LDAP synchronization fails to map consolidation module roles correctly

ERP Oracle Fusion Cloud
, , , , , , , ,
1

We’re experiencing LDAP synchronization issues with Oracle Fusion Cloud 22D where users are losing access to the consolidation module after our nightly sync runs. The LDAP role mapping configuration appears correct, but the synchronization process isn’t properly mapping Active Directory groups to Fusion consolidation roles.

Error from the sync logs:


LDAP role mapping failed for user jsmith
AD Group: CN=Finance-Consolidation,OU=ERP,DC=company,DC=com
Target Role: Consolidation Specialist - MAPPING NOT FOUND

Our LDAP query filters target the correct organizational units, but the role synchronization rules seem to fail during the mapping process. We have fallback role assignments configured, but they’re not triggering properly during these transitions. Users end up with no consolidation access until we manually reassign their roles. The issue started after we reorganized our Active Directory structure to align with our new department hierarchy. Has anyone dealt with LDAP organizational unit mapping issues after AD restructuring?

system 2

Here’s the complete solution for fixing LDAP synchronization and role mapping issues after Active Directory reorganization:

1. LDAP Query Filter Configuration: Update your LDAP query filters to match the new AD organizational structure. Navigate to Setup and Maintenance > Manage LDAP Synchronization > User Search Configuration.

Update the base DN and filter to reflect your new hierarchy:


Base DN: OU=ERP,DC=company,DC=com
Filter: (&(objectClass=user)(memberOf=CN=Finance-*,OU=ERP,DC=company,DC=com))

If you have multiple OUs after reorganization, use an OR filter:


Filter: (&(objectClass=user)(|(memberOf=CN=*,OU=Finance,OU=ERP,DC=company,DC=com)(memberOf=CN=*,OU=Consolidation,OU=ERP,DC=company,DC=com)))

Test the query using the “Validate LDAP Configuration” button before saving. This ensures the filter returns the expected users.

2. Active Directory Organizational Unit Mapping: Create explicit OU-to-role mappings for your new structure. Go to Security Console > LDAP Integration > Organizational Unit Mappings:

  • Map OU=Consolidation,OU=Finance,OU=ERP to role group “Consolidation Users”
  • Map OU=Reporting,OU=Finance,OU=ERP to role group “Consolidation Analysts”
  • Map OU=Management,OU=Finance,OU=ERP to role group “Consolidation Managers”

This creates a hierarchical mapping that respects your new AD structure.

3. Role Synchronization Rules: Fix the role mapping rules to handle both old and new group name formats during the transition:

Navigate to Security Console > Role Mapping Configuration > Add New Mapping:

For each consolidation role, create mappings for both naming conventions:


Fusion Role: Consolidation Specialist
AD Groups:
  - CN=Finance-Consolidation,OU=ERP,DC=company,DC=com (new format)
  - CN=Finance_Consolidation,OU=ERP,DC=company,DC=com (old format)
Mapping Priority: 1

This allows the sync to work during the transition period while you update all group references.

Enable case-insensitive matching and trim whitespace:

  • Check “Ignore case in group name matching”
  • Check “Trim whitespace from group names”
  • Set “Partial match mode” to “Exact” to prevent incorrect mappings

4. Fallback Role Mapping During Transitions: Configure role preservation to prevent access loss during mapping failures:

Go to Setup and Maintenance > Manage LDAP Synchronization > Advanced Options:

  • Enable “Preserve unmapped roles during synchronization” = Yes
  • Set “Role removal grace period” = 7 days
  • Enable “Send notification on mapping failure” = Yes
  • Configure notification email list for LDAP admin team

This gives you a 7-day window to fix mapping issues before roles are actually removed.

Create a default fallback role assignment:


Default Role for Unmapped Users: Consolidation Viewer (Read-Only)
Apply when: User has previous consolidation access AND current mapping fails
Duration: Until next successful sync

This ensures users maintain at least read-only access during mapping transitions.

Implementation and Testing:

  1. Update LDAP query filters to match new OU structure
  2. Create dual mappings for old and new group name formats
  3. Enable role preservation with 7-day grace period
  4. Test with a small group of users first (use “Test Synchronization” feature)
  5. Monitor sync logs for 48 hours before full deployment
  6. Run full synchronization during maintenance window
  7. Remove old group name mappings after 30 days when all references are updated

After implementing these changes, run a manual LDAP sync and monitor the logs. Users should retain their consolidation module access, and new role assignments should map correctly based on the updated AD structure. The fallback mechanisms will prevent access loss while you complete the transition to the new organizational unit hierarchy.

This draft is based on general Oracle Fusion Cloud knowledge. It has not been verified against your specific version and environment. Practitioners: verify the steps and share your experience below.

3

Your LDAP query filter probably still references the old OU structure. Check the filter syntax in Setup and Maintenance > Manage LDAP Synchronization. Make sure it matches your new AD hierarchy with the correct distinguished names.

4

I’ve seen this before. The issue is usually in the role mapping rules, not the query filter. Oracle Fusion uses exact string matching for AD group names to role mappings. If your AD group names changed during the reorganization, or if there’s any whitespace differences, the mapping will fail silently. Go to Security Console > Role Mapping Configuration and verify each consolidation role mapping against your current AD group names. Even a single extra space will break the mapping.

7

I checked the role mapping configuration and found several group names that don’t match exactly. The AD groups have hyphens while the Fusion mappings use underscores. However, I’m confused about the fallback role logic. Shouldn’t users retain their existing roles if the new mapping fails, rather than losing access completely?

8

The fallback mechanism only works if you have it explicitly configured for role removal scenarios. By default, LDAP sync removes roles that can’t be mapped to current AD groups - it’s a security feature to prevent orphaned access. You need to enable “Preserve unmapped roles during synchronization” in the LDAP configuration to prevent role removal when mapping fails. This gives you time to fix the mappings without impacting user access.

9

Also verify your LDAP certificate hasn’t expired. I know it sounds unrelated, but expired LDAP certificates can cause partial sync failures where the query succeeds but the role assignment phase fails. The error messages are often misleading in these cases. Check the certificate validity in Security Console > Certificate Management and renew if needed.