All IdentityIQ product versions can show this error since the error comes from Active Directory.
Environment
Active Directory
Error
You may find one or more of the below in the logs:
"Error occurred while setting password for the account. Exception has been thrown by the target of an invocation.The server is unwilling to process the request. (Exception from HRESULT: 0x80072035)"
Failed to update attributes. The server is unwilling to process the request.
ERROR : "Caught exception in Modify. The server is unwilling to process the request."
Root Cause
The error is not caused by IIQ, but comes directly from Active Directory. This error may be returned by Active Directory by any one of these problems:
An attempt to violate a password policy, such as history, password length, blank password, etc.
An attempt to set a value for an attribute that does not exist
An attempt to set an incorrect value for an attribute (the value does not adhere to the attribute's syntax).
Any other operation that the Active Directory server will not allow.
Workaround/Fix
Ensure that the operation is allowed by Active Directory: passwords should comply with password policy; attributes must exist; attribute values must adhere to the attribute's syntax. Also check network metrics for anomalies and check network security appliances for closed connections.
I am getting same error returned from AD while we set one group for user. Also I don't see this error always but for some user. I checked the attribute value and same is present in AD and for some user. Any idea why it is successful for one user while not for other user if value is same.
Error from IQ service log:
08/07/2015 10:21:36 : ADConnectorServices [] ERROR : ""Error occured while setting group membership. CN=Abc,CN=Users,DC=Example,DC=com. The server is unwilling to process the request.
We have the exact same issue (6.4P4) where this error pops up when updating group membership for some users, but it works for other users. No major difference in users' profiles exist.
We have the exact same issue (6.4P4) when updating group membership for users from different domain.
For example: we have AD forest abc.com which contains two domains Inc.abc.com and americas.abc.com.
Group located in Inc.abc.com. When we trying to execute provisioning plan to update member in group for user located in same domain (Inc) then everything works fine but when we trying to execute same provisioning plan for user located in different domain (americas) then we getting "The server is unwilling to process the request" error.
