Troubleshooting issues with LDAP user synchronization
Issue symptoms
The following symptoms might be observed:
- LDAP users are not created in TrueSight Server Automation RBAC.
- LDAP users are not removed from TrueSight Server Automation RBAC.
- LDAP users are not being marked as disabled in TrueSight Server Automation RBAC.
- The users in TrueSight Server Automation RBAC are not mapped to the expected roles.
Issue scope
The issue might affect all or specific LDAP users.
Diagnosing and reporting an issue
Task | Action | Steps | Reference |
|---|---|---|---|
1 | Understand problem scope |
| |
2 | Identify recent changes | Is this the initial setup of LDAP User Synchronization or was it previously working successfully? If LDAP authentication was previously working in this environment, are there any known changes since the last time it worked? For instance:
| |
3 | Review the configuration details. | Review the configuration details:
|
|
4 | Review the configuration details. | Review the details of each LDAP query (role and user):
|
|
5 | Identify and locate the Application Server log files. | The following Application Server log files can be used to troubleshoot LDAP Authentication issues. These log files are located in the installDirectory/br/ directory on the Application Server:
*If you have multiple Application Server deployments, the specified log file names are the log files of the default Application Server deployment. The names of the log files for other Application Server deployments are prefixed with the name of the deployment, connected with an underscore. For example, jobservera_appserver.log, jobserverb_console.log, and so on. Collect these Application Server logs from each Application Server host. Note the exact time of a recent failed LDAP authentication attempt so this time can be cross-referenced with the collected logs. | |
6 | Creating a BMC Support Case | Provide the following information and log files when creating a case with BMC Customer Support:
|
Resolutions for common issues
Symptom | Action | Reference |
|---|---|---|
RBAC user synchronization is completed without errors. However, no new users (or fewer than expected) are created in TrueSight Server Automation RBAC. | Follow the steps in the referenced KA to further troubleshoot and resolve. | |
RBAC user synchronization completes without errors. The correct number of new users are created in TrueSight Server Automation RBAC, but with an unexpected username format. | Follow the steps in the referenced KA to further troubleshoot and resolve. | |
RBAC user synchronization is completed without errors. The correct number of new users are created in TrueSight Server Automation RBAC, but the list of "Selected Roles" assigned to the RBAC users (newly created or existing) is not as expected. | Follow the steps in the referenced KA to further troubleshoot and resolve. | |
RBAC user synchronization is completed without errors. However, users are not removed from TrueSight Server Automation RBAC roles as expected. | Follow the steps in the referenced KA to further troubleshoot and resolve. | |
RBAC user synchronization fails with the following error: "Cannot establish a TLS connection with ldap://myldapserver1.mycompany.com:port." | Check the Application Server log for a more detailed error message which accompanies the "Cannot establish a TLS connection" error. Depending on the error message details, consult the following Knowledge Articles:
|