Directory sync error codes (mpbx-dirsync, mpbx-api-directory::config::directory_sync)
Raised by the directory sync routes under /api/v1/directory/sources (W7-INT-02b). Messages never
contain a bind password, a client secret or a token. Guide: Directory sync.
| Code | HTTP | Meaning | What to do |
|---|---|---|---|
MPBX-DIRSYNC-NOT-FOUND | 404 | No directory source with this id in this company (another company's source is invisible). | Check the id. |
MPBX-DIRSYNC-TOO-MANY | 409 | The company already has 20 directory sources. | Remove one first. |
MPBX-DIRSYNC-NAME-TAKEN | 409 | Another source of the company has this name. | Pick another name. |
MPBX-DIRSYNC-DISABLED | 409 | The source is switched off (enabled: false); it cannot be synced. | Switch it on first. |
MPBX-DIRSYNC-CONNECT | 503 | The directory could not be reached, the TLS handshake failed (certificate not valid for the host name or not trusted), Microsoft or the server answered with a failure, or it took too long. The failed run is recorded. | Check the address and the network; for a private CA give ldap.ca_certificate. |
MPBX-DIRSYNC-AUTH | 400 | The directory refused the credentials: LDAP bind refused (wrong DN or password, locked account), Microsoft refused the client credentials, or Graph needs the application permission User.Read.All with admin consent. | Fix the bind account or the app registration, then sync again. |
MPBX-DIRSYNC-PROTOCOL | 503 | The directory answered something unexpected (not LDAP, not JSON, a nextLink to another host, a message over 4 MiB). | Check that the address is the directory's LDAPS port. |
MPBX-DIRSYNC-SEARCH | 503 | The search failed on the directory side: the base DN does not exist, the server's size limit was hit, or more than 100000 entries matched. | Fix the base DN, or narrow the filter. |
MPBX-DIRSYNC-BLOCKED | 400 | The directory's address is loopback, link-local (cloud metadata), multicast or unspecified. Private network addresses are allowed. | Use the directory's real address. |
MPBX-DIRSYNC-CONFIG | 400 | The settings are not usable (bad filter, bad CA PEM, a Microsoft provider without a client secret). | Fix the source. |
Validation of a request body (bad ldaps:// URL, a filter that is not RFC 4515, a missing bind
password when the server address changes) is the usual 400 problem with the offending field.
Conflicts in a run
A conflict is not an error: the run finishes with status conflicts and lists the entries it left
alone (kind, the directory's external_id, the e-mail address, the account involved).
| Kind | Meaning | Resolution |
|---|---|---|
invalid_email | The entry has no usable e-mail address. | Fill in the address in the directory. |
duplicate_email | Two entries of the directory have the same address; neither is synced. | Make the addresses unique in the directory. |
email_exists | An account with this address exists and is not linked to the entry. | Turn on adopt_existing, or rename/remove the account. |
linked_elsewhere | The address belongs to an account linked to another source. | Decide which source owns the account. |
email_taken | The entry's new address is held by another account; the linked account keeps its old address. | Free the address or fix the directory. |
protected_account | The account is an Owner (or is the account running the sync); a sync never changes it. | Manage that account by hand. |
empty_directory | The directory returned no entries but accounts are linked; nobody was disabled. | Check the filter, the base DN or the department. |