Active Directory Log In Fails for Users Associated With the AD Group Protected Users

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• User's Role in Console is mapped to the Active Directory Group, "Protected Users"
• Logs for Active Directory Troubleshooting have results similar to:
  • ServerLog-TIMESTAMP.bt9 shows an empty result for the Canonical Name:

    (10388 Admin Thread 1)UserStorage::LoginUserAD: Calling ValidateLogin DOMAIN\USER
    (10388 Admin Thread 1)UserStorage::LoginUserAD: Check if canonical name '' exists
    (10388 Admin Thread 1)ReportLogin called username = DOMAIN\USER, successful = 0

  • AppControlAD-TIMESTAMP.bt9 finds the DOMAIN\USER result:

    DEBUG ADHelper.ADInfo.GetDirectoryEntry - Bind successful with ldap path = LDAP://DOMAIN.TLD/CN=Protected User,CN=Users,DC=DOMAIN,DC=TLD
    DEBUG ADHelper.ADInfo.GetADUserList - Found adUser for userName = DOMAIN\USER
    DEBUG ADHelper.ADHandler.ParityServerADMapping - Computer = , Users = DOMAIN\USER, Ruleset = 2

Environment

• App Control Server: 8.9.0+

Cause

Engineering is investigating this issue under EPCB-21147 and an official fix will be available in a future release of the Server.

Resolution

The following temporary workaround can be used to force the "old logic" for Active Directory using vbscript. This should be reverted after upgrading to version where this issue is fixed.

1. Navigate to https://AppControlServer/shepherd_config.php
   1. Select the Property: AllowADScript
   2. Change the Value to true.
2. Restart the App Control Server & Reporter services.
3. Verify the AD accounts are able to log in correctly.