SPC-OCA-19598 / SPC-OCA-10479 - LDAP Users Moved to Root with No License Roles

Products

• Network Observability

Issue/Introduction

After integrating DX NetOps Spectrum with Active Directory (LDAP), users are intermittently "thrown out" of their assigned user groups and moved to the **"root"** of the User Manager. 

When this occurs:
*   Subsequent login attempts with the correct password fail.
*   The following error messages are displayed:
    *   **SPC-OCA-19598:** `user [USERNAME] attempted to logon to DX NetOps Spectrum OneClick from host [IP] but authorization failed.`
    *   **SPC-OCA-10479:** `The specified user has no license roles.`

This typically happens if a user provides an incorrect or old password multiple times in a short period.

Environment

Version: DX NetOps Spectrum 21.2, 22.2, 23.x,24.x,25.x

Cause

The issue is caused by a race condition or synchronization timing conflict during LDAP group mapping. When multiple failed authentication attempts occur, the synchronization process may move the user to the root container before the group mapping can be successfully re-verified, resulting in a loss of assigned license roles.

 

Resolution

To resolve this issue, increase the synchronization delay in the OneClick configuration to allow more time for LDAP group mapping to complete.

1.  Log in to the **OneClick Web Server** host.
2.  Stop the **OneClick Tomcat** service.
3.  Navigate to the following directory:
    `$SPECROOT/custom/common/config/`
4.  Open the `ldap-grps-mappings-config.xml` file in a text editor.
5.  Locate the `syncDelay` attribute. 
    Default value is often 100.
6.  Increase the `syncDelay` value to 500 (or higher if the environment has high latency).
    Example: `<ldap-grps-mappings-config authenabled="true" syncdelay="500" groupMoveEnabled="true">`
7.  Save the file.
8.  Restart the OneClick Tomcat service.

Additional Information

If the issue persists after increasing the `syncDelay`, enable runtime web server debugging to collect more data:
1.  Go to the OneClick Administration page -> Debugging-> Web Server Debug Page (Runtime).
2.  Enable the following options:
     SSORB Security SP
     User Access Privilege Manager
     User Security
3.  Reproduce the login failure and review the `$SPECROOT/tomcat/logs/stdout.log` (Windows) or `catalina.out` (Linux) for detailed LDAP mapping errors.