Determining the node running LDAP refreshes in a PAM cluster

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

When there is a (perceived) problem with the refresh of user or device groups that have been imported into PAM from an LDAP or AD server, or with the import of a new group, it may be important to know which node in a PAM cluster communicates with the LDAP server.

Environment

CA Privileged Access Manager (PAM) cluster implementations.

Resolution

The LDAP refresh role can move between nodes in the primary site. The PAM administrator does not have control over which node does the LDAP refresh. After cluster restart the first node in the primary site, which also is the initial database replication leader, will have this role. But as individual nodes in the primary site reboot, or possibly individual services running on each node restart, the role can move to a different primary site node, and it does not necessarily move with the replication leader role. While the replication leader is shown on page Configuration > Clustering under the Status tab, there is no indicator for the LDAP refresh role.

The only way to determine the current node owning the LDAP refresh role in the PAM UI is to review the session logs (UI page Sessions > Logs) of each primary site cluster node and look for messages containing substring "PAM-LDAP-".

Additional Information

Common LDAP refresh messages are:

PAM-LDAP-0041: Periodic refresh for LDAP domain DC=### triggered.

PAM-LDAP-0009: LDAP Group CN=#### updated. 0 New Users, 0 Updated Users, 0 Deleted Users, 0 Failed New Users, 0 Failed Updated Users, 0 Failed Deleted Users, ## Users Retrieved From LDAP Directory Server

PAM-LDAP-0010: LDAP Group CN=#### updated. 0 New Devices, 0 Updated Devices, 0 Deleted Devices, 0 Failed New Devices, 0 Failed Updated Devices, 0 Failed Deleted Devices, ## Devices Retrieved From LDAP Directory Server

PAM-LDAP-0042: Periodic refresh for LDAP domain DC=### completed.