|Applies To||RSA Product Set: SecurID|
RSA Product/Service Type: Authentication Manager
RSA Version/Condition: 8.0, 8.1, 8.1.x
Platform: VMware, RSA SecurID hardware appliance
O/S Version: SuSE Linux 11
|Issue||An RSA administrator is unable to unassign a token from a user or reassign the token to a new user due to the following error:|
There was a problem processing your request.
Cannot add or manage a user with user ID com.rsa.common.InvalidArgumentException: Duplicate user ID. User IDs must be unique within an identity source. This user ID is already in use by a user in this identity source."
Token details show the token is assigned to <Unknown>. The user to whom the token was previously assigned was a user in the external identity source who no longer exists. The token showing as assigned to the <unknown>user happens when the user is deleted from the external identity source before her token was unassigned.
To avoid this error admins for the external identity source should always advise RSA admins when users are being deleted from the external identity source so the RSA admin can unassign the token from the end user before she is deleted.
|Cause||The user in the external identity source has an illegal character such as @ in the loginuid. For example, testuser@RSA.|
|Resolution||To properly resolve the issue login directly to the PostgreSQL database to manipulate the row. |
First, ensure that SSH access is enabled from the Operations Console > Administration > Operating System Access > check the option to enable SSH on eth0 and click Save. When done, open an SSH session to the Authentication Manager primary, then:
login as: rsaadmin
From the Security Console navigate to Authentication > SecurID Tokens > Manage Existing. Search for any token that has been assigned to the <unknown> userID.
Run the following command to verify that the token is not associated with any user and then delete the orphaned user from database directly.
SELECT * from rsa_rep.ims_principal_data p where id=(select t.principal_id from rsa_rep.am_token t where t.serial_number='token_serial_number');
If any results are found, they can be deleted with the command below
DELETE from rsa_rep.ims_principal_data p where id=(select t.principal_id from rsa_rep.am_token t where t.serial_number='token_serial_number');
Note that token_serial_number is a value that is keyed in based on the search of tokens done above.
db=# SELECT * from rsa_rep.ims_principal_data p where id=(select t.principal_id from rsa_rep.am_token t where t.serial_number='000123456789');
This should remove the problematic user from the system and allow the token to be assigned to any user.