Unbalanced parenthesis error using the userAccountControl attribute in the Active Directory/LDAP Account Search Filter of an ADC in RSA Identity Governance & Lifecycle
Originally Published: 2019-05-13
Last Modified: 2023-11-30
Article Number
000042091
Applies To
RSA Product Set: Identity Governance & Lifecycle
RSA Version/Condition: 6.9.1, 7.x
Issue
When using the userAccountControl attribute in the Account Search Filter of the Account Data Collector definition for Active Directory and LDAP Account Data Collectors in RSA Identity Governance & Lifecycle, the following error occurs when testing the filter:
 
javax.naming.directory.InvalidSearchFilerException:Unbalanced parenthesis;
remaning name 'OU=vcloud Users,DC=2k8r2-vcloud,DC=local'
 
User-added image
Cause
The syntax is incorrect. 
Resolution
The userAccountControl Attribute requires an extra set of parentheses surrounding it. These are showin below in red. 

Modify the reference to the userAccountControl attribute in the Account Search Filter definition:
 
  • Change from (!userAccountControl:1.2.840.11.1.4.802:=2)
  • Change to (!(userAccountControl:1.2.840.11.1.4.802:=2))

Note the extra set of parentheses that are required after the exclamation point and the attribute name, and also to end the string.


In the above example this would look like:
  • Change from
(&(objectCategory=person)(objectClass=user)(!userAcountControl:1.2.840.11.1.4.802:=2)(sAMAccountName=*))
 
  • Change to:
(&(objectCategory=person)(objectClass=user)(!(userAcountControl:1.2.840.11.1.4.802:=2))(sAMAccountName=*))

Related Articles

Trending Articles

Don't see what you're looking for?