返回
-
标题
Safeguard fails to import Directory User Group with Invalid Primary Authentication Provider error -
说明
Safeguard fails to import Directory User Group with Invalid Primary Authentication Provider error -
原因
When the service account lacks the ability to discover a domain (due to permissions), particularly the root domain, an 'Invalid Primary Authentication Provider Id" error will be returned when adding a group with PrimaryAuthenticationProviderId = {id of domain}.The inability to discover certain domains is why Safeguard shows some domains but not others.In the case of the root domain, Safeguard nevertheless assigns an Id for the root domain as a Primary Authentication Provider. This is invalid because the service account can't perform queries against the root domain. -
解决办法
RESOLUTION:
All newly created Safeguard users that are imported from the directory user group will have their primary authentication provider set to use the directory domain from which their user originates. For an Active Directory forest with multiple domains, the domains must be marked as Available Domains for Identity and Authentication. Clearing the forest root domain will have undesired results when managing directory users and groups.
Directory groups require the forest root domain to be visible and available for identity and authentication.
In SPP Web UI for 7 LTS, go to Appliance Management > Safeguard Access > Identity and Authentication | Select the Active Directory Domain | Under General Tab > "Available Domains for Identity and Authentication" ensure the AD forest root is ticked.
Verify if any firewall is blocking access to the root domain
verify that the service account used for the Active Directory Provider has read permissions in all domains including root domain. -
变更请求
800306