filesBasedn is located in the ldap component definition and eclwatch service component definition.
For an environment, there should only be one place to define it.
Currently, when ldap is enabled on dali, it looks at at the ldap component for it's fillesBasedn definition.
<ldapSecurity authMethod="simple" filesDefaultPassword="6uVy23X7q/s95rWmnysuLg==" filesDefaultUser="daliuser" filesBasedn="ou=files,ou=dataland_ecl"
On the other hand, when looking at permission thru eclwatch, it looks to what the eclwatch service is configured to use, in this case
File Scopes ou=files,ou=ecl,dc=internal,dc=sds
In order to get permissions to work, these to locations must be configured identically, which is very easy to overlook and probably not intended.