Unable to access created user INTO AD

I am trying to create user into Active directory using spring boot, user is gettting created but I am unable to access that created user. User creation code is as below:

protected void createUsersAD(String userName, String orgName){
		Name dn = buildUserDnn(userName);
		DirContextAdapter context = new DirContextAdapter(dn);

		context.setAttributeValues("objectclass",
				new String[] { "top", "person", "organizationalPerson", "inetOrgPerson" });
		context.setAttributeValue("cn", userName);
		if (orgName != "")
			context.setAttributeValue("ou", orgName);
		context.setAttributeValue("givenName",userName);
		context.setAttributeValue("displayName", userName);
		context.setAttributeValue("name", userName);		
		context.setAttributeValue("userPrincipalName",userName+"@"+config.getDomainName());
		String newQuotedPassword = "\"" + password + "\"";
		byte[] newUnicodePassword = newQuotedPassword.getBytes("UTF-16LE");
		context.setAttributeValue("unicodePwd",newUnicodePassword);
		//context.setAttributeValue("userAccountControl", Integer.toString(512));
		//context.setAttributeValue("sAMAccountName", userName);
		ldapTemplate.bind(context);
		LOGGER.debug("User created successfully INTO AD.");
	}

With the same code i am able to create user into LDAP and able to access that user as well.

When I compaired user, I observed that userAccessControl is getting set as 546 which means (a value of 546 (decimal) is 0x222 hex and means: normal account, disabled, password not required.)

I tried to set value of userAccountControl but getting an error:

> EXCEPTION======org.springframework.ldap.OperationNotSupportedException: [LDAP: error code 53 - 0000052D: SvcErr: DSID-031A1236, problem 5003 (WILL_NOT_PERFORM), data 0

Getting an error:

2020-10-05 19:10:26.167 DEBUG 12304 --- [o-auto-1-exec-4] c.a.c.security.JwtAuthenticationFilter   :  JwtAuthenticationFilter  attemptAuthentication authenticationToken com.atos.config.security.SelfServiceUserPasswordAuthToken@e3ac519c: Principal: cucumber_customer_admin_multi; Credentials: [PROTECTED]; Authenticated: false; Details: null; Not granted any authorities
2020-10-05 19:10:26.167 DEBUG 12304 --- [o-auto-1-exec-4] c.a.c.security.JwtAuthenticationFilter   :  JwtAuthenticationFilter  authenticationManager used class com.atos.config.security.SelfServiceAuthenticationManager
2020-10-05 19:10:26.168  INFO 12304 --- [o-auto-1-exec-4] c.a.c.s.SelfServiceAuthenticationManager : authenticate called 
2020-10-05 19:10:26.169 DEBUG 12304 --- [o-auto-1-exec-4] ctiveDirectoryLdapAuthenticationProvider : Processing authentication request for user: cucumber_customer_admin_multi
2020-10-05 19:10:26.450 DEBUG 12304 --- [o-auto-1-exec-4] ctiveDirectoryLdapAuthenticationProvider : Authentication for cucumber_customer_admin_multi@amosonline.io failed:javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C090436, comment: AcceptSecurityContext error, data 52e, v4563

In my (short) experience with Active Directory via LDAP, the "DSID-031A1236" code means that there is a problem with your LDAPS (LDAP over SSL / TLS) configuration. Changing AD passwords via LDAP requires LDAPS.

The LDAP error message is not useful ("DSID-031A1236"???), can be confusing ("problem 5003" refers to password policy constraints, which is not the case) and even bratty ("WILL_NOT_PERFORM", NO NO NO!), but the couple of times that I've met this specific error the solution always was related to SSL: an invalid certificate, a network load balancer "posing" as SSL but rerouting to plain LDAP ports, etc.

If you need to make changes to the AD server, there is some documentation about may be useful at https://social.technet.microsoft.com/wiki/contents/articles/2980.ldap-over-ssl-ldaps-certificate.aspx