Hi,

I've been running IDM 3.0.1 for about a year now.
I have fairly stock driver policies, nothing too exotic, but please
let me know any details you need.

Last week, I upgraded to 3.5.1.
AFAIK, I followed the entire upgrade procedure correctly and it seemed
to work just fine.

However, I'm now having problems with both new and existing user
entries. Specifically associations, I think.

I initially migrated my AD driver to 3.5.1, but then saw these errors,
so built a new 3.5.1 AD driver from scratch and am seeing the same
thing.

Basically, for a new user on the publisher channel, it fails due to:
[03/03/08 10:36:33.386]:AD-Corp PT:
<nds dtdversion="3.5" ndsversion="8.x">
<source>
<product version="3.5.10.20070918 ">DirXML</product>
<contact>Novell, Inc.</contact>
</source>
<output>
<status event-id="AD-Corp##11875ee4827##0" level="warning">Code
(-8019) Operation vetoed on unassociated object.<application>DirXML</
application>
<module>AD-Corp</module>
<object-
dn>CN=XXXX,OU=XXXX,OU=XXXX,OU=XXXX,DC=XXXX,DC=XXXX ,DC=XXX</object-dn>
<component>Publisher</component>
</status>
</output>
</nds>

It can't possibly already have an association, it's a completely new
entry.

For existing users, it's finding an association, but for the other AD
driver, and also failing:
<nds dtdversion="2.2">
<source>
<product version="3.5.10.20070918 ">DirXML</product>
<contact>Novell, Inc.</contact>
</source>
<input>
<modify-password class-name="User" event-id="AD-
Corp##11875d68b33##0" src-
dn="CN=XXXX,OU=XXXX,OU=XXXX,OU=XXXX,DC=XXXX,DC=XXX X,DC=XXX">
<association>811640c492511442aa12eac73516abd2</association>
<password><!-- content suppressed --></password>
</modify-password>
</input>
</nds>

If I remove the association, it fails again, but without the
<association> tag.

I don't have a lot of in depth experience with troubleshooting these
drivers, they just tend to work, so any help would be greatly appreciated.

Thanks much!
Patrick