Question

LF Forms User Sync error - An invalid dn syntax has been specified

Forms

Updated March 17

asked on June 15, 2022

Hi,

We have LF Forms synching users once every 24 hours. We are a pure SAML environment, no Windows users or groups. However, during the LF Forms user sync, we get this error every time:

An error occurred when searching for groups in Active Directory our.domain.ca [LFF3022-InvalidLfdsADDomain]
Message: An invalid dn syntax has been specified.

No Active Directory group 'S-1-9-12246445-....' found. The system account the Laserfiche Forms Routing Service runs under must be assigned the "ReadMemberOf" right for User objects in order to get the groups information for the Windows users in the Active Directory domain to be able to synchronize the Windows users.
Function: GetUserDescendantsInAD

The service account that runs all LF services has full read access to our AD environment.

I've looked everywhere in LFDS, Forms and cannot for the life of me find where it's trying to sync an AD group. We only have SAML users and SAML groups. I've turned off all domain syncs from within LFDS as well. Any insight on how to solve these Windows Error log messages?

Thanks.

1 0

Replies

replied on January 23

Hello,

Wanted to provide some additional info. We had a similar error, but it just occurred for 4 user accounts. The user accounts - when added to a LF-Root AD group (providing a particpant license), LFDS would not sync. When those accounts were removed from the active directory group LFDS would sync without errors. Add even one of them back in and it would fail to sync with the An invalid dn syntax has been specified message. It turned out to be a backslash "\" in one of the name fields (example: CN=Smith\, John). When the \ was removed from the AD user account name field, and they were readded to the participant license AD group. LFDS was happy and synching again.

Hope this helps someone else.

Christine

3 0

replied on March 3

Christine, I'm seeing an error, An invalid dn syntax has been specified, where the (CN=Lastname\, Firstname), but I'm not seeing where the backslash is in the name field in AD, can you please expand where you removed the \?

1 0

replied on March 12

Hello Courtney,
Our Service Desk folks found it in the value for the "distinguishedName" attribute.

They sent a screenshot from the String Attribute Editor.

Hope that helps.

0 0

replied on March 17 • Show version history

Another update.

The error occured again yesterday (showing in Event Viewer - a user name with a "\" included directly after the lastname, and before the comma - between first and last name).

It was resolved by deleting (and reentering) the first and last name from the AD User Properties "General Tab". Fields updated are highlighted in the screenshot. Note: The backslash was not visible in either of those fields.

After making the update, I attempted LFDS synchronization again and it was successful, and the person showed up in LFDS with an account.

0 0

replied on March 16

Laserfiche support provided a hotfix it is planned to be included in the upcoming Laserfiche 12 2026H1 version. Make a note of the service account, because the hotfix seems to reset it to default.

1 0

replied on June 21, 2022

There maybe something wrong with the accounts list LFDS side returns to Forms, Forms side will search the members for a Windows group with Active Directory if the group type of an account returned by LFDS is Windows Group. Please open a support case with your Solution Provider and provide the full event logs for synchronization as well as screenshots for the user authentication configuration in Forms and properties in LFDS for the groups added in the allowed list for Forms.

0 0

replied on August 24, 2022

Hello Patrick,

Was this error ever resolved?

I am seeing this with one of our customers as well.

Thanks,

Jeff Curtis

0 0

replied on August 24, 2022

We did not resolve it no. We were going to contact our provider a bit later. It's not affecting anything from what we can see, it's just throwing the error every time Forms tries to sync with LFDS.

1 0

replied on August 24, 2022

Thanks Patrick

0 0

You are not allowed to follow up in this post.

Question

Question

LF Forms User Sync error - An invalid dn syntax has been specified

Replies

Sign in to reply to this post.