000029788 - Unable to unassign RSA SecurID token or assign token to another user in Authentication Manager Security Console

Document created by RSA Customer Support Employee on Jun 14, 2016•Last modified by RSA Customer Support Employee on Apr 22, 2017
Version 3Show Document
  • Comment • 0
  • View in full screen mode

Article Content

Article Number000029788
Applies ToRSA Product Set: SecurID

RSA Product/Service Type: Authentication Manager

RSA Version/Condition: 8.0, 8.1, 8.1.x

Platform: VMware, RSA SecurID hardware appliance

O/S Version: SuSE Linux 11
IssueAn RSA administrator is unable to unassign a token from a user or reassign the token to a new user due to the following error:

There was a problem processing your request. 

Cannot add or manage a user with user ID com.rsa.common.InvalidArgumentException: Duplicate user ID. User IDs must be unique within an identity source. This user ID is already in use by a user in this identity source." 

Unassign failure in GUI
 

Token details show the token is assigned to <Unknown>. The user to whom the token was previously assigned was a user in the external identity source who no longer exists.  The token showing as assigned to the <unknown>user happens when the user is deleted from the external identity source before her token was unassigned.  
Report output
To avoid this error admins for the external identity source should always advise RSA admins when users are being deleted from the external identity source so the RSA admin can unassign the token from the end user before she is deleted.
Actions performed:
  1. From the Operations Console, selected Deployment Configuration > Identity Sources > Manage Existing.
  2. Select the identity source in which the user lives and click the arrow next to the identity source name.  Choose Edit.
  3. Click on the Map tab.
  4. Scroll to the section heading labeled Directory Configuration - Users. 
  5. Edit the search filter to block the problem user ID using the following filter:  (&(objectClass=User)(objectcategory=person)(!(samaccountname=userid))), where userid is the user who is no longer in the external identity source. 
Running these steps causes a failure to search for users in the Security Console under Identity > Users > Manage Existing when defining the external identity source as the location to be searched.  Performing the manual Clean Up Unresolvable Users job in the Security Console under Setup > Identity Sources > Clean Up Unresolvable Users also does not correct the issue.
CauseThe user in the external identity source has an illegal character such as @ in the loginuid.  For example, testuser@RSA.
ResolutionTo properly resolve the issue login directly to the PostgreSQL database to manipulate the row.  
First, ensure that SSH access is enabled from the Operations Console > Administration > Operating System Access > check the option to enable SSH on eth0 and click Save.  When done, open an SSH session to the Authentication Manager primary, then:
login as: rsaadmin 
Using keyboard-interactive authentication. 
Password: <enter OS user password>
Last login: Tue Apr 7 13:47:05 2015 from xxx.xxx.xxx.xxx 
RSA Authentication Manager Installation Directory: /opt/rsa/am 
rsaadmin@testam81pri:~> cd /opt/rsa/am/utils 
rsaadmin@ testam81pri:/opt/rsa/am/utils> ./rsautil manage-secrets -a get com.rsa.db.dba.password 
Please enter OC Administrator username: <enter OC administrator user name>
Please enter OC Administrator password: <enter OC administrator password>
com.rsa.db.dba.password: <the database password will display here>
rsaadmin@ testam81pri:/opt/rsa/am/pgsql> cd ../pgsql/bin/
rsaadmin@ testam81pri:/opt/rsa/am/pgsql/bin> ./psql -h localhost -p 7050 -d db -U rsa_dba 
Password for user rsa._dba: <enter the database password captured above>

From the Security Console navigate to Authentication > SecurID Tokens > Manage Existing.  Search for any token that has been assigned to the  <unknown> userID.
Run the following command to verify that the token is not associated with any user and then delete the orphaned user from database directly.
SELECT * from rsa_rep.ims_principal_data p where id=(select t.principal_id from rsa_rep.am_token t where t.serial_number='token_serial_number');

If any results are found, they can be deleted with the command below

DELETE from rsa_rep.ims_principal_data p where id=(select t.principal_id from rsa_rep.am_token t where t.serial_number='token_serial_number');

Note that token_serial_number is a value that is keyed in based on the search of tokens done above.
For example,
db=# SELECT * from rsa_rep.ims_principal_data p where id=(select t.principal_id from rsa_rep.am_token t where t.serial_number='000123456789');
(1 rows)
db=# DELETE from rsa_rep.ims_principal_data p where id=(select t.principal_id from rsa_rep.am_token t where t.serial_number='000123456789');
DELETE 1

 

This should remove the problematic user from the system and allow the token to be assigned to any user.



 

Attachments

    Outcomes