Environment
NetIQ eDirectory 8.8.8
NetIQ iManager 2.7.7
NetIQ iManager 2.7.7
Situation
iManager reports the following error when trying to save the modification to an object:
NDS Error -608
(Error -608) An attempt was made to add a property that is illegal to an object. The NetWare Directory Services schema determines what properties can be inherited by an object class.
This error can be given modifying perfectly valid attributes, like resetting a password or editing a user's description.
There is no -608 error in Replica Synchronization (for -608 errors in replica sync, check KB 7007197)
Resolution
When an object is edited and information is changed, eDirectory validates first the attributes present in the object before writing the newly added information. In case it finds problems with the object being edited, it will report the error and abort the modification operation.
If the information being modified is not causing the problem or if the error is given when modifying different attributes, it's likely that the object has an optional attribute present that is not defined as an optional attribute in the schema definition of any of the Object Classes that the object has defined. This could happen because one of these definitions has recently changed or because the object no longer has one class assigned that it used to have.
In order to check which attribute is causing the problem, navigate to the object with iMonitor, look at the entry information and select there the option "Validate entry" from the menu in the left panel. This performs a similar check on the object as the one being performed by eDirectory. If the problem is present on the object that is being edited, it will also mention the -608 error and it will specify which attribute is causing the -608 error. With that information, an action can be taken. It could be that it's necessary to add an extra object class to the object or that this attribute needs to be added to an existing object class. If the information is not necessary, it should be possible to use iManager or an LDIF file to delete this attribute from the entries that have it.