Zimbra offers Open Source email server software and shared calendar for Linux and the Mac
Go Back   Zimbra :: Forums > Zimbra Collaboration Suite > Administrators

Welcome to the Zimbra :: Forums!
Welcome, if you would like to post a comment please register. We also encourage you to explore all things Zimbra with our team and members of the community.

Reply
 
LinkBack Thread Tools Search this Thread Display Modes
  #1 (permalink)  
Old 02-16-2011, 12:11 PM
Senior Member
 
Posts: 60
Default LDAP: error code 16 - modify/delete:

Can someone direct me to the appropriate place to research this error?

Code:
2011-02-16 10:51:19,389 WARN  [btpool0-8] [name=j.user@mynetwork.net;ip=123.456.789.0;] account - Unable to update account password lockout attrs: j.user@mynetwork.net
com.zimbra.common.service.ServiceException: system failure: unable to modify attrs: [LDAP: error code 16 - modify/delete: zimbraPasswordLockoutFailureTime: no such value]
ExceptionId:btpool0-8:1297882279360:f62805be0b3b9ec5
Code:service.FAILURE
        at com.zimbra.common.service.ServiceException.FAILURE(ServiceException.java:253)
        at com.zimbra.cs.account.ldap.LdapProvisioning.modifyAttrsInternal(LdapProvisioning.java:309)
        at com.zimbra.cs.account.ldap.LdapProvisioning.modifyAttrs(LdapProvisioning.java:272)
        at com.zimbra.cs.account.ldap.LdapProvisioning.modifyAttrs(LdapProvisioning.java:253)
        at com.zimbra.cs.account.Provisioning.modifyAttrs(Provisioning.java:1663)
        at com.zimbra.cs.account.ldap.LdapLockoutPolicy.failedLogin(LdapLockoutPolicy.java:170)
        at com.zimbra.cs.account.ldap.LdapProvisioning.verifyPassword(LdapProvisioning.java:3079)
        at com.zimbra.cs.account.ldap.LdapProvisioning.authAccount(LdapProvisioning.java:2947)
        at com.zimbra.cs.account.ldap.LdapProvisioning.authAccount(LdapProvisioning.java:2926)
        at com.zimbra.cs.service.account.Auth.handle(Auth.java:126)
        at com.zimbra.soap.SoapEngine.dispatchRequest(SoapEngine.java:430)
        at com.zimbra.soap.SoapEngine.dispatch(SoapEngine.java:286)
        at com.zimbra.soap.SoapEngine.dispatch(SoapEngine.java:160)
        at com.zimbra.soap.SoapServlet.doPost(SoapServlet.java:275)
...
Reply With Quote
  #2 (permalink)  
Old 02-17-2011, 12:19 AM
Advanced Member
 
Posts: 198
Default

Quote:
Originally Posted by blueflametuna View Post
Can someone direct me to the appropriate place to research this error?

Code:
2011-02-16 10:51:19,389 WARN  [btpool0-8] [name=j.user@mynetwork.net;ip=123.456.789.0;] account - Unable to update account password lockout attrs: j.user@mynetwork.net
com.zimbra.common.service.ServiceException: system failure: unable to modify attrs: [LDAP: error code 16 - modify/delete: zimbraPasswordLockoutFailureTime: no such value]
ExceptionId:btpool0-8:1297882279360:f62805be0b3b9ec5
Code:service.FAILURE
        at com.zimbra.common.service.ServiceException.FAILURE(ServiceException.java:253)
        at com.zimbra.cs.account.ldap.LdapProvisioning.modifyAttrsInternal(LdapProvisioning.java:309)
        at com.zimbra.cs.account.ldap.LdapProvisioning.modifyAttrs(LdapProvisioning.java:272)
        at com.zimbra.cs.account.ldap.LdapProvisioning.modifyAttrs(LdapProvisioning.java:253)
        at com.zimbra.cs.account.Provisioning.modifyAttrs(Provisioning.java:1663)
        at com.zimbra.cs.account.ldap.LdapLockoutPolicy.failedLogin(LdapLockoutPolicy.java:170)
        at com.zimbra.cs.account.ldap.LdapProvisioning.verifyPassword(LdapProvisioning.java:3079)
        at com.zimbra.cs.account.ldap.LdapProvisioning.authAccount(LdapProvisioning.java:2947)
        at com.zimbra.cs.account.ldap.LdapProvisioning.authAccount(LdapProvisioning.java:2926)
        at com.zimbra.cs.service.account.Auth.handle(Auth.java:126)
        at com.zimbra.soap.SoapEngine.dispatchRequest(SoapEngine.java:430)
        at com.zimbra.soap.SoapEngine.dispatch(SoapEngine.java:286)
        at com.zimbra.soap.SoapEngine.dispatch(SoapEngine.java:160)
        at com.zimbra.soap.SoapServlet.doPost(SoapServlet.java:275)
...

it should be zimbraPasswordLockoutFailureLifetime, not zimbraPasswordLockoutFailureTime
Reply With Quote
  #3 (permalink)  
Old 02-17-2011, 08:17 AM
Senior Member
 
Posts: 60
Default

Actually, both exist in the schema ...

Code:
attributetype ( zimbraPasswordLocked
	NAME ( 'zimbraPasswordLocked' )
	DESC 'user is unable to change password'
	SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
	EQUALITY booleanMatch
	SINGLE-VALUE)

attributetype ( zimbraPasswordLockoutDuration
	NAME ( 'zimbraPasswordLockoutDuration' )
	DESC 'how long an account is locked out. Use 0 to lockout an account until admin resets it'
	SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{32}
	EQUALITY caseIgnoreIA5Match
	SINGLE-VALUE)

attributetype ( zimbraPasswordLockoutEnabled
	NAME ( 'zimbraPasswordLockoutEnabled' )
	DESC 'whether or not account lockout is enabled.'
	SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
	EQUALITY booleanMatch
	SINGLE-VALUE)

attributetype ( zimbraPasswordLockoutFailureLifetime
	NAME ( 'zimbraPasswordLockoutFailureLifetime' )
	DESC 'the duration after which old consecutive failed login attempts are purged from the list, even though no  successful  authentication  has occurred'
	SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{32}
	EQUALITY caseIgnoreIA5Match
	SINGLE-VALUE)

attributetype ( zimbraPasswordLockoutFailureTime
	NAME ( 'zimbraPasswordLockoutFailureTime' )
	DESC 'this attribute contains the timestamps of each of the consecutive  authentication failures made on an account'
	SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
	EQUALITY generalizedTimeMatch
	ORDERING generalizedTimeOrderingMatch )

attributetype ( zimbraPasswordLockoutLockedTime
	NAME ( 'zimbraPasswordLockoutLockedTime' )
	DESC 'the time at which an account was locked'
	SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
	EQUALITY generalizedTimeMatch
	ORDERING generalizedTimeOrderingMatch 
	SINGLE-VALUE)

attributetype ( zimbraPasswordLockoutMaxFailures
	NAME ( 'zimbraPasswordLockoutMaxFailures' )
	DESC 'number of consecutive failed login attempts until an account is locked out'
	SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
	EQUALITY integerMatch
	SINGLE-VALUE)
I know that LDAP: Error 16 is "No such attribute". The question is why?

The user had complained that the account was locked out.
I tried to find out why and spotted the error in the log.

A service exception looks more like a bug.
Reply With Quote
  #4 (permalink)  
Old 12-19-2011, 06:18 AM
Special Member
 
Posts: 160
Default

Quote:
Originally Posted by blueflametuna View Post
Actually, both exist in the schema ...

Code:
attributetype ( zimbraPasswordLocked
	NAME ( 'zimbraPasswordLocked' )
	DESC 'user is unable to change password'
	SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
	EQUALITY booleanMatch
	SINGLE-VALUE)

attributetype ( zimbraPasswordLockoutDuration
	NAME ( 'zimbraPasswordLockoutDuration' )
	DESC 'how long an account is locked out. Use 0 to lockout an account until admin resets it'
	SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{32}
	EQUALITY caseIgnoreIA5Match
	SINGLE-VALUE)

attributetype ( zimbraPasswordLockoutEnabled
	NAME ( 'zimbraPasswordLockoutEnabled' )
	DESC 'whether or not account lockout is enabled.'
	SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
	EQUALITY booleanMatch
	SINGLE-VALUE)

attributetype ( zimbraPasswordLockoutFailureLifetime
	NAME ( 'zimbraPasswordLockoutFailureLifetime' )
	DESC 'the duration after which old consecutive failed login attempts are purged from the list, even though no  successful  authentication  has occurred'
	SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{32}
	EQUALITY caseIgnoreIA5Match
	SINGLE-VALUE)

attributetype ( zimbraPasswordLockoutFailureTime
	NAME ( 'zimbraPasswordLockoutFailureTime' )
	DESC 'this attribute contains the timestamps of each of the consecutive  authentication failures made on an account'
	SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
	EQUALITY generalizedTimeMatch
	ORDERING generalizedTimeOrderingMatch )

attributetype ( zimbraPasswordLockoutLockedTime
	NAME ( 'zimbraPasswordLockoutLockedTime' )
	DESC 'the time at which an account was locked'
	SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
	EQUALITY generalizedTimeMatch
	ORDERING generalizedTimeOrderingMatch 
	SINGLE-VALUE)

attributetype ( zimbraPasswordLockoutMaxFailures
	NAME ( 'zimbraPasswordLockoutMaxFailures' )
	DESC 'number of consecutive failed login attempts until an account is locked out'
	SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
	EQUALITY integerMatch
	SINGLE-VALUE)
I know that LDAP: Error 16 is "No such attribute". The question is why?

The user had complained that the account was locked out.
I tried to find out why and spotted the error in the log.

A service exception looks more like a bug.
Ive just gotten this error as well - trying to unlock an account. 6.14.. I had to go into the account change to active, dont save, change back to lockout, save - then go back and change to active and save.. how silly.
Reply With Quote
  #5 (permalink)  
Old 01-12-2012, 11:47 AM
Moderator
 
Posts: 1,432
Default

Thanks to those who've posted in this thread. I just recently had a user who was repeatedly getting locked out.

I was getting
Code:
2012-01-11 11:58:39,484 WARN  [btpool0-4789://localhost/service/soap/AuthRequest] [name=user@domain.com;ip=x.x.x.x;ua=zclient/7.1.3_GA_3374;] account - Unable to update account password lockout attrs: user@domain.com
com.zimbra.common.service.ServiceException: system failure: unable to modify attrs: [LDAP: error code 16 - modify/delete: zimbraPasswordLockoutLockedTime: no such attribute]
ExceptionId:btpool0-4789://localhost/service/soap/AuthRequest:1326311919484:83ff47e505082987
Code:service.FAILURE
    at com.zimbra.common.service.ServiceException.FAILURE(ServiceException.java:248)
    at com.zimbra.cs.account.ldap.LdapProvisioning.modifyAttrsInternal(LdapProvisioning.java:328)
    at com.zimbra.cs.account.ldap.LdapProvisioning.modifyAttrs(LdapProvisioning.java:295)
    at com.zimbra.cs.account.ldap.LdapProvisioning.modifyAttrs(LdapProvisioning.java:275)
    at com.zimbra.cs.account.Provisioning.modifyAttrs(Provisioning.java:304)
    at com.zimbra.cs.account.ldap.LdapLockoutPolicy.successfulLogin(LdapLockoutPolicy.java:148)
    at com.zimbra.cs.account.ldap.LdapProvisioning.verifyPassword(LdapProvisioning.java:3730)
    at com.zimbra.cs.account.ldap.LdapProvisioning.authAccount(LdapProvisioning.java:3558)
    at com.zimbra.cs.account.ldap.LdapProvisioning.authAccount(LdapProvisioning.java:3540)
    at com.zimbra.cs.service.account.Auth.handle(Auth.java:118)
    at com.zimbra.soap.SoapEngine.dispatchRequest(SoapEngine.java:412)
    at com.zimbra.soap.SoapEngine.dispatch(SoapEngine.java:287)
    at com.zimbra.soap.SoapEngine.dispatch(SoapEngine.java:158)
    at com.zimbra.soap.SoapServlet.doWork(SoapServlet.java:294)
    at com.zimbra.soap.SoapServlet.doPost(SoapServlet.java:215)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:725)
    at com.zimbra.cs.servlet.ZimbraServlet.service(ZimbraServlet.java:208)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:814)
    at org.mortbay.jetty.servlet.ServletHolder.handle(ServletHolder.java:511)
    at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1166)
    at com.zimbra.cs.servlet.SetHeaderFilter.doFilter(SetHeaderFilter.java:79)
    at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1157)
    at org.mortbay.servlet.UserAgentFilter.doFilter(UserAgentFilter.java:81)
    at org.mortbay.servlet.GzipFilter.doFilter(GzipFilter.java:155)
    at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1157)
    at org.mortbay.jetty.servlet.ServletHandler.handle(ServletHandler.java:388)
    at org.mortbay.jetty.security.SecurityHandler.handle(SecurityHandler.java:218)
    at org.mortbay.jetty.servlet.SessionHandler.handle(SessionHandler.java:182)
    at org.mortbay.jetty.handler.ContextHandler.handle(ContextHandler.java:765)
    at org.mortbay.jetty.webapp.WebAppContext.handle(WebAppContext.java:422)
    at org.mortbay.jetty.handler.ContextHandlerCollection.handle(ContextHandlerCollection.java:230)
    at org.mortbay.jetty.handler.HandlerCollection.handle(HandlerCollection.java:114)
    at org.mortbay.jetty.handler.HandlerWrapper.handle(HandlerWrapper.java:152)
    at org.mortbay.jetty.handler.rewrite.RewriteHandler.handle(RewriteHandler.java:230)
    at org.mortbay.jetty.handler.HandlerWrapper.handle(HandlerWrapper.java:152)
    at org.mortbay.jetty.handler.DebugHandler.handle(DebugHandler.java:77)
    at org.mortbay.jetty.handler.HandlerWrapper.handle(HandlerWrapper.java:152)
    at org.mortbay.jetty.Server.handle(Server.java:326)
    at org.mortbay.jetty.HttpConnection.handleRequest(HttpConnection.java:585)
    at org.mortbay.jetty.HttpConnection$RequestHandler.content(HttpConnection.java:988)
    at org.mortbay.jetty.HttpParser.parseNext(HttpParser.java:756)
    at org.mortbay.jetty.HttpParser.parseAvailable(HttpParser.java:218)
    at org.mortbay.jetty.HttpConnection.handle(HttpConnection.java:415)
    at org.mortbay.io.nio.SelectChannelEndPoint.run(SelectChannelEndPoint.java:429)
    at org.mortbay.thread.BoundedThreadPool$PoolThread.run(BoundedThreadPool.java:451)
Caused by: javax.naming.directory.NoSuchAttributeException: [LDAP: error code 16 - modify/delete: zimbraPasswordLockoutLockedTime: no such attribute]; remaining name 'uid=user,ou=people,dc=domain,dc=com'
    at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3062)
    at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2987)
    at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2794)
    at com.sun.jndi.ldap.LdapCtx.c_modifyAttributes(LdapCtx.java:1455)
    at com.sun.jndi.toolkit.ctx.ComponentDirContext.p_modifyAttributes(ComponentDirContext.java:255)
    at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.modifyAttributes(PartialCompositeDirContext.java:172)
    at javax.naming.directory.InitialDirContext.modifyAttributes(InitialDirContext.java:153)
    at com.zimbra.cs.account.ldap.ZimbraLdapContext.modifyAttributes(ZimbraLdapContext.java:713)
    at com.zimbra.cs.account.ldap.LdapUtil.modifyAttrs(LdapUtil.java:487)
    at com.zimbra.cs.account.ldap.LdapProvisioning.modifyAttrsInternal(LdapProvisioning.java:313)
    ... 43 more
and
Code:
2012-01-11 11:59:12,285 WARN  [btpool0-4788://localhost/service/soap/AuthRequest] [name=user@domain.com;ip=x.x.x.x;ua=zclient/7.1.3_GA_3374;] account - Unable to update account password lockout attrs: user@domain.com
com.zimbra.common.service.ServiceException: system failure: unable to modify attrs: [LDAP: error code 16 - modify/delete: zimbraPasswordLockoutFailureTime: no such value]
ExceptionId:btpool0-4788://localhost/service/soap/AuthRequest:1326311952284:83ff47e505082987
Code:service.FAILURE
    at com.zimbra.common.service.ServiceException.FAILURE(ServiceException.java:248)
    at com.zimbra.cs.account.ldap.LdapProvisioning.modifyAttrsInternal(LdapProvisioning.java:328)
    at com.zimbra.cs.account.ldap.LdapProvisioning.modifyAttrs(LdapProvisioning.java:295)
    at com.zimbra.cs.account.ldap.LdapProvisioning.modifyAttrs(LdapProvisioning.java:275)
    at com.zimbra.cs.account.Provisioning.modifyAttrs(Provisioning.java:304)
    at com.zimbra.cs.account.ldap.LdapLockoutPolicy.failedLogin(LdapLockoutPolicy.java:168)
    at com.zimbra.cs.account.ldap.LdapProvisioning.verifyPassword(LdapProvisioning.java:3733)
    at com.zimbra.cs.account.ldap.LdapProvisioning.authAccount(LdapProvisioning.java:3558)
    at com.zimbra.cs.account.ldap.LdapProvisioning.authAccount(LdapProvisioning.java:3540)
    at com.zimbra.cs.service.account.Auth.handle(Auth.java:118)
    at com.zimbra.soap.SoapEngine.dispatchRequest(SoapEngine.java:412)
    at com.zimbra.soap.SoapEngine.dispatch(SoapEngine.java:287)
    at com.zimbra.soap.SoapEngine.dispatch(SoapEngine.java:158)
    at com.zimbra.soap.SoapServlet.doWork(SoapServlet.java:294)
    at com.zimbra.soap.SoapServlet.doPost(SoapServlet.java:215)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:725)
    at com.zimbra.cs.servlet.ZimbraServlet.service(ZimbraServlet.java:208)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:814)
    at org.mortbay.jetty.servlet.ServletHolder.handle(ServletHolder.java:511)
    at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1166)
    at com.zimbra.cs.servlet.SetHeaderFilter.doFilter(SetHeaderFilter.java:79)
    at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1157)
    at org.mortbay.servlet.UserAgentFilter.doFilter(UserAgentFilter.java:81)
    at org.mortbay.servlet.GzipFilter.doFilter(GzipFilter.java:155)
    at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1157)
    at org.mortbay.jetty.servlet.ServletHandler.handle(ServletHandler.java:388)
    at org.mortbay.jetty.security.SecurityHandler.handle(SecurityHandler.java:218)
    at org.mortbay.jetty.servlet.SessionHandler.handle(SessionHandler.java:182)
    at org.mortbay.jetty.handler.ContextHandler.handle(ContextHandler.java:765)
    at org.mortbay.jetty.webapp.WebAppContext.handle(WebAppContext.java:422)
    at org.mortbay.jetty.handler.ContextHandlerCollection.handle(ContextHandlerCollection.java:230)
    at org.mortbay.jetty.handler.HandlerCollection.handle(HandlerCollection.java:114)
    at org.mortbay.jetty.handler.HandlerWrapper.handle(HandlerWrapper.java:152)
    at org.mortbay.jetty.handler.rewrite.RewriteHandler.handle(RewriteHandler.java:230)
    at org.mortbay.jetty.handler.HandlerWrapper.handle(HandlerWrapper.java:152)
    at org.mortbay.jetty.handler.DebugHandler.handle(DebugHandler.java:77)
    at org.mortbay.jetty.handler.HandlerWrapper.handle(HandlerWrapper.java:152)
    at org.mortbay.jetty.Server.handle(Server.java:326)
    at org.mortbay.jetty.HttpConnection.handleRequest(HttpConnection.java:585)
    at org.mortbay.jetty.HttpConnection$RequestHandler.content(HttpConnection.java:988)
    at org.mortbay.jetty.HttpParser.parseNext(HttpParser.java:756)
    at org.mortbay.jetty.HttpParser.parseAvailable(HttpParser.java:218)
    at org.mortbay.jetty.HttpConnection.handle(HttpConnection.java:415)
    at org.mortbay.io.nio.SelectChannelEndPoint.run(SelectChannelEndPoint.java:429)
    at org.mortbay.thread.BoundedThreadPool$PoolThread.run(BoundedThreadPool.java:451)
Caused by: javax.naming.directory.NoSuchAttributeException: [LDAP: error code 16 - modify/delete: zimbraPasswordLockoutFailureTime: no such value]; remaining name 'uid=user,ou=people,dc=domain,dc=com'
    at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3062)
    at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2987)
    at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2794)
    at com.sun.jndi.ldap.LdapCtx.c_modifyAttributes(LdapCtx.java:1455)
    at com.sun.jndi.toolkit.ctx.ComponentDirContext.p_modifyAttributes(ComponentDirContext.java:255)
    at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.modifyAttributes(PartialCompositeDirContext.java:172)
    at javax.naming.directory.InitialDirContext.modifyAttributes(InitialDirContext.java:153)
    at com.zimbra.cs.account.ldap.ZimbraLdapContext.modifyAttributes(ZimbraLdapContext.java:713)
    at com.zimbra.cs.account.ldap.LdapUtil.modifyAttrs(LdapUtil.java:487)
    at com.zimbra.cs.account.ldap.LdapProvisioning.modifyAttrsInternal(LdapProvisioning.java:313)
    ... 43 more
Note that the first implicates zimbraPasswordLockoutLockedTime and the second zimbraPasswordLockoutFailureTime.

I had trouble saving as active so I just saved the account as pending, then went back and saved as active. Looking okay so far but the problem has been cropping up for this account over the past two days at irregular intervals, so I wouldn't say I'm in the clear until 12-24 hours have passed.

EDIT: Turns out the user was being locked out because he had a client running on a device he hadn't used in a while, and it was attempting to log in with an incorrect password.
__________________
Elliot Wilen
Berkeley, CA

Don't forget to enter your Zimbra version in your forum profile.

Last edited by ewilen; 01-17-2012 at 02:35 PM..
Reply With Quote
Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes


Similar Threads

Why Join?

Registering let's you ask questions, makes it easier to search, displays any files attached to posts, and notifies you about replies.

blog.zimbra.com




 

SEO by vBSEO ©2011, Crawlability, Inc.