Troubleshooting: Error Received When Saving Data to LDAP (Access is Denied)

Version Affected: All
 
 

Overview

A SecureAuth realm configured with a writable Lightweight Directory Access Protocol (LDAP) attribute shows, or logs, the error "LDAPProfileProvider.SetPropertyValues: Error received when saving data to LDAP, exception: Access is denied" when it tries to write a value back to Active Directory (AD).

 

Cause

The service account the realm uses to connect to AD does not have write permission to the specific attribute the realm is configured to write to. For example, the SecureAuth998 realm writes to the registeredAddress or postalAddress attribute by default for OATH enrollment; other realms may write to the audio attribute for Device Fingerprinting, or the photo attribute for Geo Velocity and Access Histories. If the service account lacks write permission to whichever attribute is involved, AD returns Access is Denied and the realm logs or displays this error.

Resolution

Grant the service account write permission to the specific attribute the realm is configured to use, then retry the action that produced the error.
 
 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.