-
Title
Linked accounts are removed after upgrade when "Automatically Link Managed Directory Accounts" option is enabled on directory user groups -
Description
Linked accounts are removed after upgrade of SPP to 8.0.2 LTS or 8.2.x or higher when Directory User Groups have the option "Automatically Link Managed Directory Accounts" enabled.
When "Automatically Link Managed Directory Accounts" option is enabled, SPP will sync linked accounts from Active Directory based on the value of the Managed Object attribute of the directory user.
- The Managed Object attribute is configurable under Appliance Management > Safeguard Access > Identity and authentication > Active Directory Provider > Attributes tab > Managed Objects field > {attribute name}
- If there are no linked accounts configured in Active Directory for users and the option is enabled, SPP will overwrite any manually linked accounts, in this case the list will be empty.
- If linked accounts are configured in Active Directory for users and the option is enabled, SPP will overwrite any manually linked accounts with the linked accounts that are configured in Active Directory.
In order to keep linked account assignments that were set manually, the option "Automatically Link Managed Directory Accounts" should be disabled for the Directory User Group in SPP.
-
Cause
SPP is configured to automatically link managed directory accounts, but linked accounts are also being maintained manually in SPP. During directory sync, SPP overwrites manual assignments. In addition, using an incorrect Managed Objects attribute configuration may result in incorrect linked accounts. -
Resolution
Use only one management method:
- AD-driven linking: keep automatic linking enabled and ensure the AD Managed Objects attribute is correctly populated in Active Directory with the linked accounts.
- Manual linking: disable automatic linking on affected directory user groups and manage linked accounts only in SPP.
Workaround:
If the issue occurs immediately after upgrade, roll back to a (pre-upgrade snapshot or backup) to restore service, then correct the configuration before retrying the upgrade. -
Change Request
482661 | 713420