a value in IDM/OpenIDM; it only happens if the attribute has an empty value. 

Recent Changes

Configured the LDAP connector to synchronize data to DS/OpenDJ.

Updated the mapping configuration file (sync.json, located in the /path/to/idm/conf directory).

Causes

By default, DS/OpenDJ does not allow empty string values (zero-length-values) for attributes that have a syntax of Directory String. 

The LDAP result code: 21 is caused by invalid attribute syntax. This error is received when the requested operation failed because it violated the syntax for a specified attribute.

Per RFC 4517 - A zero-length character string is not permitted.

Note

Although it is possible to change the schema for the affected attribute to allow zero-length-values, this is not recommended.  You may face issues at any time with other ldap applications that are adhering to the spec.

Solution

You can resolve this issue by adding a transform script to the sync.json file for all attributes that have a syntax of Directory String. For example, the following simple transform script checks if the source property has an empty string value, and if so, sets the target property value to null. If the value is not empty, then the target property value is updated to match the source property value:

{
      "source" : "Team",
      "target" : "Team",
                    "transform" : {
                        "type" : "text/javascript",
                        "source" : "if(source.TEAM === ""){value = null} else{value = source.TEAM}"
},

This transform script has been included in the sync.json file; alternatively, you could include this transform script in a separate file and call the file from sync.json instead, for example:

{
      "source" : "Team",
      "target" : "Team",
                    "transform" : {
                        "type" : "text/javascript",
                        "file" : "script/DirectoryStringTransform.js"
},

See Also

How do I update attributes stored in arrays in IDM/OpenIDM (All versions) using JavaScript?

How do I provision external accounts in a pre-defined order in IDM/OpenIDM (All versions)?

Integrator's Guide › Synchronizing Data Between Resources › Transforming Attributes in a Mapping

Integrator's Guide › Synchronizing Data Between Resources › Configuring Synchronization Between Two Resources

DS 5 › Developer's Guide › Respecting LDAP Schema › Example 5.5. Invalid Attribute Syntax

RFC 4517 > LDAP: Syntaxes and Matching Rules > 3.3.6 > Directory String

Related Training

N/A

Related Issue Tracker IDs

N/A



Copyright and TrademarksCopyright © 2018 ForgeRock, all rights reserved.

Recommended Books

Loading...