We have migrated from RSA Identity Management & Governance version 6.9.1 Patch 17 to version 7.0.1 Patch 02 Hot-fix 02.
After this upgrade, we are observing that entitlement collectors have become case-sensitive. And this is breaking account/group to app-role relationships which were previously working.
Has anyone faced this issue and know any resolution or work around?
Hi Sean,
Thanks for responding. It is a database collector connecting to DB2 databases and we are using a custom driver
(Driver Class com.ibm.db2.jcc.DB2Driver). The driver is db2jcc4.jar
ADC’s have a case sensitive setting, because of that whenever the account name is referenced by that collector or any other collector it should be case insensitive if the ADC is configured that way. We have found that over time that setting has been expanded by developers based on the request of Customers. We found out early in 7.0.0 that the switch also meant a case insensitive search for Users when processing account mappings.
It sounds like a resolution issue, so what is the configuration? Is it Account -> Groups? If so are the accounts & groups in the same ADC collector? Or is it EDC application roles to Account or Groups?
Check your ADC configuration to see if it is set to case sensitive.
Hello Sean,
Thanks for the background on this feature. I am working with Dipankar on this issue, so I am able to speak to it -
We have 1 Active Directory ADC collector (case in-sensitive) collecting accounts and group memberships. We have 1 application EDC collection app-roles for Groups. These groups come from AD ADC I mentioned earlier. In 6.9.1 P17, we were able to collect group name with any case in the application source file, and it would get correctly resolved against group collected by AD ADC, but post 7.0.1 P02 HF02, EDC rejects the app-role to group relationship if case of the group name referenced in the relationship doesn't match with the case as it appears in Active Directory.
We don't have any control over EDC case sensitivity unlike ADC. Is this something which was coded to work this way starting 7.x?
RSA provided us with 7.0.1 P02 Hot Fix 08 for this issue.
What type of entitlement collector is this? Database (if so which JDBC driver), ldap, ...