WSO2 4.5 Identity Management Server - Can't write users to external LDAP

Question

We have an issue with WSO2 Identity Server Version 4.5.0 where we have swapped out the default embedded Apache DS and replaced it with OID (Oracle Internet Directory).

We have updated the user-mgt.xml and other configuration files the way we think they should be.

However, we cannot write users/roles back to LDAP from WSO2.

We can write create users/roles directly in LDAP when logged in through Directory Studio.

We can view users/roles in WSO2. We can also delete a user in WSO2.

We have gone through the user docs on configuring the user store: https://docs.wso2.org/display/IS450/Configuring+Primary+User+Stores#ConfiguringPrimaryUserStores(Carbon4.2.0v2)-ConfiguringanexternalLDAPorActiveDirectoryuserstore

It is only the writing to LDAP through WSO2 that is not working so it must be a WSO2 configuration issue. I have the UserStoreManager configured to ReadWriteLDAPUserStoreManager Again - reading, and deleting works fine through WSO2.

Does anyone have any ideas/suggestions on where to look to solve this problem?

Answer 1

We discovered the problem. We switched out the default LDAP for an external LDAP but the schema definitions were off a bit and we had SCIM enabled in user-mgt.xml.

There's a good explanation here: http://sureshatt.blogspot.com/2013/06/scim-user-provisioning-with-wso2.html