Troubleshooting: Unable to Populate Groups in Role Based Access Control

Version Affected: 9.0.x
 
 

Overview

When creating a rule in Role Based Access Control (RBAC), the group fields return No results found even for a valid Active Directory (AD) group name, so groups never populate.

 

Cause

When migrating from an older IdP version to a newer one, the SecureAuth\Admin\WebConfig folder's web.config file can still reference a certificate, via its serverCertSN value, that no longer exists on the appliance. Because RBAC uses this certificate to authenticate its group lookup, an invalid reference causes the lookup to return no results, even for a valid group name.

The screenshot below shows the Create Rule screen's User Groups with Read and Write Permissions field returning No results found for a valid group name.

The screenshot below shows the SecureAuth\Admin\WebConfig folder's web.config file open in Notepad, with its serverCertSN value highlighted.

Resolution

Change the serverCertSN value in web.config to reference a personal certificate that is present on the IdP appliance. This resolves the group lookup so groups populate normally.

The screenshot below shows the same Create Rule screen after the fix, with the group name now returning a matching suggestion instead of No results found.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.