AD group users are not synchronizing in Aria Operations.

Products

• VCF Operations

Issue/Introduction

• When importing an AD group to Aria Operations "Administration > Control Panel > Access Control > User Groups > Import from Source"  AD Group Import is successful but not all the users are listing under "User Accounts"
  
  
• Manually synchronizing the user group from "Administration > Control Panel > Authentication Sources > AD_Group > Synchronize User Group" does not synchronize the users either.
  
  
• /storage/log/vcops/log/analytics.audit-################.log, shows AD import is successful but the user logging is failing.
  
  

  YYYY-MM-DDTHH:MM:06,298+0000 - UserId : #########################, UserName : admin, AuthSource : LOCAL, Session : ####################, ClientIP : ########, Category : USER_GROUP_IMPORT - Importing user group(s) succeeded. ID(s): "###################", Name(s): "CN=AD_NAME,OU=Groups,OU=Security,DC=users" Source(s): "AD users".
YYYY-MM-DDTHH:MM:45,881+0000 - UserId : n/a, UserName : xyz@dmain, AuthSource : AD users, Session : n/a, ClientIP : #######, Category : AUTHENTICATION_LOGIN - Log in failed. Origin: "UI". Due to the following error: "Invalid credentials".
YYYY-MM-DDTHH:MM:48,647+0000 - UserId : n/a, UserName : xyz@dmain, AuthSource : AD users, Session : n/a, ClientIP : #######, Category : AUTHENTICATION_LOGIN - Log in failed. Origin: "UI". Due to the following error: "Invalid credentials".

Environment

Aria Operations 8.18.x 

Cause

The user or service account being used for AD integration in Aria Operations does not have sufficient permission on AD. This user should have access to 'memberOf' attribute. This attribute is used by Aria Operations for associating users with groups.

Resolution

User account used for AD integration requires sufficient permissions to access the AD. Review the user account's permission on AD and make sure that the 'Common Name' and 'memberOf' attributes are assigned to this user.

To find the AD integrating user in Aria operations, Navigate to Administration > Control Panel > Auth Sources > Click 3 horizonal dots on desired AD > Edit> User Name

Additional Information

Refer to the below document for more details on AD configuration in Aria Operations :
Authentication Sources: Add Authentication Source for User and Group Import