IT46481: `CREATE USER` ACTION WITH PASSWORD FOR MICROSOFT ACTIVE DIRECTORY REQUEST NODE MAY FAIL IN ACE12

APAR status

• Closed as documentation error.

Error description

• When using Microsoft Active Directory Request Node in ACE12, the
  `Create User` action may fail to complete. This is a product
  limitation. For setting password while creating a user,
  `unicodePwd` attribute needs to be set. However, ACE uses LDAP
  protocol to communicate with Active directory. The LDAP protocol
  doesnt encrypt communication and hence the LDAP server may not
  allow user creation with the sent password due to security
  risks.
  

Local fix

Problem summary

• ****************************************************************
  
  USERS AFFECTED:
  All users of IBM App Connect Enterprise V12.0 and V13.0 using
  `CREATE USER` action with password for Microsoft Active
  Directory Request Node
  
  
  Platforms affected:
  AIX, LinuxZ64, LinuxX64, LinuxPPCLE64, WinX64
  
  ****************************************************************
  
  PROBLEM DESCRIPTION:
  When using Microsoft Active Directory Request Node in IBM App
  Connect Enterprise v12 and v13, the `Create User` action may
  fail to complete. This is a product limitation. For setting
  password while creating a user, `unicodePwd` attribute needs to
  be set. However, IBM App Connect Enterprise uses LDAP protocol
  to communicate with Active directory. The LDAP protocol does not
  
  encrypt communication and hence the LDAP server may not allow
  user creation with the sent password due to security risks.
  

Problem conclusion

• The IBM App Connect Enterprise v12 Documentation
  (https://www.ibm.com/docs/en/app-connect/12.0?topic=applications
  
  -using-microsoft-active-directory-app-connect-enterprise) and
  IBM App Connect Enterprise v13 Documentation
  (https://www.ibm.com/docs/en/app-connect/13.0?topic=applications
  
  -using-microsoft-active-directory-app-connect-enterprise) will
  be modified to include the product limitation.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

Applicable component levels