OATH Seed is missing after UPN change in AD

SecureAuth IdP Versions Affected: All Versions

Description: Some Users have had their UPN changed as part of a migration activity. After changing UPN from AD side , OATH seed is there in PostalAddress attribute in AD but not able to see it in SecureAuth helpdesk realm. 

Cause: The value of  search attribute under Data tab is set to "userPrincipalName". This means the User has effectively changed. SecureAuth uses this value for encryption/decryption but this value does not get updated until the next time user enrolls and provisions through the enrollment realm (Default 998) so SecureAuth still has the old value and fails to decrypt the Seed correctly

Resolution: After updating the UPN from AD side, these Users will have to re-enroll through the enrolment realm.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.
Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.