Siebel CRM Master Error Catalog (Part 8): Assignment Manager Rules & Security / LDAP Authentication (SBL-EXL-*, SBL-SEC-*)

Part 8: Assignment Manager & Security / Authentication

Comprehensive Scenario Analysis: Territory Assignment Rules, Position Candidate Matching, LDAP / Active Directory SSO, Database Authentication, and Data Encryption Keys.
Key Prefixes: SBL-EXL-*****, SBL-SEC-*****

SBL-EXL-00120: Assignment Engine Evaluation Timeout ASSIGNMENT ENGINE

Scenario A: Excessive Candidate Rules Processing (Cartesian Evaluation)

An Assignment Manager task (`AsgnSrvr` / `AsgnBatch`) evaluates thousands of complex assignment rules without indexed criteria, causing processing timeouts on high-volume object tables (e.g., `S_ORG_EXT`).

Resolution: Optimize Assignment Rules in Administration - Assignment -> Assignment Rules. Group rules into distinct Assignment Rule Groups, enable rule caching, and restrict candidate positions evaluated per rule.

Scenario B: Real-Time Dynamic Assignment Invocation Hangs UI

Synchronous assignment execution (`AssignObjects` business service) triggered during web user record save operations exceeds Object Manager HTTP request timeout limits.

Resolution: Offload dynamic assignment to background asynchronous requests using Workflow Policies or dispatch background jobs to `AsgnSrvr` via Server Request Broker.

Scenario C: Unindexed Wildcard Match Criteria in Assignment Attributes

Assignment criteria configured with wildcard operators (`LIKE "*string*"`) force the Assignment Engine to execute full table scans on assignment attribute tables.

Resolution: Replace wildcard string comparisons with explicit value lists or range comparisons. Ensure custom database indexes (`X_` indexes) exist on assignment attribute columns.

Scenario D: Memory Leak in AsgnSrvr Thread Pool

The multi-threaded Assignment Server process (`AsgnSrvr`) consumes excessive process heap memory during prolonged batch processing, leading to thread execution timeouts.

Resolution: Configure process recycling parameters in Server Manager: set MaxTasks and Recycle Process = TRUE for `AsgnSrvr` component to refresh threads periodically.

SBL-SEC-10007: LDAP / Active Directory User Authentication Failed LDAP / SECURITY

Scenario A: Service Account Credentials Expired for LDAP Bind

The Siebel Security Adapter cannot query the Directory Server because the service account specified in `LDAPSystemDN` has an expired password or locked account status.

Resolution: Update service account password in Active Directory. Re-encrypt and update `LDAPSystemPassword` parameter in Enterprise Security Profile using Server Manager or SMC console.

Scenario B: User DN Search Path / Base DN Misconfiguration

User authentication fails because the user account resides in an Organizational Unit (OU) outside the search tree configured in parameter `BaseDN` or `UserDN`.

Resolution: Expand `BaseDN` in Security Adapter settings (e.g., DC=enterprise,DC=com) or set `Scope = SUBTREE` to search all nested Active Directory OUs.

Scenario C: Missing User Mapping Record in Siebel Database (`S_USER`)

The user successfully authenticates against LDAP / AD, but the login fails because no matching database user record exists in `S_USER` / `S_PARTY` with matching `LOGIN` name.

Resolution: Create user record in Administration - User -> Employees or enable automatic user provisioning (`Auto User Create = TRUE`) in Security Adapter profile.

Scenario D: LDAPS Port 636 TLS/SSL Certificate Trust Failure

Encrypted LDAP connection (`ldaps://`) fails during TLS handshake because the Domain Controller's Root CA certificate is missing from Siebel TrustStore.

Resolution: Import Active Directory Domain Controller Root CA certificate into Siebel Application Interface and Gateway Security TrustStore using Java `keytool`.

SBL-SEC-10018: Encryption Key Mismatch / Decryption Error DATA ENCRYPTION

Scenario A: Mismatched Key File (`keyfile.bin`) Across Nodes

An Object Manager instance attempts to decrypt sensitive database columns (e.g., credit cards or passwords) using a local key file that differs from the key file used to encrypt the data.

Resolution: Synchronize the master key file (`keyfile.bin`) across all Siebel Server and Gateway nodes in siebsrvr/admin/ directory.

Scenario B: AES / RSA Encryption Subsystem Upgrade Misconfiguration

Upgrading column encryption algorithms (e.g., RC4 to AES-256) renders existing encrypted database records unreadable prior to re-encryption utility run.

Resolution: Execute the `sieb256` / `siebel_encrypt` database utility to batch re-encrypt existing database table columns using the new encryption key profile.

Scenario C: Corrupted Password Parameter in Configuration File

Encrypted DB passwords stored in `.cfg` or Gateway registry become corrupted during manual configuration file edits.

Resolution: Regenerate encrypted password strings using `siebenc` command line tool and re-populate configuration settings.

Scenario D: SSL/TLS Security Level Mismatch on SISNAPI Socket

Server node configured with `EncryptionType = AES256` rejects incoming network socket connections from web servers configured with lower security levels.

Resolution: Align `EncryptionType` parameters identically across Enterprise, Server, and Application Interface profiles in Siebel Management Console (SMC).

SBL-EXL-00105: Candidate Rule Loading Failure ASSIGNMENT RULES

Scenario A: Unreleased / Inactive Assignment Rule in Memory

Assignment Manager attempts to execute rules that were modified in UI but never released via the `Release` button in Administration - Assignment.

Resolution: Navigate to Administration - Assignment -> Assignment Rules. Select the modified rule group and click Release to update rule definitions in runtime cache.

Scenario B: Corrupted Rule Engine Cache File (`rulecache.dat`)

The compiled rule binary cache file (`rulecache.dat`) stored in `siebsrvr/bin` is corrupted or out of sync across cluster nodes.

Resolution: Stop Assignment Server. Delete `rulecache.dat` from siebsrvr/bin/ directory and restart `AsgnSrvr` component to force clean cache rebuild.

Scenario C: Missing Employee / Position Candidate Mapping

An Assignment Rule passes filter criteria but yields zero assigned candidates because candidate positions/employees were deleted or inactivated in system.

Resolution: Verify candidate position status in Administration - Assignment -> Assignment Rules -> Position Candidates. Replace inactive positions.

Scenario D: Invalid Dynamic Candidate Assignment Object Link

Dynamic candidate rules fail to load because the target Assignment Object lacks required candidate team Business Component definitions in Siebel Tools.

Resolution: Check Assignment Object properties in Web Tools. Ensure `Candidate Team Business Component` and `Candidate Position Column` mappings are valid.

SBL-SEC-10005: User Authorization / Responsibility Denied RESPONSIBILITY / ACCESS

Scenario A: Target View Not Assigned to Active Responsibility

A user attempts to navigate to a View (or execute an API mapped to a View), but none of their assigned Responsibilities grant access to that View.

Resolution: Add the target View to user's assigned Responsibility in Administration - Application -> Responsibilities -> Views.

Scenario B: Responsibility Tab Layout / Web Hierarchy Inactive

User has Responsibility access to a View, but the parent Screen or Application Tab is set to `Inactive = TRUE` in repository for their active Application profile.

Resolution: Verify Screen and Page Tab assignments in Siebel Tools / Web Tools for the active Application object (e.g., `Siebel Financial Services`).

Scenario C: Primary Position / Organization Context Missing

User logs in successfully but receives access errors because their Employee record lacks a designated `Primary Position` or `Primary Organization`.

Resolution: Navigate to Administration - User -> Employees. Assign a valid Primary Position and Primary Organization to the employee.

Scenario D: Delegated Administration Group Restriction Filter

Delegated administrators attempt to assign responsibilities or views outside their delegated organization boundary.

Resolution: Verify Delegated Administration scope in Administration - User -> User Delegation and ensure administrator has authority over target responsibility.