Version Affected: 24.4.5 and later (introduced by a Release Update, not the base 24.04 release)
Bug Number: EE-3941 (Password Throttling), EE-3832 (Multi-Factor Throttling)
Bug Status: Open — workaround only
Fixed in Version(s): Not yet fixed
Overview
After upgrading to 24.4.5 or later, authenticating into a realm that uses Password Throttling or Multi-Factor Throttling can fail with an LDAP exception when SecureAuth tries to save throttling data to user storage.
Cause
Starting in 24.04 (via a Release Update, not the base release), the realm's Data/Properties page added a profile field for both Password Throttling and Multi-Factor Throttling. Instead of carrying over the actual directory attribute used in earlier Identity Provider (IdP) versions — which is tied to an AUX ID field (for example, homepostaladdress for Password Throttling, or postalCode for Multi-Factor Throttling) — the new field's value contains the AUX ID field's own name instead (for example, AuxId1). Because that AUX ID name isn't a real directory attribute, saving throttling data fails with an LDAP exception.
Resolution / Workaround
This is a known defect — Password Throttling is tracked as EE-3941, Multi-Factor Throttling as EE-3832. Until a fix ships, work around it as follows:
- Go to the realm's Data/Properties page.
- Find the profile field for the throttling type you're using — Password Throttling or Multi-Factor Throttling.
- Replace the AUX ID value (for example, AuxId1) with the actual directory attribute that field should reference — homepostaladdress for Password Throttling, or postalCode for Multi-Factor Throttling.
- Save the change.
SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.
Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.
Comments
Please sign in to leave a comment.