I am trying to edit a user account, but when I click the user I get the following error:
Cannot add or manage a user with user ID com.rsa.common.InvalidArgumentException: Duplicate user ID. User IDs must be unique within an identity source. This user ID is already in use by a user in this identity source.
I have tried cleaning up the unresolvable user accounts from the LDAP identity source, but that didn't work as this user was not unresolvable. I am running Authentication Manager 8.1.
Take a look at our knowledge article 000017718 - Cannot add or manage a user with user ID <UserID>. User IDs must be unique within a deployment. This user ID is already in use in RSA Authentication Manager. I think that might help your issue.
Regardsm
Erica
Thank for moving this to the right place. I did look at this article, but the strange thing is we only have one identity source outside of the local database and the userID only exists in the one. There is not a duplicate. I can't do anything with the account, not even delete it. I get that same error. Is there a way to force delete his userID and reimport it from my LDAP identity source?
Edit the user search filter in the operations console, and exclude that one user.
Then run a cleanup, that userid should show up in the cleanup preview if you uncheck the grace period box.
how to exclude:
example of default filter, pulls all users
(objectClass=User)&(objectcategory=person)
now I want to exclude userid mittens
to force mittens into the cleanup list
(&(objectClass=User)&(objectcategory=person)&(!(sAMAccountName=mittens)))
Once I run the cleanup I can go back and fix my filter and the
userid mittens would show up in the Security Console again, but remain unregistered and the
internal database would not have a GUID assigned to that user (yet)...
unless I touched mittens account in any way (make a note, or assign a token) any admin action on
that userid will register the user.
Kindly review Article - How a User Becomes Unresolvable as it is important to take note when and how a user becomes unresolvable
Also kindly take note that user once cleaned up as per 000017718 - Cannot add or manage a user with user ID <UserID>. User IDs must be unique within a deployment. This user ID is already in use in RSA Authentication Manager then will lose all associations that it had like tokens, administrative role etc. and they then have to added back and token seeds needs assignment and distribution.
-Sri
Authentication Manager, AM maps LDAP (Active Directory) users in an external Identity Source through several attributes including; objectGUID, SamAccountName or UPN, first or given name, last or surname (sn), Distinguished Name or DN, and email or mail. - https://community.rsa.com/docs/DOC-45370
The way to understand your problem is that more than one attribute changed for this user. Since AM version 8.2 we've been very good at resolving users if one attribute changed, e.g. they got married and changed their surname, An Admin moved the user so their organizational unit ou changed therefore their DN changed. Even if an Admin deleted then recreated the user account in AD, so that their objectGUID changed, AM could still find and resolve that user - NOTE: if you run a Clean-up job after an LDAP user is deleted from AD or moved out of scope, that user will be removed from AM and their token will be returned to the available list. That's what Sriranga is pointing out, how a user could become unresolvable.
Ed is basically giving you the surgical move you would have to do when the pointer to a user is so messed up that the normal clean up process cannot find them, these problems include actual duplicates and Identity Source overlap where a single user shows up in two or more Identity Sources. Dr. Ed (who by the way is Chief of Staff in our Authentication Surgical Unit) is explaining how to hide this userID so that a Clean-up could be run and this user could totally removed from AM (we use the term un-registered), though in the cases of Identity Source overlap you might need to do the User Ed-ectomy in more than one external Identity Sources.
Marshall Stokoe,
I've moved your question to the RSA SecurID Access space where it will be seen by the product's support engineers, other customers and partners. Please bookmark this page and use it when you have product-specific questions.
Alternatively, from the RSA Support page, click on Ask A Question on the blue navigation bar and choose Ask A Product Related Question. From there, scroll to RSA SecurID Access and click Ask A Question. That way your question will appear in the correct space.
Regards,
Erica