Can more than one LDAP Search Domain be entered in Performance Center
Article ID: 15814
Updated On:
Products
Issue/Introduction
Users from two different LDAP Domain trees need to access Performance Center.
When configuring the LDAP integration only a single Search Domain value can be entered.
When doing this, if users in a different LDAP Domain tree attempt to log in they are faced with a message about invalid user access.
In the Performance Center SSOService.log files we see messages like this for the same users failed log in attempts.
2020-11-25 09:30:00, Product Code: pc, Username: <UserName>, Remember Me: false, SSO version: 7.0, Remote Host: <IP_Address>, Redirect URL: http://<PC_Host>:8181/pc/desktop/page, Error Message: Unable to authenticate user.
Environment
All supported Performance Management releases
Cause
The user is not in the defined Search Domain tree in the LDAP configuration.
Resolution
In order for this to work with Performance Management we have two paths to choose from.
- If not already configured this way set up the LDAP Domain trees so that the two containing the target users are found under a single higher level tree above.
- Modify the configured Search Domain to represent the tree above the two where the users are found.
- Ensure the Search Scope is configured for 'subtree'.
- This tells the configuration to search all sub-trees under the configured Search Domain tree.
- Use of the onelevel or base options for Search Scope will cause this process to fail.
- Move users in LDAP configuration so that they are all found in the same LDAP Domain tree or those under it.
- Ensure the Search Domain is set to the tree that will result in a search of trees underneath which contain the target users to be found.
- Ensure the Search Scope is configured for 'subtree'.
- This tells the configuration to search all sub-trees under the configured Search Domain tree.
- Use of the onelevel or base options for Search Scope will cause this process to fail.
Additional Information
Feedback
