RACFv2 Timeout When Retrieving Account Details in Provisioning Manager
Article ID: 137585
Updated On:
Products
Issue/Introduction
When attempting to retrieve account information in Provisioning Manager for an account whose owner is set to a RACF Group (rather than an individual user), the operation times out and fails with the following error:
ERROR: ETA_E_0020<RAC>, User Account 'USERNAME' on TEST_B23 read failed: Connector Server Read failed: Timed out (ldaps://connectorserverhost:20411)Environment
Release : v14.5, v15 (All supported versions)
Cause
This issue occurs when an account profile in RACF has a group assigned as its owner (eTRACOwner). The Java Connector Server (JCS) attempts to resolve the owner by looking it up as a RACF user entry (etracuserid). Because the owner value corresponds to a group rather than a user ID, the lookup fails with error ICH30001I UNABLE TO LOCATE USER ENTRY, causing the connector server request to time out.
To confirm this cause, perform the following verification steps:
1. Check the Provisioning Server transaction log (etatransYYYYMMDD-nnn.log) to confirm that the timeout originates from the Connector Server on port 20411:
20190730:163507:TID=1dbb70:Search :S379:E375:P: Class Name: User Account
20190730:163507:TID=1dbb70:Search :S379:E375:P: base-dn: eTDYNAccountName=USERNAME,eTDYNAccountContainerName=Users,eTDYNDirecto
20190730:163507:TID=1dbb70:Search :S379:E375:P:+ ryName=TEST_B23,eTNamespaceName=RACF v2,dc=im
20190730:163507:TID=1dbb70:Search :S379:E375:P: scope : BASE
20190730:163507:TID=1dbb70:Search :S379:E375:P: filter : (objectClass=eTDYNAccount)
20190730:163507:TID=1dbb70:Search :S379:E375:P: attrs : <ALL>
20190730:163507:TID=1dbb70:Search :S379:E375:P: size-limit: 50000
20190730:163507:TID=1dbb70:Search :S379:E375:P: time-limit: 90
20190730:163637:TID=1dbb70:Search :S379:E375:F: FAILURE: Connector Server Search (eTDYNAccountName=USERNAME)
20190730:163637:TID=1dbb70:Search :S379:E375:F: rc: 0x0034 (DSA is unavailable)
20190730:163637:TID=1dbb70:Search :S379:E375:F: msg: Connector Server Read failed: Timed out (ldaps://<IP>:20411)
20190730:163637:TID=1dbb70:Search :E375:----:F: FAILURE: External Search (eTDYNAccountName=USERNAME)
20190730:163637:TID=1dbb70:Search :E375:----:F: rc: 0x0034 (DSA is unavailable)
20190730:163637:TID=1dbb70:Search :E375:----:F: msg: :ETA_E_0020<RAC>, User Account 'USERNAME' on 'TEST_B23' read failed: Conn
20190730:163637:TID=1dbb70:Search :E375:----:F:+ector Server Read failed: Timed out (ldaps://ipaddress:20411)
2. Inspect jcs_daily.log to verify if eTRACOwner is set to a group name (e.g., RACFGROUP):
eTRACOwner: RACFGROUP, eTRACTsoUserdata: 0000, eTRACLastAccessTime: hh:mm:ss}
3. Review jcs_daily.log for LDAP error code 80 containing the ICH30001I exception:
ICH30001I UNABLE TO LOCATE USER ENTRY RACFGROUP]: failed to lookup etracuserid=RACFGROUP,eTRACAdminGrp=Users,host=B13,o=COMPANY,c=us'
[ApacheDS Worker-thread-190] (com.ca.jcs.core:com.ca.jcs.processor.RetryOpProcessorProxy:343) DEBUG - class com.ca.jcs.racf.RACFMetaConnector: TEST_B23 [eTDYNDirectoryName=TEST_B23,eTNamespaceName=RACF v2,dc=im,dc=etasa]: no retry group found matching exception text 'javax.naming.NameNotFoundException: JCS@connectorserverhostname: JNDI: [LDAP: error code 80 - ICH30001I UNABLE TO LOCATE USER ENTRY RACFGROUP]: failed to lookup etracuserid=RACFGROUP,eTRACAdminGrp=Users,host=B13,o=COMPANY,c=us'Resolution
To resolve the issue, remove the eTRACOwner mapping using Connector Xpress and redeploy the project configuration:
Open Connector Xpress and load the project for your RACF v2 namespace.
In the right-hand attribute mapping panel, locate and remove the mapping for the owner attribute (
eTRACOwner).In the left-hand menu tree, right-click RACF v2, increment the project version number, and click Deploy.
Restart the Java Connector Server (JCS) service for the updated connector deployment to take effect.
Attachments
Feedback
