Ошибка пользователь отсутствует не существует такого пользователя

11.03.2008, 23:50

#1

At one of our customers there is an Active Directory that contains several domains. There are overlapping user accounts in these domains, like DomainAUser1 and DomainBUser1, often one of these accounts is disabled, while the same account in the other domain is active.

Recently I worked with a list, where I chose a user in People picker without problems, however, when saving the list item, I received an error:

The user does not exist or is not unique.<nativehr>0x81020054</nativehr><nativestack></nativestack>

The full stack trace:

[COMException (0x81020054): The user does not exist or is not unique.<nativehr>0x81020054</nativehr><nativestack></nativestack>]
   Microsoft.SharePoint.Library.SPRequestInternalClass.AddOrUpdateItem(String bstrUrl, String bstrListName, Boolean bAdd, Boolean bSystemUpdate, Boolean bPreserveItemVersion, Boolean bUpdateNoVersion, Int32& plID, String& pbstrGuid, Guid pbstrNewDocId, Boolean bHasNewDocId, String bstrVersion, Object& pvarAttachmentNames, Object& pvarAttachmentContents, Object& pvarProperties, Boolean bCheckOut, Boolean bCheckin, Boolean bMigration, Boolean bPublish, String bstrFileName, ISP2DSafeArrayWriter pListDataValidationCallback, ISP2DSafeArrayWriter pRestrictInsertCallback, ISP2DSafeArrayWriter pUniqueFieldCallback) +0
   Microsoft.SharePoint.Library.SPRequest.AddOrUpdateItem(String bstrUrl, String bstrListName, Boolean bAdd, Boolean bSystemUpdate, Boolean bPreserveItemVersion, Boolean bUpdateNoVersion, Int32& plID, String& pbstrGuid, Guid pbstrNewDocId, Boolean bHasNewDocId, String bstrVersion, Object& pvarAttachmentNames, Object& pvarAttachmentContents, Object& pvarProperties, Boolean bCheckOut, Boolean bCheckin, Boolean bMigration, Boolean bPublish, String bstrFileName, ISP2DSafeArrayWriter pListDataValidationCallback, ISP2DSafeArrayWriter pRestrictInsertCallback, ISP2DSafeArrayWriter pUniqueFieldCallback) +406

[SPException: The user does not exist or is not unique.]
   Microsoft.SharePoint.SPGlobal.HandleComException(COMException comEx) +27609794
   Microsoft.SharePoint.Library.SPRequest.AddOrUpdateItem(String bstrUrl, String bstrListName, Boolean bAdd, Boolean bSystemUpdate, Boolean bPreserveItemVersion, Boolean bUpdateNoVersion, Int32& plID, String& pbstrGuid, Guid pbstrNewDocId, Boolean bHasNewDocId, String bstrVersion, Object& pvarAttachmentNames, Object& pvarAttachmentContents, Object& pvarProperties, Boolean bCheckOut, Boolean bCheckin, Boolean bMigration, Boolean bPublish, String bstrFileName, ISP2DSafeArrayWriter pListDataValidationCallback, ISP2DSafeArrayWriter pRestrictInsertCallback, ISP2DSafeArrayWriter pUniqueFieldCallback) +28003791
   Microsoft.SharePoint.SPListItem.AddOrUpdateItem(Boolean bAdd, Boolean bSystem, Boolean bPreserveItemVersion, Boolean bNoVersion, Boolean bMigration, Boolean bPublish, Boolean bCheckOut, Boolean bCheckin, Guid newGuidOnAdd, Int32& ulID, Object& objAttachmentNames, Object& objAttachmentContents, Boolean suppressAfterEvents, String filename) +26729773
   Microsoft.SharePoint.SPListItem.UpdateInternal(Boolean bSystem, Boolean bPreserveItemVersion, Guid newGuidOnAdd, Boolean bMigration, Boolean bPublish, Boolean bNoVersion, Boolean bCheckOut, Boolean bCheckin, Boolean suppressAfterEvents, String filename) +26726382
   Microsoft.SharePoint.SPListItem.Update() +161
   Microsoft.SharePoint.WebControls.SaveButton.SaveItem(SPContext itemContext, Boolean uploadMode, String checkInComment) +20288612
   Microsoft.SharePoint.WebControls.SaveButton.OnBubbleEvent(Object source, EventArgs e) +1315
   System.Web.UI.Control.RaiseBubbleEvent(Object source, EventArgs args) +70
   System.Web.UI.Page.RaisePostBackEvent(IPostBackEventHandler sourceControl, String eventArgument) +29
   System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +2981

A similar error can we reproduce when selecting a user in People picker, then before save, we set the account in AD as disabled:

When saving the item, the same “The user does not exist or is not unique” exception is thrown as long the user was not yet available in the user list of SharePoint. If the user was already former created in the SharePoint user list, there was no error, even if the user was disabled in AD.

However, in our case, it was a bit more complicated. When I searched the user in People picker, only one of the accounts was shown up, the one that was not disabled (in this case, from DomainA). The disabled account from the other domain was not included in the People picker. So far, so good.

However, after I selected the user and closed the People picker by pressing OK, the other, disabled user (from DomainB) was set in the field, and caused the issue at save.

When I set the account by explicitly specifying the domain (like DomainAtestuser) I hade no such problems.

After a user from DomainB was resolved by People picker, both accounts was shown up in the result list (at least, for a while).

I’ve created a few network traffic capture using Wireshark, and found that the LDAP queries again the AD were correct, searching only accounts that are not disabled (see condition (!(userAccountControl:1.2.840.113556.1.4.803:=2) below).

(&(&(&(objectCategory=person)(objectClass=user))(!(userAccountControl:1.2.840.113556.1.4.803:=2)))(|(|(|(|(|(|(|(name=testuser*)(displayName=testuser*))(cn=testuser*))(mail=testuser*))(sn=testuser*))(SamAccountName=testuser*))

The response from AD was OK as well, including only the active user from DomainA.

Using SQL Server Profiler I found queries, like the ones below:

exec sp_executesql N’DECLARE @DocParentIdForRF uniqueidentifier SELECT TOP 1 @DocParentIdForRF = Docs.Id FROM Docs WHERE Docs.SiteId = @SITEID AND Docs.DirName = @FDN AND Docs.LeafName = @FLN;   SELECT TOP(@NUMROWS) t1.[Type] AS c0, UserData.[tp_ContentTypeId], UserData.[nvarchar10], UserData.[tp_ID], UserData.[tp_CopySource], UserData.[tp_Version], t1.[Id] AS c4, UserData.[nvarchar4], UserData.[nvarchar9], UserData.[nvarchar5], UserData.[tp_Created], t1.[SortBehavior] AS c1, UserData.[tp_HasCopyDestinations], UserData.[nvarchar1], UserData.[tp_ModerationStatus], UserData.[tp_Level], UserData.[nvarchar6], t1.[MetaInfo] AS c3, t1.[ScopeId] AS c5, UserData.[tp_Modified], CASE WHEN DATALENGTH(t1.DirName) = 0 THEN t1.LeafName WHEN DATALENGTH(t1.LeafName) = 0 THEN t1.DirName ELSE t1.DirName + N”/” + t1.LeafName END  AS c2, UserData.[nvarchar3] FROM UserData INNER MERGE JOIN Docs AS t1 WITH(NOLOCK) ON (UserData.[tp_RowOrdinal] = 0) AND (t1.SiteId=UserData.tp_SiteId) AND (t1.SiteId = @SITEID) AND (t1.ParentId = UserData.tp_ParentId) AND (t1.Id = UserData.tp_DocId) AND ( (UserData.tp_Level = 1) ) AND (t1.Level = UserData.tp_Level) AND (t1.IsCurrentVersion = 1) AND (t1.Level = 1 OR t1.Level =  2) WHERE ( (UserData.tp_Level = 1) ) AND (UserData.tp_SiteId=@SITEID AND (UserData.tp_ParentId=@DocParentIdForRF)) AND (UserData.tp_RowOrdinal=0) AND ((UserData.[bit3]=0 ) AND ((UserData.[tp_ContentTypeId] = @L2IMG) AND (((UserData.[nvarchar3] LIKE @L3TXP) OR (UserData.[nvarchar1] LIKE @L4TXP)) OR ((UserData.[nvarchar4] LIKE @L4TXP) OR (UserData.[nvarchar5] LIKE @L3TXP)))) AND t1.SiteId=@SITEID AND (t1.ParentId=@DocParentIdForRF)) ORDER BY UserData.[nvarchar3]  ASC ,UserData.[tp_ID]  ASC  OPTION (FORCE ORDER, MAXDOP 1)’,N’@LFFP uniqueidentifier,@SITEID uniqueidentifier,@L2IMG varbinary(8000),@L3TXP nvarchar(4000),@L4TXP nvarchar(4000),@FDN nvarchar(4000),@FLN nvarchar(4000),@NUMROWS bigint,@RequestGuid uniqueidentifier’,@LFFP=’00000000-0000-0000-0000-000000000000′,@SITEID=’94053632-22BC-4CEA-A146-8EC049097DA3′,@L2IMG=0x010A00980232D0CB4C3C41A835ED215B890946,@L3TXP=N’%DomainAtestuser%’,@L4TXP=N’DomainAtestuser%’,@FDN=N’my/_catalogs’,@FLN=N’users’,@NUMROWS=12,@RequestGuid=’5DBABDC5-3182-4866-8FBC-0E9244FE6733′

and

exec proc_SecResolvePrincipal @SiteId=’94053632-22BC-4CEA-A146-8EC049097DA3′,@Input=N’DomainAtestuser’,@InputIsEmailOnly=0,@AccountName=N’DomainAtestuser’,@DLAlias=NULL,@DLAliasServerAddress=NULL,@SearchScope=1,@RequestGuid=’5DBABDC5-3182-4866-8FBC-0E9244FE6733′

While the user did not yet exist in the SharePoint site, neither of these queries had a result.

Using Reflector I found that the following classes and methods have significant roles in the user login name resolution:

Microsoft.SharePoint.Utilities.SPUtility class, ResolvePrincipalInternal, ResolveWindowsPrincipal, SearchAgainstAD methods
Microsoft.SharePoint.WebControls.PeopleEditor class, GetAccountFromSid method
Microsoft.SharePoint.Utilities.SPActiveDirectoryPrincipalBySIDResolver class, ResolvePrincipal method
Microsoft.SharePoint.Utilities.SPUserUtility class, ResolveAgainstUserInfoList method
System.Security.Principal.NTAccount class, Translate and TranslateToSids methods

There are a few approach to resolve the user via the methods above:

SPPrincipalInfo pi = SPUtility.ResolveWindowsPrincipal(web.Site.WebApplication, «testuser», SPPrincipalType.User, false);

or

SecurityIdentifier sid = (SecurityIdentifier)new NTAccount(«testuser»).Translate(typeof(SecurityIdentifier));

or using Reflection through the internal static GetAccountFromSid method of the PeopleEditor class:

We can use the public instance methods of the PeopleEditor class from a console application as well, however, in this case we have to inject a dummy HTTP context first.

I found that the source of the issue might be the Translate method of the NTAccount class. If I call this method first (or after a long while) with the account name (like ‘testuser’), the SID of the disabled account is returned. When calling the method with the full login name (like ‘DomainAtestuser’ or ‘DomainBtestuser’), the SID of the corresponding user is returned. However, when we call the method with the account name (like ‘testuser’) just after we called the method with the full login name (like ‘DomainAtestuser’), the SID of the active user is returned. It seems that there is a sort of caching implemented somewhere in these objects, but since they are rather complex, including calls into unmanaged code, I was not (yet) able to resolve the issue of user name resolution.

Describe the bug
The Auth.signIn method now returns a userNotFoundException even though the user exists in the cognito user pool.

I had an existing and fully functioning auth flow working through cognito for my react-native app. However, I, realized that I needed to create and use a new cognito user pool for my app, and delete the old user pool. I achieved this via the amplify-cli. All seemed well when I did a sign up test in the app. The user could create an account, receive a verification code in their email, and the cognito user pool responded appropriately. However, when that same user that was just created attempts to sign in, the Auth.signIn method throws a userNotFoundException error.

To Reproduce
Assuming the app already as Auth added
In the terminal run:

1. amplify remove auth
   Confirm removal
2. amplify push
   Confirm push
3. amplify add auth
   Select default configuration with social providers and conduct a standard setup
4. Rebuild the App
5. Create a new user via the Auth.signUp method (in app, this is just the standard auth flow)
6. Attempt to sign in with the just-created user.

Expected behavior
The Auth.signIn method should return a successful sign in.

Code Snippet
Error:
error signing in... {code: "UserNotFoundException", name: "UserNotFoundException", message: "User does not exist."}

Context of Auth.signIn method:

import React, { Component, useState, useContext } from 'react' import {AuthContext} from '../../navigation/Screens'; import {ToggleContext} from './Auth'; import { View, TouchableWithoutFeedback, StyleSheet } from 'react-native' import { Text } from 'galio-framework'; import { Auth } from 'aws-amplify' import argonTheme from '../../constants/argonTheme'; import Input from '../../components/Auth/Input' import ActionButton from '../../components/Auth/ActionButton' import SocialButton from '../../components/Auth/SocialButton'; import GoogleButton from '../../components/Auth/GoogleButton'; // Sign in screen function SignIn() { // Assigns updateAuth function to a variable // Assigns toggleAuthType function to a variable const updateAuth = useContext(AuthContext); const toggleAuthType = useContext(ToggleContext); // Username and Password state management via useState hooks const [username, setUsername] = useState(''); const [password, setPassword] = useState(''); // Sign In function // Attempts to sign in with given username and password // * Note that Auth.signIn returns a promise in the form of an object // Sets current view to the main app if the Auth.signIn promise resolves to a success // Logs error and alerts if the Auth.Sign promise resolves to a failure async function signIn() { try { await Auth.signIn(username, password) console.log('successfully signed in') updateAuth('MainNav') } catch (code) { console.log('error signing in...', code) alert(code.message) } } function showForgotPassword() { toggleAuthType('showForgotPassword') } return ( <View> <Input onChangeText={(text) => {setUsername(text)}} type='username' placeholder='Username' /> <Input onChangeText={(text) => {setPassword(text)}} type='password' placeholder='Password' secureTextEntry /> <ActionButton title='Sign In' onPress={signIn} BGColor={argonTheme.COLORS.ACTIVE} /> <View style={styles.buttonContainer}> <TouchableWithoutFeedback onPress={showForgotPassword}> <Text style={{fontSize: 16, fontFamily: 'OpenSans-regular'}}>Forget your password?</Text> </TouchableWithoutFeedback> </View> <View style={styles.buttonContainer}> <Text style={{fontSize: 16, fontFamily: 'OpenSans-regular'}}>Or</Text> </View> <View style={styles.socialCont}> <GoogleButton title="Sign in with Google" onPress={() => Auth.federatedSignIn({ provider: "Google" })} /> <SocialButton title="Sign in with Facebook" onPress={() => Auth.federatedSignIn({ provider: "Facebook" })} BGColor={argonTheme.COLORS.FACEBOOK} iconName='facebook' iconColor='white' textColor={argonTheme.COLORS.WHITE} /> <SocialButton title="Sign in with Apple" BGColor={argonTheme.COLORS.BLACK} iconName='apple' iconColor='white' textColor={argonTheme.COLORS.WHITE} /> </View> </View> ) } const styles = StyleSheet.create({ buttonContainer: { paddingTop: '2%', justifyContent: 'center', flexDirection: 'row', }, socialCont: { marginTop: '5%' }, }) export default SignIn 

aws-exports.js

const awsmobile = { "aws_project_region": "us-east-2", "aws_cognito_identity_pool_id": "us-east-2:d15b3200-6cc2-4e28-9ef0-334cdfa3c389", "aws_cognito_region": "us-east-2", "aws_user_pools_id": "us-east-2_uZqiPEd19", "aws_user_pools_web_client_id": "1npgiokobk2d10ofoerablv93t", "oauth": { "domain": "nerdhub-auth-dev.auth.us-east-2.amazoncognito.com", "scope": [ "phone", "email", "openid", "profile", "aws.cognito.signin.user.admin" ], "redirectSignIn": "http://localhost:3000/", "redirectSignOut": "http://localhost:3000/", "responseType": "code" }, "federationTarget": "COGNITO_USER_POOLS" }; 

parameters.json

{ "identityPoolName": "nerdhub39718c9f_identitypool_39718c9f", "allowUnauthenticatedIdentities": false, "resourceNameTruncated": "nerdhu39718c9f", "userPoolName": "nerdhub39718c9f_userpool_39718c9f", "autoVerifiedAttributes": [ "email" ], "mfaConfiguration": "OFF", "mfaTypes": [ "SMS Text Message" ], "smsAuthenticationMessage": "Your authentication code is {####}", "smsVerificationMessage": "Your verification code is {####}", "emailVerificationSubject": "Your verification code", "emailVerificationMessage": "Your verification code is {####}", "defaultPasswordPolicy": false, "passwordPolicyMinLength": 8, "passwordPolicyCharacters": [], "requiredAttributes": [ "email" ], "userpoolClientGenerateSecret": true, "userpoolClientRefreshTokenValidity": 30, "userpoolClientWriteAttributes": [ "email" ], "userpoolClientReadAttributes": [ "email" ], "userpoolClientLambdaRole": "nerdhu39718c9f_userpoolclient_lambda_role", "userpoolClientSetAttributes": false, "sharedId": "39718c9f", "resourceName": "nerdhub39718c9f", "authSelections": "identityPoolAndUserPool", "authRoleArn": { "Fn::GetAtt": [ "AuthRole", "Arn" ] }, "unauthRoleArn": { "Fn::GetAtt": [ "UnauthRole", "Arn" ] }, "useDefault": "defaultSocial", "hostedUI": true, "hostedUIDomainName": "nerdhub-auth", "authProvidersUserPool": [ "Facebook", "Google" ], "hostedUIProviderMeta": "[{"ProviderName":"Facebook","authorize_scopes":"email,public_profile","AttributeMapping":{"email":"email","username":"id"}},{"ProviderName":"Google","authorize_scopes":"openid email profile","AttributeMapping":{"email":"email","username":"sub"}}]", "oAuthMetadata": "{"AllowedOAuthFlows":["code"],"AllowedOAuthScopes":["phone","email","openid","profile","aws.cognito.signin.user.admin"],"CallbackURLs":["http://localhost:3000/"],"LogoutURLs":["http://localhost:3000/"]}", "userPoolGroupList": [], "dependsOn": [] } 

Environment
System:
OS: macOS 10.15.4
CPU: (8) x64 Intel(R) Core(TM) i5-1038NG7 CPU @ 2.00GHz
Memory: 16.45 MB / 16.00 GB
Shell: 5.7.1 — /bin/zsh
Binaries:
Node: 12.14.1 — /usr/local/bin/node
Yarn: 1.22.4 — /usr/local/bin/yarn
npm: 6.14.5 — /usr/local/bin/npm
Browsers:
Chrome: 84.0.4147.105
Safari: 13.1
npmPackages:
@apollo/react-hooks: ^3.1.5 => 3.1.5
@aws-amplify/pubsub: ^2.1.9 => 2.1.9
@babel/core: ^7.9.0 => 7.9.0
@babel/runtime: ^7.9.2 => 7.9.2
@expo/vector-icons: ^10.0.6 => 10.0.6
@react-native-community/eslint-config: ^1.1.0 => 1.1.0
@react-native-community/google-signin: ^4.0.0 => 4.0.0
@react-native-community/masked-view: ^0.1.9 => 0.1.9
@react-native-community/netinfo: ^5.9.2 => 5.9.5
@react-navigation/bottom-tabs: ^5.2.7 => 5.2.7
@react-navigation/compat: ^5.1.9 => 5.1.9
@react-navigation/drawer: ^5.5.0 => 5.5.0
@react-navigation/material-top-tabs: ^5.2.2 => 5.2.8
@react-navigation/native: ^5.2.6 => 5.4.3
@react-navigation/stack: ^5.2.11 => 5.2.11
@unimodules/core: ^5.1.0 => 5.1.0
@unimodules/react-native-adapter: ^5.2.0 => 5.2.0
amazon-cognito-identity-js: ^4.3.1 => 4.3.3
apollo-boost: ^0.4.9 => 0.4.9
aws-amplify: ^2.3.0 => 2.3.0
aws-amplify-react-native: ^4.2.0 => 4.2.1
babel-jest: ^25.3.0 => 25.3.0
eslint: ^6.8.0 => 6.8.0
expo-asset: ^8.1.4 => 8.1.4
expo-constants: ^9.0.0 => 9.0.0
expo-file-system: ^8.1.0 => 8.1.0
expo-font: ^8.1.1 => 8.1.1
galio-framework: ^0.6.3 => 0.6.3
graphql: ^14.6.0 => 14.7.0
jest: ^25.3.0 => 25.3.0
metro-react-native-babel-preset: ^0.59.0 => 0.59.0
prop-types: ^15.7.2 => 15.7.2
react: ^16.11.0 => 16.13.1
react-native: 0.62.2 => 0.62.2
react-native-elements: ^1.2.7 => 1.2.7
react-native-gesture-handler: ^1.6.1 => 1.6.1
react-native-inappbrowser-reborn: ^3.4.0 => 3.4.0
react-native-material-dropdown: ^0.11.1 => 0.11.1
react-native-material-tabs: ^4.1.2 => 4.1.2
react-native-reanimated: ^1.8.0 => 1.8.0
react-native-safe-area-context: ^0.7.3 => 0.7.3
react-native-screens: ^2.5.0 => 2.5.0
react-native-snap-carousel: ^3.9.1 => 3.9.1
react-native-splash-screen: ^3.2.0 => 3.2.0
react-native-tab-view: ^2.14.0 => 2.14.2
react-native-vector-icons: ^6.6.0 => 6.6.0
react-native-view-more-text: ^2.1.0 => 2.1.0
react-test-renderer: 16.11.0 => 16.11.0
typescript: ^3.8.3 => 3.8.3
npmGlobalPackages:
@aws-amplify/cli: 4.21.0
create-react-app: 3.4.0
expo-cli: 3.15.5
firebase-tools: 8.4.0
gatsby-cli: 2.12.17
gulp: 4.0.2
npm: 6.14.5
react-native-cli: 2.0.1

Smartphone (please complete the following information):

• Device: iPhone 11
• OS: IOS 13.6
• Browser: safari