Resources For IT Professionals
Post an article
Wikis - Page Details
  • First published by (Microsoft)
  • When: 10 Aug 2011 12:11 PM
  • Last revision by (fMicrosof)
  • When: 19 Mar 2013 10:41 AM
  • Revisions: 16
  • Comments: 3
Options
RSSSubscribe to Article (RSS)
Can You Improve This Article?
Positively! Click Sign In to add the tip, solution, correction or comment that will help other users.

Report inappropriate content using these instructions.
Wiki  >  TechNet Articles  >  FIM CM: "There is no such object on the server"

FIM CM: "There is no such object on the server"

FIM CM: "There is no such object on the server"

Recently, a co-worker of mine was working on an issue concerning the error message "There is no such object on the server" while attempting to un-block a Smart Card.  He took the time to write up the issue. 

The error "There is no such object on the server" could surface on any number of operations. However, today, we will be focusing on the fact that we are receiving the error during the Offline unblock of a Smart Card.
In this case, the below error is returned in the Browser.

 

The following call stack was discovered when reviewing the Application Event Log on the Forefront Identity Manager Certificate Management (FIM CM) server.  In reviewing this stack trace, we noticed the GetGroupBySid function call.  The GetGroupBySid function does a lookup in Active Directory for the group using the ObjectSid of the group.  Knowing this, we want to review the FIM CM Web.Config file.

<Data>at System.DirectoryServices.DirectoryEntry.Bind(Boolean throwIfFail) at System.DirectoryServices.DirectoryEntry.Bind()

at System.DirectoryServices.DirectoryEntry.get_Name()

at Microsoft.Clm.DS.DirEntry.BindDirectoryEntry(ProviderType providerType, String serverOrDomain, String path)

at Microsoft.Clm.DS.User.GetGroupBySid(Sid sidGroup)

at Microsoft.Clm.BusinessLayer.AccessControlManager.LoadGroupSecurityDescriptor(Sid sid)

at Microsoft.Clm.BusinessLayer.AccessControlManager.CheckUserAccess(String principal, DirectoryEntry userEntry, UserAccessRights desiredAccess)

at Microsoft.Clm.BusinessLayer.UserAccess.CheckUserAccessByName(String principal, String userName, UserAccessRights desiredAccess)

at Microsoft.Clm.Web.Security.CanPerformActionOnUser(String userName, ManagementAction action) at Microsoft.Clm.Web.Modules.ActionLinksUserControl.checkActionsByOfflineUnblockPermission()

at Microsoft.Clm.Web.Modules.ActionLinksUserControl.offlineUnblockLink_Click(Object sender, EventArgs e)
 
WEB.CONFIG (This is the FIM CM web.config file located at %Program Files%\Microsoft Forefront Identity Manager\2010\Certificate Management\web)

Any time we see activity where FIM CM is attempting to resolve Group SIDs, we should review the "PLUGGABLE EXTENSIONS" section of the FIM CM web.config file. 

<!-- PLUGGABLE EXTENSIONS *********************************************-->               

<!-- Request Security Implementation
Clm.RequestSecurity.Flags
Flags used for configuring default implementation. 
            Allowed values are:
                  UseUser
                  UseGroups
      These values can be OR-ed.
      If not specified, the value is defaulted to "UseGroups"

Clm.RequestSecurity.Groups

Comma-separated list of AD groups (Global or Universal)
that will be used to determine certificate manager access
to users that are members of these groups. The list should
contain group names using DOMAIN\group format. Leaving the list
empty forces CLM to consider all groups that users are members of.

EXAMPLE:
<add key="Clm.RequestSecurity.Flags" value="UseUser,UseGroups" />  
<add key="Clm.RequestSecurity.Groups" 
    value="DOMAIN1\Group1,DOMAIN2\Group2" />-->

<add key="Clm.RequestSecurity.Flags" value="UseUser,UseGroups" />

<add key="Clm.RequestSecurity.Groups" value="" />

<add key="Clm.RequestSecurity.ManagerCanApprove" value="false" />

*NOTE: Leaving the list, CLM.REQUESTSECURITY.GROUPS empty, forces FIM CM to consider all groups that users are a member of
(Yes, we're ending a sentence with a preposition, but that's something we'll have to get over.)

RESOLUTION
To resolve this issue, we limited the list of groups to the Clm.RequestSecurity.Groups to those security groups that are of interest to FIM CM.  Essentially those configured in the Policy Settings in the FIM CM Portal. 

Was this a magic fix, guaranteed to work every time you get the "no such object on the server" error? - Of course not!

We never dug into what object wasn't found.  To do this we would need to collect more data such as:

  1. Network Monitor Trace - executing simultaneous network traces when reproducing the issue allows you to be able to review traffic leaving the FIM CM server and then from the Active Directory to see the traffic coming into the Directory Server and leaving again.
  2. Active Directory Logging - to help isolate the problem object

Additionally, another possible cause could have been one of the groups we included in the UseGroups flag.

That said, this solution allowed us to get back to business. As an added benefit, taking advantage of the UseGroups setting typically speeds up FIM CM operations; instead of having to iterate through an unknown number of groups to verify user permissions, we are only looking at limited subset of groups.

In conclusion:

  1. "There is no such object on the server" is an error that FIM CM gets back from the Active Directory and then passes that information back to the user.
  2. Logging - including event logs (Application, FIM Certificate Management, Security, System) can provide valuable clues as to what, or where the problem lies. 
    1. Here is how to enable verbose tracing for FIM CM and/or CLM
  3. The fix is either to identify the offending object and fix whatever is wrong with it, or bypass the attempt to find it. (In this case we did the latter
  4. Always take advantage of the UseGroups tag in the web.config 
, , , , , , , , , , , , , , , , , , [Edit tags]
Leave a Comment
  • Please add 8 and 4 and type the answer here:
  • Post
Wiki - Revision Comment List(Revision Comment)
Sort by: Published Date | Most Recent | Most Useful
Comments
  • 10 Aug 2011 2:16 PM

    Ed Price - MSFT edited Revision 11. Comment: Updated title per UX Guidelines

  • 10 Aug 2011 2:14 PM

    Ed Price - MSFT edited Revision 10. Comment: Spacing and fonts

  • 10 Aug 2011 1:40 PM

    Tim Macaulay edited Original. Comment: had to clean up the information

Page 1 of 1 (3 items)
Wikis - Comment List
Sort by: Published Date | Most Recent | Most Useful
Posting comments is temporarily disabled until 10:00am PST on Saturday, December 14th. Thank you for your patience.
Comments
  • Posted by
    on 10 Aug 2011 1:40 PM

    Tim Macaulay edited Original. Comment: had to clean up the information

  • Posted by
    on 10 Aug 2011 2:14 PM

    Ed Price - MSFT edited Revision 10. Comment: Spacing and fonts

  • Posted by
    on 10 Aug 2011 2:16 PM

    Ed Price - MSFT edited Revision 11. Comment: Updated title per UX Guidelines

Page 1 of 1 (3 items)