Cannot register new users - 'Network Operation did not complete in a reasonable time'

HCL Domino Domino Forum
1

Suddenly after running for about 10 years through versions of Domino, we can no longer register new users on our domain. All the Admin clients we try say “FAILED: Network Operation did not complete in a reasonable amount of time: please retry”. All other activity on the server is normal. The server we have always used as the Registration Server is corectly referenced in the ‘Register Person’ dialogue in the Domino Administrator.

Is there any “Registration” service or parameter of some kind that needs to specifically running on the nominated Registration server?

This started happening last week after we tried to build a Websphere Portal server and enabled DIIOP and LDAP on the same Domino server that we are using as the Registration Server. Could this be a co-incidence?

Our server uses Site documents and we have made a site document for DIIOP and LDAP both of which appear to work correctly.

We can run the Admin client properly and can ‘see’ all the normal services and functions in that client.

Could this be a problem with a wrongly declared User ‘Role’ perhaps? We’ve recently put our Administrators into an ‘Administrators’ group instead of listing them individually in the Security section.

As of now though, ‘Administrators’ can’t register any new users - which is causing us a serious problem.

David Clover

==========================

IT Manager

Mathematics and Computing Faculty

The Open University

Milton Keynes

MK7 6AA

Tel: +44 (0)1908-653529

2

Subject: Cannot register new users - ‘Network Operation did not complete in a reasonable time’

During registratin try creating user mailfile in background

3

Subject: Cannot register new users - ‘Network Operation did not complete in a reasonable time’

David, Sounds like you have made lots of changes in a short period of time. Try taking one of the administrators out of the Administratyors group, listing them seperately in the Administrators field of the registration server doc. Try to create a new user ? What happens?

I am not aware of any “Special Task” which neds to be run on the registration server.

Does your Administrators group have the correct access and roles to the Domino Directory?

4

Subject: Cannot register new users - ‘Network Operation did not complete in a reasonable time’

OK - with some lateral thinking and a prompt from IBM in Mainz, we have discovered the problem - and it’s a bit weird. Here’s the story for the LDD record - we don’t have a full solution yet though.

Description

=======

  1. System:

Windows 2003 Server - version 5.2 (Build 3790.srv03_sp1_rtm.050324-1447 : Service Pack 1)

Running Lotus Domino 7.0.2 Enterprise (no Sametime) We have a DA connection to a standard Active Directory 2003 schema LDAP directory.

  1. Problem

We cannot any longer register new users using the Registration Process against MCS-Notes1 on the Admin Client or using CA on the Web Client.

  1. Error messages

Attempts to do so on the Webadmin client with CA result in this message:

Webadmin Client: FAILED: Notes error: Directory Assistance has detected an unavailable replica, retry NAMELookup (UserName)

Attempts to do so on the Notes Admin client result in this different message:

FAILED: Network operation did not complete in a reasonable amount of time : please retry

(We do indeed have Directory Assistance running - but this has never previously caused us a problem with registration.)

Temporary Resolution

==============

The Directory Assistance (DA) linkage is working fine - and login requests are being correctly passed through to Windows 2003 Active Directory (AD) when we login using an AD username via the web and logins using a Notes/Domino domain name are being separately and correctly honoured via the Notes/Domino directory.

However, the issue is that when we register a new Lotus Notes user in the Domino Directory (using our Notes IDs as Administrators and the Cert.ID or CA process), we don’t want any interaction at all with the central Windows 2003 Active Directory via LDAP - we only want to work with the local Notes/Domino Directory at that point.

What I did as an experiment was to completely remove the LDAP link to the AD’s DA by removing the ‘da.nsf’ entry in the Notes Directory under the “Directory assistance database name:” entry in the server document - and as a result we can now register new users in the Domino Directory just fine.

But this is a changed and unwelcome behaviour. We need to find a setting we can apply in the Domino Directory which will ensure that any attempts to register a new user are NOT passed by DA to the AD LDAP server (which in our environment can’t deal with them anyway) so that they are only processed locally by Domino.

We had a very similar issue with SMTP inbound email to the same server a while ago (there’s an entry in LDD about it under my name too) - the DA LDAP lookup to AD was trying to find an MS Exchange mailbox to deliver instead of a Domino one - which we resolved then by changing this entry:

[Configuration][Router/SMTP][Advanced][Controls][Restrict name lookups to primary directory only][Enabled]

What we infer is that a recent change in the Windows 2003 AD as published to DA by LDAP returns some artefact when we try to register a new user - which makes no sense to the Domino Registration process - so it simply times out. But we never (in our system) want to interact with the Windows 2003 AD when registering a new Notes user.

Advice on Directory settings to solve this impasse would be extremely helpful - as we do need to reinstate the DA to allow Active Directory pass-through authentications for web applications.

David Clover

==========================

IT Manager

Mathematics and Computing Faculty

The Open University

Milton Keynes

MK7 6AA

Tel: +44 1908-653529