Keycloak 26.4.0 -> LDAP Error 65 at one AD Server #43115

Luktan82 · 2025-10-01T09:33:03Z

Luktan82
Oct 1, 2025

Hi everybody,

I'm struggling at one problem I can't solve:

I have a KC with two realms (RA and RB).
Every realm is connected at User federation to a special Microsoft AD Server (RA to DCA and RB to DCB) via "writable".
Both configurations are the same (except the host and the Bind DN and so of course).
The import of the user is working and also the authentication and so on.

BUT at RB it is not possible to update for example the first name of the user.
At RA it is possible.

The Debug Logs of RB shows:

> 2025-10-01 10:30:42,058 WARN  [org.keycloak.services.resources.admin.UserResource] (executor-thread-354) Could not update user!: org.keycloak.models.ModelException: Could not modify attribute for DN [***SECURITY***,DC=de]
        at org.keycloak.storage.ldap.idm.store.ldap.LDAPOperationManager.modifyAttributes(LDAPOperationManager.java:604)
        at org.keycloak.storage.ldap.idm.store.ldap.LDAPOperationManager.modifyAttributes(LDAPOperationManager.java:115)
        at org.keycloak.storage.ldap.idm.store.ldap.LDAPIdentityStore.update(LDAPIdentityStore.java:155)
        at org.keycloak.storage.ldap.mappers.LDAPTransaction.commitImpl(LDAPTransaction.java:59)
        at org.keycloak.models.AbstractKeycloakTransaction.commit(AbstractKeycloakTransaction.java:46)
        at org.keycloak.services.DefaultKeycloakTransactionManager.lambda$commitWithTracing$1(DefaultKeycloakTransactionManager.java:170)
        at org.keycloak.tracing.NoopTracingProvider.trace(NoopTracingProvider.java:59)
        at org.keycloak.tracing.NoopTracingProvider.trace(NoopTracingProvider.java:69)
        at org.keycloak.services.DefaultKeycloakTransactionManager.commitWithTracing(DefaultKeycloakTransactionManager.java:169)
        at org.keycloak.services.DefaultKeycloakTransactionManager.lambda$commit$0(DefaultKeycloakTransactionManager.java:146)
        at org.keycloak.tracing.NoopTracingProvider.trace(NoopTracingProvider.java:59)
        at org.keycloak.tracing.NoopTracingProvider.trace(NoopTracingProvider.java:69)
        at org.keycloak.services.DefaultKeycloakTransactionManager.commit(DefaultKeycloakTransactionManager.java:121)
        at org.keycloak.services.resources.admin.UserResource.updateUser(UserResource.java:241)
        at org.keycloak.services.resources.admin.UserResource$quarkusrestinvoker$updateUser_c4d9b11bd2b4f2348fa10c8d4ebc91a1ff824340.invoke(Unknown Source)
        at org.jboss.resteasy.reactive.server.handlers.InvocationHandler.handle(InvocationHandler.java:29)
        at io.quarkus.resteasy.reactive.server.runtime.QuarkusResteasyReactiveRequestContext.invokeHandler(QuarkusResteasyReactiveRequestContext.java:183)
        at org.jboss.resteasy.reactive.common.core.AbstractResteasyReactiveContext.run(AbstractResteasyReactiveContext.java:147)
        at io.quarkus.vertx.core.runtime.VertxCoreRecorder$15.runWith(VertxCoreRecorder.java:645)
        at org.jboss.threads.EnhancedQueueExecutor$Task.doRunWith(EnhancedQueueExecutor.java:2651)
        at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2630)
        at org.jboss.threads.EnhancedQueueExecutor.runThreadBody(EnhancedQueueExecutor.java:1622)
        at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1589)
        at org.jboss.threads.DelegatingRunnable.run(DelegatingRunnable.java:11)
        at org.jboss.threads.ThreadLocalResettingRunnable.run(ThreadLocalResettingRunnable.java:11)
        at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
        at java.base/java.lang.Thread.run(Thread.java:1583)
Caused by: javax.naming.directory.SchemaViolationException: [LDAP: error code 65 - 00002014: UpdErr: DSID-031A1238, problem 6002 (OBJ_CLASS_VIOLATION), data 0
]; remaining name '***SECURITY***,DC=de'
        at java.naming/com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3291)
        at java.naming/com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:3206)
        at java.naming/com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2997)
        at java.naming/com.sun.jndi.ldap.LdapCtx.c_modifyAttributes(LdapCtx.java:1505)
        at java.naming/com.sun.jndi.toolkit.ctx.ComponentDirContext.p_modifyAttributes(ComponentDirContext.java:277)
        at java.naming/com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.modifyAttributes(PartialCompositeDirContext.java:192)
        at java.naming/javax.naming.directory.InitialDirContext.modifyAttributes(InitialDirContext.java:213)
        at org.keycloak.storage.ldap.idm.store.ldap.LDAPOperationManager$6.execute(LDAPOperationManager.java:585)
        at org.keycloak.storage.ldap.idm.store.ldap.LDAPOperationManager$6.execute(LDAPOperationManager.java:581)
        at org.keycloak.storage.ldap.idm.store.ldap.LDAPOperationManager.execute(LDAPOperationManager.java:742)
        at org.keycloak.storage.ldap.idm.store.ldap.LDAPOperationManager.execute(LDAPOperationManager.java:714)
        at org.keycloak.storage.ldap.idm.store.ldap.LDAPOperationManager.modifyAttributesNaming(LDAPOperationManager.java:581)
        at org.keycloak.storage.ldap.idm.store.ldap.LDAPOperationManager.modifyAttributes(LDAPOperationManager.java:602)
        ... 26 more

2025-10-01 10:30:42,058 DEBUG [org.hibernate.session.metrics] (executor-thread-354) HHH000401: Logging session metrics:
        608681 ns acquiring 1 JDBC connections
        92 ns releasing 1 JDBC connections
        644192 ns preparing 8 JDBC statements
        3370446 ns executing 7 JDBC statements
        355571 ns executing 1 JDBC batches
        0 ns performing 0 second-level cache puts
        0 ns performing 0 second-level cache hits
        0 ns performing 0 second-level cache misses
        557610 ns executing 1 flushes (flushing a total of 10 entities and 4 collections)
        45816 ns executing 4 pre-partial-flushes
        518627 ns executing 4 partial-flushes (flushing a total of 36 entities and 36 collections)

And the very special thing is, that I can change the users password at RB! So the connection over LDAPS is working.

The mapping is also quite the same and in RB are the right attributes like fistname, lastname, email and so (just 5 attributes are synching).

I than confirmed with an LDAP Browser if the LDAP Bind user is able to edit the users attribute and its working.
So anything
Any ideas???

Navigation Menu

Repository navigation

Keycloak 26.4.0 -> LDAP Error 65 at one AD Server #43115

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 0 comments

Select a reply

Uh oh!

Keycloak 26.4.0 -> LDAP Error 65 at one AD Server #43115

Uh oh!

Uh oh!

Luktan82 Oct 1, 2025

Replies: 0 comments

Luktan82
Oct 1, 2025