CIFS creation fails with LDAP error: a constraint violation occurred
Applies to
ONTAP 9
Issue
- CIFS creation fails with error
constraint violation occurredas below.
cls1::> cifs server create -vserver vs1 -cifs-server cifs1 -domain xyz.com -ou OU=Gloxcxcx,OU=Rexxxx
In order to create an Active Directory machine account for the CIFS server, you must supply the name and password of a Windows account with sufficient
privileges to add computers to the "OU=Gloxcxcx,OU=Rexxxx" container within the "xyz.COM" domain.
Enter the user name: $xdx@xxcx.com
Enter the password:
Warning: An account by this name already exists in Active Directory at CN=cifs1,OU=Gloxcxcx,OU=Rexxxx,DC=xyz,DC=com.
If there is an existing DNS entry for the name cifs1, it must be removed. Data ONTAP cannot remove such an entry.
Use an external tool to remove it after this command completes.
Ok to reuse this account? {y|n}: y
Error: Machine account creation procedure failed
[ 30073] Loaded the preliminary configuration.
[ 32193] Created a machine account in the domain
[ 33438] SID to name translations of Domain Users and Admins
completed successfully
**[ 33537] FAILURE: Could not modify account
** 'cn=cifs1,OU=Gloxcxcx,OU=Rexxxx,dc=xyz,dc=COM':
** Constraint violation
Error: command failed: Failed to create the Active Directory machine account "cifs1". Reason: LDAP Error: A constraint violation occurred.
- DC Event logs returns
Table SEQ Table \* ARABIC 2: UPN and SPN uniqueness error codes
SYMPTOMS
Decimal Hex Symbolic String
8467 21C7 ERROR_DS_SPN_VALUE_NOT_UNIQUE_IN_FOREST The operation failed because SPN value provided for
addition/modification is not unique forest-wide.
- Packet Trace shows the constrain type of 90303 which is the servicePrincipalName.
Lightweight Directory Access Protocol
LDAPMessage addResponse(6) constraintViolation (000021C7: AtrErr: DSID-03200BE2, #1:
0: 000021C7: DSID-03200BE2, problem 1005 (CONSTRAINT_ATT_TYPE), data 0, Att 90303 (servicePrincipalName)
)
messageID: 6
protocolOp: addResponse (9)
addResponse
resultCode: constraintViolation (19)
matchedDN:
errorMessage: 000021C7: AtrErr: DSID-03200BE2, #1:
0: 000021C7: DSID-03200BE2, problem 1005 (CONSTRAINT_ATT_TYPE), data 0, Att 90303 (servicePrincipalName)
- During a CIFS creation, a service principal name (SPN) is created for the CIFS server, and is attached to the
<account>specified in the CIFS creation command.
