Symantec IGA

 View Only
  • 1.  Unable to login to IDM User Console

    Posted Jan 22, 2020 10:56 AM
    Short Summary:  We migrated data to the virtual appliance recently.  We have about 12 custom attributes we were required to keep.  The directory xml was updated with these attributes as was the schema for CA Directory.  We placed all the custom attributes under a custom object class in im_user_aux.dxc.

    The problem is, when the directory xml for the user store is updated as below, we cannot login to the IDM user console.

    <ImsManagedObject name="User" description="My Users" objectclass="imUser,imUserAux" pagesize="0" maxrows="0" objecttype="USER">

    The issue is with the search being sent out, to be exact, the filter.  This is the search being sent in the server.log while in debug mode:

    2020-01-21 16:57:13,094 DEBUG [ims.llsdk.directory.jndi] (default task-69) findObjectByFriendlyName using filter: (&(uid=imadmin)(&(objectclass=imUser)(objectclass=imUserAux))) and base DN ou=im,ou=ca,o=com

    This is the search that comes in on the directory:

    [8] 20200121.142542.583 144.2 SEARCH dn="ou=im,ou=ca,o=com" scope=subtree filter=(&(imLoginId=imadmin)(&(1.1=^E\00)(objectClass=imUserAux))) eis=imLoginId uid imPasswordData imEnabledState source="client"
    [5] 20200121.142542.583 144.2 RESULT success 0 entries 0 msecs

    Of course there is no match for the filter as the imUser object class filter is all garbled.

    I can send the search from the command line with no issue:

    -bash-3.2$ ldapsearch -T1 -h ec24az4532-91 -p 19289 -D "cn=dsaadmin,ou=im,ou=ca,o=com" -b "ou=im,ou=ca,o=com" "(&(imLoginId=imadmin)(&(objectClass=imUser)(objectClass=imUserAux)))" dn
    Enter bind password:
    dn: cn=imadmin,ou=people,ou=im,ou=ca,o=com

    If we remove the imUserAux object class from the directory xml, the issue is resolved but now user objects get created with only the imUser object class and as a result, we cannot add custom attributes.

    Has anyone seen this issue before?  Is this a known bug?




  • 2.  RE: Unable to login to IDM User Console

    Broadcom Employee
    Posted Jan 22, 2020 11:44 AM
    Hi Sam,

    This might due to user store attribute imUserAux might not be configured properly.  Can you verify if CA directory ( assume) has this setup correctly?

    Best regards,
    Frank


    ------------------------------
    ------------------------------
    And, as always Perhaps there are others in the communities who have experience in doing this and we invite them to comment here also.
    Another option may be to reach out to our partner HCL Technologies to see in what way they can assist further. The Enterprise Studio team of HCL can be reached at enterprisestudio@hcl.com. https://www.hcltech.com/enterprise-studio
    ------------------------------



  • 3.  RE: Unable to login to IDM User Console

    Posted Jan 22, 2020 02:08 PM
    Looks good to me but you would really need to expand on what could be configured incorrectly.  as mentioned in my post above, I can do the search on the command line using both object classes and it succeeds in finding the entry.  To expand on this, both ldap searches are the exact same but the one IDM sends, does not get to CA directory the same way and as a result, fails.  The object class is configured as so...

    schema set object-class im-UUA-oc:0 = {
    name = imUserAux
    ldap-names = imUserAux
    subclass-of imUser
    kind = auxiliary
    may-contain
    [bunch of attributes]
    };



  • 4.  RE: Unable to login to IDM User Console
    Best Answer

    Broadcom Employee
    Posted Jan 22, 2020 02:46 PM

    Hi Samuel,

    That post sheds some light on the problem. Your imUserAux objectclass cannot be a subclass of imUser. That makes it structural. It needs to be just kind = auxiliary. Please remove the subclass-of line and see if the problem persists.



    ------------------------------
    Thanks,
    Jeremy
    ------------------------------



  • 5.  RE: Unable to login to IDM User Console

    Broadcom Employee
    Posted Jan 22, 2020 03:04 PM
    Hi,

    Jeremy is right, an auxiliary class should not be a subclass of a structural one, therefore, it should be defined as subclass-of = top, however i doubt it will be enough to fix Samuel's issue, happy to be wrong :)

    In addition, i would change a little bit the definition of the directory.xml as follows

    - Make sure that imUserAux is not defined as objectClass in the following line (only structural class-es should be listed here)

    <ImsManagedObject name="User" description="My Users" objectclass="imUser" pagesize="0" maxrows="0" objecttype="USER">

    - when you define an attribute that is part of your auxiliary class, specify objectClass=auxclassname at the attribute definition level e.g.

    <ImsManagedObjectAttr physicalname="actualattrnamedefinedinimUserAux" objectclass="imUserAux" description="custom attrtibute from imUserAux" displayname="CustomAttr1" valuetype="String" maxlength="0"/>

    Once done, import the xml file. Doing this way, you should be able to login and also manage attributes from your auxiliary class

    HTH


  • 6.  RE: Unable to login to IDM User Console

    Posted Jan 22, 2020 03:10 PM

    Jeremy,

    That was the problem, leaving it as a aux class fixed the ldap filter.  interesting that the search would go out with a contained error as the filter.

    imUser is a structural OC, correct?  Am i understanding it correctly when I say, a structural class cannot subclass a aux class.

    Regardless, I appreciate your help.  Take tomorrow off as a reward!

    Ty.




  • 7.  RE: Unable to login to IDM User Console

    Broadcom Employee
    Posted Jan 22, 2020 04:32 PM
    No problem! I had ran into this issue just a month back. I will double check we updated the examples in the docs (I thought we did at the time).

    You are correct, imUser is a structural objectclass and inherits attributes from the parent objectclasses, hierarchical all the way back to "top".  imUserAux was intended to be an auxiliary class, which can be added to any existing object and permits your new custom attributes.

    ------------------------------
    Thanks,
    Jeremy
    ------------------------------