Problem: AD Connector synchronization fails with ldap.DECODING_ERROR
Problem
On UCS 5.2, AD-to-UCS synchronization fails with:
Traceback (most recent call last):
File "/usr/lib/python3/dist-packages/univention/connector/ad/__init__.py", line 1986, in resync_rejected
if not self._ignore_object(property_key, mapped_object) and not self._ignore_object(property_key, ad_object):
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/univention/connector/__init__.py", line 1946, in _ignore_object
if self._subtree_match(object['dn'], subtree):
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/univention/connector/__init__.py", line 1769, in _subtree_match
x = ldap.dn.str2dn(subtree.lower())
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/ldap/dn.py", line 49, in str2dn
return ldap.functions._ldap_function_call(None,_ldap.str2dn,dn,flags)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/ldap/functions.py", line 52, in _ldap_function_call
result = func(*args,**kwargs)
^^^^^^^^^^^^^^^^^^^^
ldap.DECODING_ERROR
The traceback points to _ignore_object checking ignore_subtree, then _subtree_match failing at:
x = ldap.dn.str2dn(subtree.lower())
This indicates an invalid configured exclusion DN, not necessarily a malformed user.
Investigation
Inspect the ignored subtrees on the connector host:
ucr search --brief '^connector/ad/mapping/ignoresubtree/'
A literal plus inside an OU name must be escaped. For an OU named Team+Lab:
Invalid: OU=Excluded,OU=Team+Lab,DC=ad,DC=example,DC=org
Correct: OU=Excluded,OU=Team\+Lab,DC=ad,DC=example,DC=org
An unescaped + separates attribute-value pairs within a multi-valued RDN. Do not replace valid structural plus signs blindly.
Solution
Save the previous values locally and correct every invalid entry. Adapt this synthetic example to your actual existing key and DN:
ucr set 'connector/ad/mapping/ignoresubtree/ignore1=OU=Excluded,OU=Team\+Lab,DC=ad,DC=example,DC=org'
systemctl restart univention-ad-connector
univention-adconnector-list-rejected