Skip to main content
NetApp Knowledge Base

CIFS creation fails with LDAP error: a constraint violation occurred

Views:
1,438
Visibility:
Public
Votes:
0
Category:
ontap-9
Specialty:
nas
Last Updated:
8/13/2024, 4:10:56 PM

Applies to

ONTAP 9

Issue

  • CIFS creation fails with error constraint violation occurred as below.

cls1::> cifs server create -vserver vs1 -cifs-server cifs1 -domain xyz.com -ou OU=Gloxcxcx,OU=Rexxxx
In order to create an Active Directory machine account for the CIFS server, you must supply the name and password of a Windows account with sufficient
privileges to add computers to the "OU=Gloxcxcx,OU=Rexxxx" container within the "xyz.COM" domain.
Enter the user name: $xdx@xxcx.com
Enter the password:
Warning: An account by this name already exists in Active Directory at CN=cifs1,OU=Gloxcxcx,OU=Rexxxx,DC=xyz,DC=com.
         If there is an existing DNS entry for the name cifs1, it must be removed. Data ONTAP cannot remove such an entry.
        Use an external tool to remove it after this command completes.
         Ok to reuse this account? {y|n}: y
Error: Machine account creation procedure failed
  [ 30073] Loaded the preliminary configuration.
  [ 32193] Created a machine account in the domain
  [ 33438] SID to name translations of Domain Users and Admins
           completed successfully
**[ 33537] FAILURE: Could not modify account
**         'cn=cifs1,OU=Gloxcxcx,OU=Rexxxx,dc=xyz,dc=COM':
**         Constraint violation
Error: command failed: Failed to create the Active Directory machine account "cifs1". Reason: LDAP Error: A constraint violation occurred.

  • DC Event logs returns

Table SEQ Table \* ARABIC 2: UPN and SPN uniqueness error codes
SYMPTOMS
Decimal    Hex    Symbolic    String
8467    21C7    ERROR_DS_SPN_VALUE_NOT_UNIQUE_IN_FOREST    The operation failed because SPN value provided for
addition/modification is not unique forest-wide.

  • Packet Trace shows the constrain type of 90303 which is the servicePrincipalName.

Lightweight Directory Access Protocol
    LDAPMessage addResponse(6) constraintViolation (000021C7: AtrErr: DSID-03200BE2, #1:
    0: 000021C7: DSID-03200BE2, problem 1005 (CONSTRAINT_ATT_TYPE), data 0, Att 90303 (servicePrincipalName)
)
        messageID: 6
        protocolOp: addResponse (9)
            addResponse
                resultCode: constraintViolation (19)
                matchedDN: 
                errorMessage: 000021C7: AtrErr: DSID-03200BE2, #1:
    0: 000021C7: DSID-03200BE2, problem 1005 (CONSTRAINT_ATT_TYPE), data 0, Att 90303 (servicePrincipalName)

  • During a CIFS creation, a service principal name (SPN) is created for the CIFS server, and is attached to the <account> specified in the CIFS creation command.

 

 

Sign in to view the entire content of this KB article.

New to NetApp?

Learn more about our award-winning Support

NetApp provides no representations or warranties regarding the accuracy or reliability or serviceability of any information or recommendations provided in this publication or with respect to any results that may be obtained by the use of the information or observance of any recommendations provided herein. The information in this document is distributed AS IS and the use of this information or the implementation of any recommendations or techniques herein is a customer's responsibility and depends on the customer's ability to evaluate and integrate them into the customer's operational environment. This document and the information contained herein may be used solely in connection with the NetApp products discussed in this document.