Configure WSO2 Identity Server with Active Directory? - wso2

Question

I am trying to stand up WSO2 Identity Server 5.0.0 with Active Directory as the primary user store. I have connectivity, LDAPS, working database, etc. and can login to the admin console as the admin user I have chosen, and can successfully search for AD users and see roles.
However, if I try to show the details of a user, or change their password, I receive errors. For example, when attempting to change password, I see in the logs:
TID: [0] [IS] [2016-04-15 16:14:15,135] ERROR
{org.wso2.carbon.user.mgt.ui.UserAdminClient} - User testuser does
not exisit in the user store
{org.wso2.carbon.user.mgt.ui.UserAdminClient}
org.wso2.carbon.user.mgt.stub.UserAdminUserAdminException:
UserAdminUserAdminException
but I have looked up this user and clicked the "change password" link in the resulting display, so it was able to at least find that user in the search.
I suspect that the AD roles of the user that I have configured for the LDAP connection are not sufficient to perform these tasks, but am unsure. Am I on the right trail, and if so, what are the requirements for this user? Or, is there something else to troubleshoot related to these errors?
UPDATE 4/18/2016:
OK when I added the debug suggested in an answer (log4j.logger.org.wso2.carbon.user.core=DEBUG), I noticed that the tool was searching for the user by CN and not finding it:
TID: [0] [IS] [2016-04-18 10:19:42,394] DEBUG {org.wso2.carbon.identity.mgt.IdentityMgtEventListener} - Pre update credential by admin is called in IdentityMgtEventListener {org.wso2.carbon.identity.mgt.IdentityMgtEventListener}
TID: [0] [IS] [2016-04-18 10:19:42,394] DEBUG {org.wso2.carbon.identity.mgt.IdentityMgtEventListener} - Updating credentials of user astudent16 by admin with a non-empty password {org.wso2.carbon.identity.mgt.IdentityMgtEventListener}
TID: [0] [IS] [2016-04-18 10:19:42,394] DEBUG {org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager} - Searching for user astudent16 {org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager}
TID: [0] [IS] [2016-04-18 10:19:42,409] DEBUG {org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager} - Searching for user with SearchFilter: (&(objectClass=user)(cn=astudent16)) in SearchBase: {org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager}
TID: [0] [IS] [2016-04-18 10:19:42,472] DEBUG {org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager} - Name in space for astudent16 is null {org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager}
TID: [0] [IS] [2016-04-18 10:19:42,472] DEBUG {org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager} - User: astudent16 exist: false {org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager}
TID: [0] [IS] [2016-04-18 10:19:42,487] ERROR {org.wso2.carbon.user.mgt.ui.UserAdminClient} - User astudent16 does not exisit in the user store {org.wso2.carbon.user.mgt.ui.UserAdminClient}
org.wso2.carbon.user.mgt.stub.UserAdminUserAdminException: UserAdminUserAdminException
I referred back to documentation, and the vendor documentation suggests that for Active Directory, the UserNameAttribute in user-mgt.xml be set to CN - we had this set to sAMAccountName.
So, we changed to CN, and now the error is different:
TID: [0] [IS] [2016-04-18 10:30:46,338] DEBUG {org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager} - Searching for user A Student16 {org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager}
TID: [0] [IS] [2016-04-18 10:30:46,354] DEBUG {org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager} - Searching for user with SearchFilter: (&(objectClass=user)(cn=A Student16)) in SearchBase: {org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager}
TID: [0] [IS] [2016-04-18 10:30:46,354] DEBUG {org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager} - Name in space for A Student16 is CN=A Student16,OU=2016,OU=Students,OU=Accounts,DC=some,DC=org {org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager}
TID: [0] [IS] [2016-04-18 10:30:46,354] DEBUG {org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager} - User: A Student16 exist: true {org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager}
TID: [0] [IS] [2016-04-18 10:30:46,463] DEBUG {org.wso2.carbon.user.core.ldap.ActiveDirectoryUserStoreManager} - value after escaping special characters in A Student16 : A Student16 {org.wso2.carbon.user.core.ldap.ActiveDirectoryUserStoreManager}
TID: [0] [IS] [2016-04-18 10:30:46,463] DEBUG {org.wso2.carbon.user.core.ldap.ActiveDirectoryUserStoreManager} - Can not access the directory service for user : A Student16 {org.wso2.carbon.user.core.ldap.ActiveDirectoryUserStoreManager}
javax.naming.NameNotFoundException: [LDAP: error code 32 - 0000208D: NameErr: DSID-03100238, problem 2001 (NO_OBJECT), data 0, best match of:
'DC=some,DC=org'
]; remaining name 'CN=A Student16'
at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3112)

Answer 1

Add following the line to <IS_HOME>repository/conf/log4j.properties file, and try the scenario which failed. Also attach wso2caron.log file to analyze the issue.
log4j.logger.org.wso2.carbon.user.core=DEBUG
Also attach user-mgt.xml file.

Answer 2

I think I am having the same problem you are. I was able to get the password recovery to work for a user by changing the UserSearchBase so it fully referenced the OU for the user.
In our case we have users in:
OU=FacStaff,OU=People,DC=SomeCollege,DC=edu
OU=Students,OU=People,DC=SomeCollege,DC=edu
OU=Sysusers,OU=PrivUsers,DC=SomeCollege,DC=edu
By specifying the full OU, the password recovery works for users in that OU, but users in any other OU cannot even log in.
I want to have my UserSearchBase set to DC=SomeCollege,DC=edu so it can search our whole tree, and this does work for authentication, but not anything where it has to write to Active Directory.
I can replicate the error by doing an ldapmodify with an ldif that leaves out part of the DN for a user, so I suspect the problem lies in the updateCredentialByAdmin function in that it is attempting to use the CN and UserSearchBase where it should be using the full DN.
I have also tried using multiple UserSearchBase entries, separating them with the hash character. Again, it works for authentication, but not updates.