Troubleshooting: OATH Seed Missing From the Help Desk Realm After a User's UPN Changes in AD

Version Affected: All
 
 

Overview

After a user's User Principal Name (UPN) is changed in Active Directory -- for example, as part of a migration -- their OATH seed can appear to be missing from the Help Desk realm, even though it's still present in the user's PostalAddress attribute in AD.

Cause

The realm's Data tab has its Search Attribute set to userPrincipalName.

SecureAuth uses this value to encrypt and decrypt the OATH seed. When the user's UPN changes, SecureAuth continues using the old UPN value until the user re-enrolls and provisions through the enrollment realm -- so it still has the old value, and fails to decrypt the seed correctly against the new UPN.

Resolution:

After updating a user's UPN in Active Directory, have that user re-enroll through the enrollment realm (the default enrollment realm is 998).


 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.