Defender 5.9.3 - Administration Guide

If users are experiencing problems authenticating via Defender, there are a number of possible causes, ranging from VPN issues through to individual token failures. To help identify the cause, the information below is useful to collect and send to One Identity Software Support, providing important contextual and diagnostic information.

Step 1: Gather required information

Appendices > Appendix B: Troubleshooting common authentication issues > Step 1: Gather required information

Step 1: Gather required information

Answers to the following questions can help you get the required information about the authentication issues:

What error message is the user receiving? Ask the user to provide the full error message text (make a screenshot).
How many users are affected? The total number of Defender users is also useful to put into context.
Were the affected users working previously? If so, when?
What token types are the affected users using?
What Defender Security Server version and platform are being used?
When did the issue start occurring? It is useful to have a time approximation to help match up with the logs.
Have any changes been made recently? For example to any Defender components, Active Directory, VPN server, or network.

Obtain the log files from the following location on the Defender Security Server:

%ProgramFiles%\One Identity\Defender\Security Server\Logs

Additionally, obtain user IDs of several affected users. These are required to locate information related to the affected users in the Defender log files. Make sure to obtain the user IDs, not the user names.

Step 2: Analyze Defender Security Server log

Appendices > Appendix B: Troubleshooting common authentication issues > Step 2: Analyze Defender Security Server log

Step 2: Analyze Defender Security Server log

The default location for the Defender Security Server log files is %ProgramFiles%\One Identity\Defender\Security Server\Logs.

To analyse the Defender Security Server log files, take the following actions:

Locate an affected user in the Defender Security Server log files by searching for the user’s ID. Each request received by the Defender Security Server is recorded in the log files. The example log messages in this section show records for a user whose user ID is testuser.
If the user ID cannot be found in the log, then verify that any deployed VPN servers are functioning correctly. The log message shown below would be seen for each request received by Defender regardless of whether or not it was successful.
<Time> Radius request: Access-Request for <User Id> from <Client IP> through NAS:<Access Node Name> Request ID: <N/A> Session ID: <Unique Session ID>
Using the Unique Session ID, cycle through the log messages associated with the user’s session. For example a successful session will look like this:

Tue 18 Aug 2009 11:57:10 Radius Request from 192.168.10.106:2951 Request ID: 31 Tue 18 Aug 2009 11:57:10 Radius request: Access-Request for testuser from 192.100.10.106:2951 through NAS:WebMail Request ID: 31 Session ID: 8A89040F Tue 18 Aug 2009 11:57:10 User testuser authenticated with Active Directory Password Session ID:8A89040F Tue 18 Aug 2009 11:57:10 Radius response: Authentication Acknowledged User-Name: testuser, Request ID: 31 Session ID: 8A89040F

Locate the relevant error message reason in the table below and take the recommended actions.

Table 37:
Reasons Defender Security Server log error messages
Message	Meaning	Recommended actions
`Reason: Invalid response` `Radius response: Authentication rejected` `User-Name: testuser`	Incorrect token response.	Verify the correct response is being entered. Check the response in the administration console. Check if PIN configured for user.
`Reason: Account locked out due to invalid attempts` `Radius response: Authentication Rejected` `User-Name: testuser`	User’s account is locked in Defender.	Use the Defender Administration Console to reset violation count for the user.
`Reason: Invalid password` `Radius response: Authentication Rejected` `User-Name: testuser`	Incorrect Active Directory password.	Verify the correct password is being entered.
`authentication abandoned user testuser`	Session timed out while waiting for user response.	Verify connectivity between the client and the Defender Security Server on the configured RADIUS port.
`Reason: User not valid for this route` Radius response: Authentication Rejected User-Name: testuser	This message can be caused by one of the following: User is not a member of the Access Node. User does not have a token. User is not a Defender user. There is no license available for the user. Client IP not permitted by the Access Node.	Verify the members of the Access Node. Verify the user has a Defender token assigned. Verify that suitable licenses exist. Verify the IP.
`Domain Search from CN=testuser,CN=Users,DC=child,DC=democor p,DC=local took 57 seconds` `LDAP` `failed (-1)finding user testuser`	Active Directory search has failed. This can happen if, for example, the child domain is unavailable.	Verify that the Defender service account has sufficient permissions or is a member of the Domain Administrators group.
`LDAP failed (50) writing token data for CN=PDWIN1348400003,OU=Tokens,OU=Defender,DC=democorp,DC=local` `Failed to write token data to LDAP`	The Defender service account does not have sufficient permissions in Active Directory to update the user’s token information.	Verify that the Defender service account has sufficient permissions or is a member of the Domain Administrators group.

Step 3: Gather further diagnostics

Appendices > Appendix B: Troubleshooting common authentication issues > Step 3: Gather further diagnostics

Step 3: Gather further diagnostics

If Step 1: Gather required information and Step 2: Analyze Defender Security Server log have not resolved the issue, further diagnostics may be required, including collecting environmental details and tracing. Contact One Identity Support for advice on how to enable tracing. You will need to provide the version number of the Defender Administration Console and Defender Security Server you are using. Normally, you can find the Defender trace files in the following location: %ProgramData%\One Identity\Diagnostics.

Documentos relacionados