12 Troubleshooting Mobile Security Administrative Console LDAP Sync

This chapter describes troubleshooting tips for LDAP (Oracle Unified Directory and Active Directory) sync with the Mobile Security Administrative Console.

This chapter contains the following topics:

• Section 12.1, "AD Sync Job Error"

• Section 12.2, "Job is Already Running"

• Section 12.3, "Group Not Showing"

• Section 12.4, "Deleted or Disabled Users Still Appearing"

• Section 12.5, "User Role Mapped to End User"

• Section 12.6, "Cannot Log In to Console"

• Section 12.7, "Invalid Username"

12.1 AD Sync Job Error

When you click Sync on the Mobile Security Administrative Console Settings->LDAP Settings tab, you see this message:

Error while executing LDAP sync Job! Please check the server".

This can happen when the scheduled AD sync task is disabled or deleted on the Mobile Security Administrative Console Server. Proceed as follows:

1. Go to the Mobile Security Administrative Console server and open Task Scheduler. Check whether the ldap_sync task scheduler is disabled under the Task scheduler Library listing.

2. If disabled enable it back.

3. Try to sync again.

12.2 Job is Already Running

When you click a Sync button on the Mobile Security Administrative Console Settings->LDAP Settings tab you see the message:

LDAP sync Job is already running.

This message indicates that the LDAP sync task is already running or the LDAP sync scheduled task is stopped during execution. Proceed as follows:

1. Try to sync again after a few minutes.

2. If the error message still appears, go to the Mobile Security Administrative Console server and delete the file:

   install-dir\OMSS\ACP\config\*_sync_cron_running.log
   

3. Try to sync again.

12.3 Group Not Showing

If the LDAP User/Group is not showing on Mobile Security Administrative Console, proceed as follows:

1. Make sure the user/group is member of control group or role mapping groups.

2. Trigger a full sync by clicking Full Sync on Mobile Security Administrative Console Console Settings->LDAP Settings tab.

12.4 Deleted or Disabled Users Still Appearing

If deleted/Disabled users are still showing up on Mobile Security Administrative Console, trigger a full sync by clicking Sync Now

12.5 User Role Mapped to End User

User role is mapped to end user role. Proceed as follows:

1. Make sure user is part of respective role mapping group.

2. Trigger full sync by clicking Full Sync on the Mobile Security Administrative Console Console Settings->LDAP settings tab.

12.6 Cannot Log In to Console

If you cannot log in to the Mobile Security Administrative Console:

1. Make sure LDAP sync schedule task is complete. You can check the status of the sync in one of these log files:

   install-dir\OMSS\ACP\logs\ldap-sync\ldap_sync_job_scheduler.log 
   

   or

   install-dir\OMSS\ACP\logs\ad-sync\ad_sync_job_scheduler.log
   

2. If another admin user is allowed to log in, check for the failed user on Mobile Security Administrative Console console.

3. If the user does not show up on Mobile Security Administrative Console console, trigger a sync by clicking Full Sync on the Mobile Security Administrative Console's Settings->LDAP settings tab.

12.7 Invalid Username

If you cannot register a Mobile Security Container and get the error:

Invalid username

Make sure the user is appearing on Mobile Security Administrative Console console and is part of the control group.