Failed due to the cluster state message for LDAP scheduled sync

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

A PAM cluster was upgraded to 4.1.6 to take advantage of the new LDAP sync scheduler feature in this release. For one domain the LDAP Sync History page shows all runs with status Failed and error message "Failed due to the cluster state.". But the cluster is running well. The Clustering page on the primary site nodes shows all nodes in sync. The session log actually shows a PAM-LDAP-0042 message stating that the refresh completed for the domain.

Environment

PAM 4.1.6 cluster

Cause

The refresh of multiple groups in the domain runs into an error, because the groups don't exist anymore in Active Directory. The session logs show multiple PAM-LDAP-0024 and PAM-LDAP-0037 messages.  All those errors are concatenated into one string, which ends up being too long to be stored in a database table used to store the status of scheduled sync job runs. Due to the error the job status is not updated when the domain refresh ends. A little later a watchdog finds the job in a running state with no LDAP sync in progress. It updates the status to Failed and adds the above message, because a known way to get into this situation is a cluster state change.

Resolution

This problem will be fixed in 4.1.7 and 4.2.

For 4.1.6 the solution is included in published hotfix 4.1.6.05.