000030664 - Active Directory Account Collector fails with 'Naming Exception happened' in RSA Identity Governance & Lifecycle

Document created by RSA Customer Support Employee on Jun 14, 2016•Last modified by RSA Customer Support on Aug 20, 2020
Version 4Show Document
  • Comment • 0
  • View in full screen mode

Article Content

Article Number000030664
Applies ToRSA Product Set: RSA Identity Governance & Lifecycle 
RSA Version/Condition: All
 
IssueThe Active Directory (AD) Account Collector fails intermittently when attempting to collect account data from certain AD domain controllers. This issue is present only in the native Active Directory Account Collector (Data Source Type: Active Directory) and does not occur when using the generic LDAP Account Collector (Data Source Type: Ldap). The Data Source Type setting is under Collectors > Account Collectors > Create Account Collector.

A test of the collector fails as follows:
 
Collector test failed:
com.aveksa.server.runtime.ServerException: Test request failed with response: com.aveksa.server.runtime.ServerException: java.lang.RuntimeException 


The following error is logged to the aveksaServer.log file. Note this error references a failure to connect to the referral server.
 

2015-06-22 17:01:03,662 INFO  [com.aveksa.collector.accountdata.LdapAccountDataReader] 
Naming Exception happened :
javax.naming.CommunicationException: Dohmen.com:389 
[Root exception is java.net.ConnectException: Connection timed out]
     at com.sun.jndi.ldap.LdapReferralContext.<init>(LdapReferralContext.java:92)


followed by:



2015-06-22 17:01:03,664 ERROR [com.aveksa.client.datacollector.framework.DataCollectorManager] 
FAILED method=Collect 
CollectionMetaInfo[{ID=98, run_id=1435010400534, collector_id=68, test-run=true, collector_name=Restat.net - ADC, 
data_file=/home/oracle/jboss-4.2.2.GA/server/default/./deploy/aveksa.ear/aveksa.war/WEB-INF/LocalAgent/collected_data/98.data}]
java.lang.RuntimeException


Please refer to RSA Knowledge Base Article 000030327 -- Artifacts to gather in RSA Identity Governance & Lifecycleto find the location of the aveksaServer.log file for your specific deployment. The aveksaServer.log may also be downloaded from the RSA Identity Governance & Lifecycle user interface (Admin > System > Server Nodes tab > under Logs.)
 
CauseAn LDAP referral is an (optional) feature of the LDAP protocol that allows for an LDAP server that is unable to locate the desired LDAP record, to redirect the client to a different LDAP source that is more likely to hold the result.

This failure occurs if the Account Collector attempts to follow an LDAP referral and one of the following occurs:
  • The Account Collector cannot bind successfully (connect) to the Microsoft AD domain controller (referral server) returned in the referral request. The failure to bind may be because the domain controller returned in the referral is not reachable from the RSA Identity Governance & Lifecycle server location, or because the bind information used for the secondary domain controller (referral server) does not match the bind information used for the primary.  
  • Not all AD domains will return referral information which is why this issue may occur on some AD domains and not on others.
  • It is also possible for only certain LDAP queries to generate a referral.
All these factors make this issue appear intermittently.
 
ResolutionThis issue is configurable in the following RSA Identity Governance & Lifecycle versions and/or patch levels: 
  • RSA Identity Governance & Lifecycle 6.8.1 P10
  • RSA Identity Governance & Lifecycle 6.9.0 P02
  • RSA Identity Governance & Lifecycle 6.9.1 P02
  • RSA Identity Governance & Lifecycle 7.0.0
The fix is to add an option in the RSA Identity Governance & Lifecycle user interface to ignore referrals when configuring Active Directory Account Collectors as illustrated in the screenshot below:
 
User-added image


Most often the intent is to bind to a single domain controller, and only return results from that domain. The attempt to follow referrals is unintended and undesired.  In order to successfully follow referrals in an AD domain, the bind account used for the LDAP connection must be the same for all domains, which typically is not practical.  

To prevent LDAP referrals, configure the RSA Identity Governance & Lifecycle Account Collector to ignore referrals. In the user interface go to Collectors > Account Collectors > {AD Collector name} > General tab > Edit > Next (Connection information). Check the Ignore Referral checkbox.
 
WorkaroundConfigure the Microsoft AD domain controller to which the Account Collector binds to disable the referrals. Contact Microsoft for more information on how to disable this feature. Note that disabling referrals is not recommended as it may affect other applications that use Microsoft AD LDAP.
 

Attachments

    Outcomes