Error "Unable to resolve trusted user because multiple matching trusted users exist" on RSA Authentication Manager 8.x for trusted realm

[#1]

Article Number

000037199

Applies To

RSA Product Set: SecurID
RSA Product/Service Type: Authentication Manager
RSA Version/Condition: 8.x
 

Issue

Trusted realm authentication fails with following error:

Unable to resolve trusted user because multiple matching trusted users exist
 

Image description

 

Cause

Authentication Manager trusted realm configuration allows duplicate user creation/addition to the trusted user list if the case in the user ID is different; for example, user.name vs User.Name, or as shown in the example below with bharath versus Bharath.

If there is a user ID of user.name in Authentication Manager when a trusted realm is setup, and then you try to add a trusted realm user manually called user.name it will fail with the following message:

Remote principal already exists

Image description

If you then try to add User.Name the system allows for that user to be added, resulting in duplicate user IDs in the system:

Image description

The /opt/rsa/am/server/imsTrace.log captures the following exceptions:

2019-02-13 14:13:51,141, [AgentProtocolServer Core Thread #1], (AbstractAuthRequestHandler.java:192), trace.com.rsa.authmgr.internal.protocol.ace.AbstractAuthRequestHandler, DEBUG, am82p.vcloud.local,,,,Principal resolution failure. Processing aborted. com.rsa.authmgr.internal.admin.principalres.PrincipalResolutionException: Unable to Resolve Principal:Unable to resolve remote principal because multiple matching remote principals exist
   at com.rsa.authmgr.internal.admin.principalres.impl.PrincipalResolutionImpl.a(PrincipalResolutionImpl.java:66)
   at com.rsa.authmgr.internal.admin.principalres.impl.PrincipalResolutionImpl.b(PrincipalResolutionImpl.java:71)
   at com.rsa.authmgr.internal.admin.principalres.impl.PrincipalResolutionImpl.resolveRemotePrincipal(PrincipalResolutionImpl.java:348)
   at com.rsa.authmgr.internal.protocol.ace.AuthV4RequestHandler.resolveRemotePrincipal(AuthV4RequestHandler.java:734)
   at com.rsa.authmgr.internal.protocol.ace.AuthV4RequestHandler.resolvePrincipal(AuthV4RequestHandler.java:659)
   at com.rsa.authmgr.internal.protocol.ace.AuthV4RequestHandler.initializePrincipalDetail(AuthV4RequestHandler.java:498)
   at com.rsa.authmgr.internal.protocol.ace.AuthV4RequestHandler.performProcessing(AuthV4RequestHandler.java:324)
   at com.rsa.authmgr.internal.protocol.ace.AuthV4RequestHandler.defaultExecuteProcess(AuthV4RequestHandler.java:202)
   at com.rsa.authmgr.internal.protocol.ace.AuthV4RequestHandler.executeProcessWithDefaultCache(AuthV4RequestHandler.java:177)
   at com.rsa.authmgr.internal.protocol.ace.AuthV4RequestHandler.process(AuthV4RequestHandler.java:151)
   at com.rsa.authmgr.internal.protocol.ace.AceProtocolHandler.process(AceProtocolHandler.java:105)

Resolution

This issue will be resolved in RSA Authentication Manager 8.4 patch 2, which is being released shortly.

Workaround

As a workaround, delete the trusted realm duplicate users manually. 

1. In the Security Console, click Administration > Trusted Realms > Trusted Users > Manage Existing.
2. Use the search fields to find the trusted user that you want to delete.
3. From the search results, click the context arrow for the trusted user that you want to delete.
4. From the context menu, click Delete.
5. Click OK.