Zurück
-
Titel
A UID conflict message is displayed for an Active Directory user even when the UID is only allocated to a single user -
Beschreibung
A UID conflict message is displayed for an Active Directory user even when the UID is only allocated to a single user
A 'vastool user checkaccess <username>' command shows the following UID conflict message:DENIED (User has a UID conflict) [user=user01] [service=(any)]However the following command used to check for a UID conflict shows that only one user has this UID:# /opt/quest/libexec/vas/sqlite3 /var/opt/quest/vas/vasd/vas_ident.vdb 'select * from user_posix where uidNumber like "1234"'Where 1234 in this example is the UID of the user.
Note that the same user will be shown twice in the output. -
Ursache
The QAS cache file does show duplicate entries for the account in question even though there is no duplicate in AD. This issue may be caused by accounts that have been deleted in AD and then recreated again.
-
Lösung
If using a version of Authentication services prior to 4.1.2.23060 then this is a known defect:
-------------------------------------------------------------------------------Defect 717481* vasd: Move uid conflict code to checking the pwent table.-------------------------------------------------------------------------------
Upgrade to a more recent version of Authentication services containing the defect fix in order to avoid these false UID conflict messages.
The latest version of Authentication services can be downloaded from the following link:
https://support.oneidentity.com/authentication-services
If you are unable to upgrade, this command can also be used to remove the duplicate entries from the QAS cache file:
# printf '.timeout 5000\ndelete from user_posix where userkey not in (select userkey from user_ad);\n' | /opt/quest/libexec/vas/sqlite3 -header /var/opt/quest/vas/vasd/vas_ident.vdb
Essentially this command will look for user_posix entries without a corresponding user_ad entry and delete them. -
Änderungsanforderung
717481