Where are LDAP Errors logged by Azure Active Directory Provisioning Agent?

Question

I have the SAP Success Factors to Active Directory user account provisioning agent installed. I have one user account that fails to provision, and the error data shown in the portal is,

Error code  
HybridSynchronizationActiveDirectoryInvalidParameter  

Error message  
ConstraintViolation-LdapErr: A value in the request is invalid.. The parameter is incorrect. \nError Details: Error in attribute conversion operation, data 0, v4563  

All of the attribute values appear to be correct and consistent with the users that provision successfully. How do I go about getting additional details? I have checked numerous logs on the on-premises provisioning agent server as well as the target domain controller and come up with nothing.

Answer 1

@Michael Liben Were you able to get past this issue?

As I researched this, I noticed that our instructions for checking the provisioning agent logs are currently across different docs. I'll put in a request to consolidate this into one article. Thank you for the feedback!
Meanwhile, here are some useful references for troubleshooting agent logs:

• The most probable cause of this error is an attempt to either set an empty string "" on an AD attribute or setting a value that's greater than the max length for that attribute. E.g., company and department name in AD cannot be longer than 64 characters. Reference: https://learn.microsoft.com/en-us/azure/active-directory/app-provisioning/hr-user-update-issues#null-and-empty-values-not-processed-as-expected
• The provisioning agent logs are available in the Event Viewer on the Windows server. You can refer to this doc for details: https://learn.microsoft.com/en-us/azure/active-directory/saas-apps/workday-inbound-tutorial#troubleshooting-tips
• You can update the config file "C:\Program Files\Microsoft Azure AD Connect Provisioning Agent\AADConnectProvisioningAgent.exe.config" to get additional trace logs. Refer: https://learn.microsoft.com/en-us/azure/active-directory/saas-apps/workday-inbound-tutorial#configure-provisioning-agent-to-emit-event-viewer-logs
• You can install a PowerShell module to just capture agent logs for a specific time frame: https://learn.microsoft.com/en-us/azure/active-directory/cloud-sync/how-to-troubleshoot#log-files

Answer 2

Hello @Michael Liben

Thank you for sharing this question on this community space.

I have read your case scenario description and I would like to gather few details about it so, please see them down below:

Moreover, I want to share the following URL as well.

https://learn.microsoft.com/en-us/answers/questions/761199/ldap-error-code-12-00000057-ldaperr-dsid-0c090b19.html

I hope you can find this useful to overcome your concern.

Looking forward to your feedback,

Cheers,

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.