Troubleshooting: User/Group Restriction Hard-Stops Login for Allowed Accounts (Missing Groups Mapping)

Version Affected: All
 
 

Overview

Login is hard-stopped for every account attempting to log in to a realm — including accounts that belong to the group the realm's User/Group Restriction is configured to allow.

Cause

The Profile Provider cannot pull a user's group name because the Groups field on the realm's Data tab isn't mapped to an attribute. The Debug log shows an entry similar to:

LDAPProfileProvider.GetDataFromLDAPDS: no group to filter is defined or group field not defined

Resolution:

1. Open the Admin Console and go to the Data tab of the affected realm.
2. Map the Groups field to the memberOf attribute.
3. Save the settings.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.