The OIM to AD integration, which uses the certificates as a mutual handshake, will be rejected if it encounters a critical extension that it doesn't recognize and therefore information that it cannot process. Any non-critical extension isn't necessary the issue here

The server does not support the requested critical extension is a strong indicator OIM is passing a variable within your scheduled task that your AD (LDAP) server is rejecting. If I was to guess blind, it's probable that Active Directory doesn't support the PagedResultsControl extension, which is related to your OIM batch size and batch start settings within your scheduled task.

There's also the page size entry of the Lookup.Configuration.ActiveDirectory as well as the Lookup.Configuration.ActiveDirectory.Trusted lookup definitions for the granulated setting also.

To confirm the attributes in question, remove the batch size and batch start from the scheduled task and rerun - worked for me

There's also more info on the oracle's troubleshooting page, Identity Manager Connector Guide for Microsoft Active Directory User Management. This also takes into account the different scenarios, such as if you're reconciling with AD LDS instead of a direct AD DC call. In this scenario, the scheduled job attributes you're using are not present within the Microsoft AD LDS User Schema.

About the author