LDAP users are assigned a Member role in Aria operations for networks

Products

• VMware Aria Operations for Networks

Issue/Introduction

• Settings > Identity & Access Management > User Management > LDAP Users
• LDAP Users has a role of member assigned.

• Settings >  Identity & Access Management > LDAP > Group base access control .
• Group DN field contains path to a group where the user is not a direct  member.
• The Group DN is assigned an Administrator role.
• AON Platform restapilayer log shows the following

var/log/arkin/restapilayer/restapilayer.log
2024-12-12T09:36:46.180Z INFO vnera.restapilayer.ArkinJndiLdapRealm dw-1114514 - POST /auth/login getRolesAndGroupForLdapUser:229 All groups configured for user are: []{{{}2024-12-12T09:36:46.180Z INFO vnera.restapilayer.ArkinJndiLdapRealm dw-1114514 - POST /auth/login getRolesAndGroupForLdapUser:233 No configured groupDNs matches directly with user groups, hence assigning member role
{}}}

Environment

VMware vRealize Network Insight 6.8
VMware vRealize Network Insight 6.9
Aria Operations for Networks 6.10.0
Aria Operations for Networks 6.11.0
Aria Operations for Networks 6.12.0
Aria Operations for Networks 6.12.1
Aria Operations for Networks 6.13.0
Aria Operations for Networks 6.14.0

Cause

Authenticating to a group where a user is not a direct member is not currently supported. 

Resolution

We needs to provide the full path to the group in which the user is in.

Under Settings >  Identity & Access Management > LDAP > Group base access control  , The user must be direct member of the CN

cn=XXXX,ou=XXXX,ou=XXX,ou=XXX,ou=XX,ou=XX,dc=XX,dc=XX

Additional Information

Configure Lightweight Directory Access Protocol (LDAP)