Bug: Throttling Profile Field References the AUX ID Instead of the Property Attribute

Version Affected: 24.4.5 and 24.4.6 (introduced by a Release Update, not the base 24.04 release)
Bug Number: EE-3941 (Password Throttling), EE-3832 (Multi-Factor Throttling)
Bug Status: Closed - Fixed
Fixed in Version(s): 24.4.7 (Password Throttling and Multi-Factor Throttling)

 

Overview

After upgrading to 24.4.5 or later, authenticating into a realm that uses Password Throttling or Multi-Factor Throttling can fail with an LDAP exception when SecureAuth tries to save throttling data to user storage.

 

Cause

Starting in 24.04 (via a Release Update, not the base release), the realm's Data/Properties page added a profile field for both Password Throttling and Multi-Factor Throttling. Instead of carrying over the actual directory attribute used in earlier Identity Provider (IdP) versions — which is tied to an AUX ID field (for example, homepostaladdress for Password Throttling, or postalCode for Multi-Factor Throttling) — the new field's value contains the AUX ID field's own name instead (for example, AuxId1). Because that AUX ID name isn't a real directory attribute, saving throttling data fails with an LDAP exception.

 

Resolution / Workaround

Both issues are fixed in 24.4.7: Password Throttling (EE-3941) and Multi-Factor Throttling (EE-3832). Upgrade to 24.4.7 or later to resolve this issue.

If a realm's throttling fields were already changed by an earlier upgrade, upgrading to 24.4.7 does not change them back. Correct those fields as follows:

1. Go to the realm's Data/Properties page.
2. Find the profile field for the throttling type you're using — Password Throttling or Multi-Factor Throttling.
3. Replace the AUX ID value (for example, AuxId1) with the actual directory attribute that field should reference — homepostaladdress for Password Throttling, or postalCode for Multi-Factor Throttling.
4. Save the change.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.