Adaxes Service Log Error for SCP

Question

Service account has Create / Delete all child object perms for this object and all descendant objects

Softerra.Adaxes.Directory.Configuration.AdaxesConfigurationException: Failed to create or update the service connection point in domain.com'. ---> Softerra.Adaxes.ServiceLocation.ServiceConnectionPointException: Access is denied. ---> System.DirectoryServices.Protocols.DirectoryOperationException: The user has insufficient access rights. at System.DirectoryServices.Protocols.LdapConnection.ConstructResponse(Int32 messageId, LdapOperation operation, ResultAll resultType, TimeSpan requestTimeOut, Boolean exceptionOnTimeOut) at System.DirectoryServices.Protocols.LdapConnection.SendRequest(DirectoryRequest request, TimeSpan requestTimeout) at Softerra.Adaxes.ServiceLocation.ServiceConnectionPointManager.EnsureContainerExists(String distinguishedName) at Softerra.Adaxes.ServiceLocation.ServiceConnectionPointManager.GetContainerDistinguishedName(ServiceConnectionPointLocation location) --- End of inner exception stack trace --- at Softerra.Adaxes.ServiceLocation.ServiceConnectionPointManager.GetContainerDistinguishedName(ServiceConnectionPointLocation location) at Softerra.Adaxes.ServiceLocation.ServiceConnectionPointManager.CreateDistinguishedName(String commonName, ServiceConnectionPointLocation location) at #7e.#df.#lyc(NtdsDirectoryIdentifier directoryId, NetworkCredential credential, ServiceConnectionPointLocation location) at #7e.#df.#lyc(OnPremiseManagedDomain managedDomain) --- End of inner exception stack trace ---

Answer 1

Hello,

The error means that the account used to manage the domain in Adaxes (domain service account) does not have native Active Directory permissions to create service connection points under the System built-in container. If you are using the Adaxes service account (specified during the installation) to manage the domain in Adaxes, the permissions are also required. For more details about the accounts and required permissions, have a look at the following help article: https://www.adaxes.com/help/PermissionsOfDomainServiceAccount.

Comments

Can you expand a bit on the Sytem OU? I dont think I see anything referencing it in the documentation you linked.

---

Hello,

During the Adaxes service start, two types of service connection points (SCPs) are created. One SCP is created under the computer where the Adaxes service runs. It is used by Adaxes clients (Administration console, Web interface, etc.) to locate the Adaxes service. This SCP is created using the credentials of the Adaxes service account. Another set of SCPs is created in the System\Softerra\Softerra Adaxes container of each domain managed by Adaxes. These SCPs are used to populate the settings for the Adaxes Self-service client. The SCPs are created using the credentials of the corresponding domain service account.

---

Is there any way to disable this if we don't plan on using the Self-Service client at all?

---

Hello,

Unfortunately, there is no possibility of disabling the creation of SCPs used to populate the setting for the Password self-service client. However, if you are not using the client, you can safely ignore the error in the Adaxes event log.