Cannot add an Active Directory group to DPA if the group name includes a plus sign

10/29/2018 9:34 PM

10/29/2018 9:34 PM

If you add an Active Directory or LDAP group whose name includes a plus sign (for example, "+Developers") to DPA 11.0, an error similar to the following is displayed: 

Unable to get the Repository users: javax.naming.InvalidNameException: Invalid name: CN=+developers,CN=Users,DC=ignite,DC=local

Database Performance Analyzer

This issue is resolved in DPA 11.1. SolarWinds recommends upgrading to the latest version to resolve the issue.

If you cannot upgrade, the work-around is to update the group name in the conusergroup table by adding a backslash (\) to escape the + character. You can do this by:

• Running a SQL command
• Using Chrome developer tools

Run a SQL command to update the group name

1. In DPA, search for the group name:
   1. Click Options.
   2. Click the Administration tab.
   3. Click User Administration. 
   4. Click Add Active Directory Group. 
      The Add Active Directory Group dialog opens.
   5. Click Search for a Group.
      The Search dialog opens.
   6. In the Search String box, enter a string that will return the group name. Then click Search.
      
2. Click Save to close the Search dialog.
   On the Add Active Directory Group dialog, the Group Name field displays the name you searched for.
3. Select a role or permissions for this group.
4. Click Save.
   The Unable to get the Repository users error is displayed.
5. In a SQL editor, run the following query to find the ID of the record that was just added:
   select ID, NAME from conusergroup
6. Update the NAME field to escape the + character with a backslash (\). Depending on which SQL editor you are using, the command would be similar to one of the following (replace the group name and ID):

   • update conusergroup set name = 'CN=\+developers,CN=Users,DC=ignite,DC=local' where ID = 1

     
      

   • update conusergroup set name = 'CN=\\+developers,CN=Users,DC=ignite,DC=local' where ID = 1

     
      

   After the update, the name should look similar to this:

   CN=\+developers,CN=Users,DC=ignite,DC=local

7. In DPA, return to the User Administration page. When DPA has refreshed the user groups, this page no longer displays an error, and you can work with that group in DPA.
   Note: DPA might take up to 1 minute to refresh the user groups.

Use Chrome developer tools to update the group name

1. Open DPA in a Chrome browser, and search for the group name:
   1. Click Options.
   2. Click the Administration tab.
   3. Click User Administration. 
   4. Click Add Active Directory Group. 
      The Add Active Directory Group dialog opens.
   5. Click Search for a Group.
      The Search dialog opens.
   6. In the Search String box, enter a string that will return the group name. Then click Search.
      
2. Click Save to close the Search dialog.
   On the Add Active Directory Group dialog, the Group Name field displays the name you searched for.
3. Select a role or permissions for this group.
4. Press F12 to open the browser developer tools. 
5. Click the Elements tab.
6. Press Ctrl+F to open the Find text box. 
7. Search for distinguishedName. 
   This locates a hidden element in the HTML that contains the group name value.
8. Double-click the value field, and add a backslash (\) in front of the +. 
9. Press Enter.
10. Press F12 to close the developer tools.
11. On the Add Active Directory dialog, click Save.
    The name is stored with the escape character, and the group is saved. 

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment.  You elect to use third party content at your own risk, and you will be solely responsible for the incorporation of the same, if any.