000037199 - Error "Unable to resolve trusted user because multiple matching trusted users exist" on RSA Authentication Manager 8.x for trusted realm

Document created by RSA Customer Support Employee on Mar 1, 2019
Version 1Show Document
  • Comment • 0
  • View in full screen mode

Article Content

Article Number000037199
Applies ToRSA Product Set: SecurID
RSA Product/Service Type: Authentication Manager
RSA Version/Condition: 8.x
 
IssueTrusted realm authentication fails with following error:

Unable to resolve trusted user because multiple matching trusted users exist
 


User-added image


 
Cause

Authentication Manager trusted realm configuration allows duplicate user creation/addition to the trusted user list if the case in the user ID is different; for example, user.name vs User.Name, or as shown in the example below with bharath versus Bharath.



If there is a user ID of user.name in Authentication Manager when a trusted realm is setup, and then you try to add a trusted realm user manually called user.name it will fail with the following message:



Remote principal already exists



User-added image




If you then try to add User.Name the system allows for that user to be added, resulting in duplicate user IDs in the system:



User-added image



The /opt/rsa/am/server/imsTrace.log captures the following exceptions:



2019-02-13 14:13:51,141, [AgentProtocolServer Core Thread #1], (AbstractAuthRequestHandler.java:192), trace.com.rsa.authmgr.internal.protocol.ace.AbstractAuthRequestHandler, DEBUG, am82p.vcloud.local,,,,Principal resolution failure. Processing aborted. com.rsa.authmgr.internal.admin.principalres.PrincipalResolutionException: Unable to Resolve Principal:Unable to resolve remote principal because multiple matching remote principals exist
   at com.rsa.authmgr.internal.admin.principalres.impl.PrincipalResolutionImpl.a(PrincipalResolutionImpl.java:66)
   at com.rsa.authmgr.internal.admin.principalres.impl.PrincipalResolutionImpl.b(PrincipalResolutionImpl.java:71)
   at com.rsa.authmgr.internal.admin.principalres.impl.PrincipalResolutionImpl.resolveRemotePrincipal(PrincipalResolutionImpl.java:348)
   at com.rsa.authmgr.internal.protocol.ace.AuthV4RequestHandler.resolveRemotePrincipal(AuthV4RequestHandler.java:734)
   at com.rsa.authmgr.internal.protocol.ace.AuthV4RequestHandler.resolvePrincipal(AuthV4RequestHandler.java:659)
   at com.rsa.authmgr.internal.protocol.ace.AuthV4RequestHandler.initializePrincipalDetail(AuthV4RequestHandler.java:498)
   at com.rsa.authmgr.internal.protocol.ace.AuthV4RequestHandler.performProcessing(AuthV4RequestHandler.java:324)
   at com.rsa.authmgr.internal.protocol.ace.AuthV4RequestHandler.defaultExecuteProcess(AuthV4RequestHandler.java:202)
   at com.rsa.authmgr.internal.protocol.ace.AuthV4RequestHandler.executeProcessWithDefaultCache(AuthV4RequestHandler.java:177)
   at com.rsa.authmgr.internal.protocol.ace.AuthV4RequestHandler.process(AuthV4RequestHandler.java:151)
   at com.rsa.authmgr.internal.protocol.ace.AceProtocolHandler.process(AceProtocolHandler.java:105)

ResolutionThis issue will be resolved in RSA Authentication Manager 8.4 patch 2, which is being released shortly.
WorkaroundAs a workaround, delete the trusted realm duplicate users manually. 
  1. In the Security Console, click Administration > Trusted Realms > Trusted Users > Manage Existing.
  2. Use the search fields to find the trusted user that you want to delete.
  3. From the search results, click the context arrow for the trusted user that you want to delete.
  4. From the context menu, click Delete.
  5. Click OK.

Attachments

    Outcomes