iDRAC10: Unable to Log in with Directory Service Accounts

The user is unable to log in to iDRAC10 using Directory Service integrated account with the error message:

• "RAC0212"

Or

• "RAC0506"

• "The same Directory Service integration configuration is working on iDRAC9 systems."

The Directory Service "Test" feature shows "Filter Compile Error" at UserSearch or User Authorization as failed. 

      [20:17:38]: "Dial" Performed. Result: "Dial success" LDAP URL: "ldap://dcfqdn:389" 
      [20:17:38]: "Bind" Performed. Result: "Bind success" Bind User: "test.user@example.com" 
      [20:17:38]: "UserSearch" Performed. Result: "Filter Compile Error, Err: LDAP Result Code 201 "Filter Compile Error": ldap: invalid characters for escape in filter: encoding/hex: invalid byte: U+002C ','" 

In iDRAC10, the LDAP queries are built based on object attributes returned from pervious search. If the result contains LDAP special characters in the "cn" or "distinguishedName" they do not get properly escaped.

Offending characters include "," "(" ")" ".".

/* User Search */
        "attribute_list": [
            "cn",
            "samaccountname",
            "sn",
            "userPrincipalName",
            "objectGUID",
            "objectSid",
            "sAMAccountName",
            "mail",
            "userAccountControl",
            "msDS-UserPasswordExpiryTimeComputed"
        ]

/* Group Search */
        "attribute_list": [
            "cn",
            "distinguishedName",
            "groupType",
            "objectClass",
            "objectSid",
            "sAMAccountName"
        ]

This behavior is addressed in the upcoming iDRAC10 Firmware release 1.20.80.50.