# Could not create user: Error creating subcontext

**URL:** <https://forum.keycloak.org/t/could-not-create-user-error-creating-subcontext/607>\
**Category:** Configuring the server\
**Tags:** admin-console\
**Created:** [December 4, 2019, 8:57pm UTC](https://forum.keycloak.org/t/could-not-create-user-error-creating-subcontext/607 "2019-12-04T20:57:10Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![JamesH](https://avatars.discourse-cdn.com/v4/letter/j/3d9bf3/32.png) [@JamesH](https://forum.keycloak.org/u/JamesH)\
**Post date:** [December 4, 2019, 8:57pm UTC](https://forum.keycloak.org/t/could-not-create-user-error-creating-subcontext/607/1 "2019-12-04T20:57:11Z")

</div>

Hi there,

I’ve been trying to setup keycloak to interact with an oldap database. Currently we have it connected to the database through federation, it syncs users from the db fine but when we try to add a user we get the following error:

keycloak standalone.sh[1121]: 20:40:41,359 WARN [org.keycloak.services.resources.admin.UsersResource] (default task-98) Could not create user: org.keycloak.models.ModelException: Error creating subcontext [cn=james.hastings,ou=People,dc=domain,dc=com]

(domain is replaced with our domain, everything else is as is)

Further down the line in the server.log, we see another error well, although this may be caused by above:

Caused by: javax.naming.directory.InvalidAttributeValueException: [LDAP: error code 21 - objectclass: value #0 invalid per syntax]; remaining name ‘cn=james.hastings,ou=People,dc=domain,dc=com’

Any help in understanding why this is occurring would be greatly appreciated, and I will provide any additional information needed.

We have the following attributes on the federation settings:  
priority: 0  
import users: on  
edit mode: writable  
sync registration: on  
vendor: other  
username LDAP attribute: cn  
RDN LDAP attribute: cn  
UUID LDAP attribute: entryUUID  
UserObjectClasses: \*  
Bind Type: Simple  
Enable StartTLS: Off (for now)  
Search Scope: One Level  
Use Truststore SPI: Only for ldaps  
Connection Pooling: On  
Pagination: On

connection and authentication both succeed

---

<div class="post-metadata">

**Author:** ![Sheppy](https://avatars.discourse-cdn.com/v4/letter/s/9f8e36/32.png) [@Sheppy](https://forum.keycloak.org/u/Sheppy)\
**Post date:** [January 12, 2023, 2:47pm UTC](https://forum.keycloak.org/t/could-not-create-user-error-creating-subcontext/607/2 "2023-01-12T14:47:10Z")

</div>

Did you ever understand the problem in the years since then?