Properties DirectoryObjectAttribute and DirectoryObjectClass are required

[ChristophHannappel]

I did a fresh install of LDAPCPSE v18.0.20240513.3 on a new SharePoint Server SE Farm.
I used the automated Install Script.
When i try to open the Global configuration or Mapping of permissions at the Central Administration i'll get an error message Properties DirectoryObjectAttribute and DirectoryObjectClass are required.

I've attached the ULS Log:
ldapcp.log

What can i do to set those Properties?

[Yvand]

Hi @ChristophHannappel, can you send me the output of these commands:

$trust = Get-SPTrustedIdentityTokenIssuer "<YourTrustName>"
$trust.ClaimProviderName
$trust.ClaimTypeInformation

[ChristophHannappel]

Hi @Yvand ,

 $trust = Get-SPTrustedIdentityTokenIssuer 'ADFS'
$trust.ClaimProviderName
$trust.ClaimTypeInformation
LDAPCPSE


DisplayName                    : Primary SID
InputClaimType                 : http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid
MappedClaimType                : http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid
IsIdentityClaim                : True
AcceptOnlyKnownClaimValues     : False
ClaimValueModificationAction   : None
ClaimValueModificationArgument : 
KnownClaimValues               : {}
UpgradedPersistedProperties    : 

DisplayName                    : Group SID
InputClaimType                 : http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid
MappedClaimType                : http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid
IsIdentityClaim                : False
AcceptOnlyKnownClaimValues     : False
ClaimValueModificationAction   : None
ClaimValueModificationArgument : 
KnownClaimValues               : {}
UpgradedPersistedProperties    : 

Thank you.

[Yvand]

@ChristophHannappel this is a bug in LDAPCP that happens because your trust uses none of the expected claim types for the identifier.
I will fix this. Just to be sure, did you choose claim type http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid for the user identifier because you intend to use the SID ?

[Yvand]

Fixed in #223

[ChristophHannappel]

Just to be sure, did you choose claim type http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid for the user identifier because you intend to use the SID ?

Yes, but if there is a more fitting one - i'm open to that :)

[Yvand]

@ChristophHannappel you do not need the update to get unblocked, you can create the configuration manually using PowerShell:

Add-Type -AssemblyName "Yvand.LDAPCPSE, Version=1.0.0.0, Culture=neutral, PublicKeyToken=80be731bc1a1a740"
[Yvand.LdapClaimsProvider.LDAPCPSE]::DeleteConfiguration()
$config = [Yvand.LdapClaimsProvider.LDAPCPSE]::CreateConfiguration()
$settings = $config.Settings

$settings.ClaimTypes.Clear()
$ct = New-Object "Yvand.LdapClaimsProvider.Configuration.ClaimTypeConfig"
$ct.ClaimType = "http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid"
$ct.DirectoryObjectClass = "user"
$ct.DirectoryObjectAttribute = "objectSid"
$settings.ClaimTypes.Add($ct)

$ct = New-Object "Yvand.LdapClaimsProvider.Configuration.ClaimTypeConfig"
$ct.ClaimType = "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid"
$ct.DirectoryObjectClass = "group"
$ct.DirectoryObjectAttribute = "objectSid"
$settings.ClaimTypes.Add($ct)

$settings.ClaimTypes | ft LDAPAttribute, EntityType, ClaimType, UseMainClaimTypeOfDirectoryObject
$config.ApplySettings($settings, $true)

[ChristophHannappel]

Hi @Yvand, unfortunately the script fails at line 3 with the following error:

$config = [Yvand.LdapClaimsProvider.LDAPCPSE]::CreateConfiguration()
Exception calling "CreateConfiguration" with "0" argument(s): "Properties DirectoryObjectAttribute and DirectoryObjectClass are required"
At line:1 char:1
+ $config = [Yvand.LdapClaimsProvider.LDAPCPSE]::CreateConfiguration()
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : InvalidOperationException

[Yvand]

Hi @ChristophHannappel, ok, in the script above, can you try to replace:

$config = [Yvand.LdapClaimsProvider.LDAPCPSE]::CreateConfiguration()
$settings = $config.Settings

with:

$config = New-Object Yvand.LdapClaimsProvider.Configuration.LdapProviderConfiguration("LDAPCPSEConfig", [Microsoft.SharePoint.Administration.SPFarm]::Local, "LDAPCPSE");
$config.Id = New-Object System.Guid ("F2D006C9-C536-46DA-845D-D5E88CBD15E6")
$settings = [Yvand.LdapClaimsProvider.Configuration.LdapProviderSettings]::GetDefaultSettings("LDAPCPSE")

[ChristophHannappel]

Hi @Yvand, this leads to another error message:

Add-Type -AssemblyName "Yvand.LDAPCPSE, Version=1.0.0.0, Culture=neutral, PublicKeyToken=80be731bc1a1a740"

[Yvand.LdapClaimsProvider.LDAPCPSE]::DeleteConfiguration()

$config = New-Object LdapProviderConfiguration("LDAPCPSEConfig", [Microsoft.SharePoint.Administration.SPFarm]::Local, "LDAPCPSE");
New-Object : Cannot find type [LdapProviderConfiguration]: verify that the assembly containing this type is loaded.
At line:1 char:11
+ $config = New-Object LdapProviderConfiguration("LDAPCPSEConfig", [Mic ...
+           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidType: (:) [New-Object], PSArgumentException
    + FullyQualifiedErrorId : TypeNotFound,Microsoft.PowerShell.Commands.NewObjectCommand

Thank you for your support.

[Yvand]

@ChristophHannappel I forgot to include the namespace, I fixed the script in the previous command, can you try again?

[ChristophHannappel]

Hi @Yvand, this leads to the Properties DirectoryObjectAttribute and DirectoryObjectClass are required error.

Add-Type -AssemblyName "Yvand.LDAPCPSE, Version=1.0.0.0, Culture=neutral, PublicKeyToken=80be731bc1a1a740"

[Yvand.LdapClaimsProvider.LDAPCPSE]::DeleteConfiguration()

$config = New-Object Yvand.LdapClaimsProvider.Configuration.LdapProviderConfiguration("LDAPCPSEConfig", [Microsoft.SharePoint.Administration.SPFarm]::Local, "LDAPCPSE");
New-Object : Exception calling ".ctor" with "3" argument(s): "Properties DirectoryObjectAttribute and DirectoryObjectClass are required"
At line:1 char:11
+ $config = New-Object Yvand.LdapClaimsProvider.Configuration.LdapProvi ...
+           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [New-Object], MethodInvocationException
    + FullyQualifiedErrorId : ConstructorInvokedThrowException,Microsoft.PowerShell.Commands.NewObjectCommand

[Yvand]

@ChristophHannappel hmm yes, I see why it won't work now. So at the moment, you have the following options:

• Keep your config and try the nightly version
• Or recreate your SPTrustedIdentityTokenIssuer to change the identifier claim type
• Or wait for me to publish the new LDAPCP version, which should not take too long, I think 2 weeks max

[ChristophHannappel]

Hi @Yvand, i've used the nightly version and the issue is solved.
Thank you very much.
For the production use i'll wait for the new LDACPCP Release.