Version Affected: IdP - All versions
Description:
A small group of Users report they are unable to enroll for Time based passcodes and Push Notifications.
Warning log says Exception: LDAPProfileProvider.SetPropertyValues: Error received when saving data to user storage, exception: LDAPProfileProvider.SetPropertyValues: Got error when saving data to LDAP, exception: Access is denied.
Cause: Privileged accounts are protected in AD by AdminSDHolder
Resolution:
If you need to set granular permissions, the AD GUI does not handle this well. In the AD GUI, The permissions that apply to "This object and descendant" only shows you the wrong type of granular permissions, so if you correctly set this, you still cannot set the correct permission
Instead of using the GUI, open an Admin Command prompt and use dsacls to set the permissions.
Example:
dsacls "cn=AdminSDHolder,cn=System,dc=wood,dc=sasp,dc=local" /G "wood\norights:RPWP;audio;"
The above command will grant access to the service account (called norights) It grants read permission and write permission to the audio attribute on the AdminSDHolder account.
Special Considerations:
MS Active Directory periodically applies these permissions to your privileged accounts. If you cannot wait for this task to take place (up to an hour) you can re-apply the permissions directly on the privileged account to get this working straight away.
SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.
Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.
Comments
Please sign in to leave a comment.