When a new contact is automatically created from an LDAP user upon login, the access type is not set correctly. It is set to NULL as displayed on the contact detail screen.

Products

• CA IT Asset Manager
• CA Software Asset Manager (CA SAM)
• ASSET PORTFOLIO MGMT- SERVER
• SUPPORT AUTOMATION- SERVER
• CA Service Desk Manager - Unified Self Service
• CA Service Desk Manager
• CA Service Management - Asset Portfolio Management
• CA Service Management - Service Desk Manager

Issue/Introduction

Description:

You can configure CA Service Desk Manager to create a contact automatically from a corresponding LDAP user record whenever a new user logs in to Service Desk. To enable this feature, the ldap_enable_auto option must be installed in addition to the required LDAP options.

With the feature in effect, when the contact is created in Service Desk automatically for the new user, the access type is also assigned automatically. However, in some situations the access type is not assigned.

Solution:

The access type is not assigned when the LDAP user does not join the Domain Users group.

For example, you would like the Service Desk to create new contacts with the Analyst access type that is created from Domain Admins group with the LDAP user (See Figure 1):

Figure 1:

<Please see attached file for image>

If the LDAP user joins the Domain Admins group only, the contact of the Service Desk is automatically created but the access type is set NULL on the contact detail (see Figure 2):

Figure 2:

<Please see attached file for image>

To resolve the problem, the LDAP user must join not only the Domain Admins group but also the Domain Users group.

Also consider that if the contact belongs to multiple groups in LDAP, and those groups are mapped to Access Types in Service Desk, Service Desk is unable to determine which access type to attach to the contact.

A contact in LDAP can belong to multiple groups ("memberOf" attribute in LDAP). The r11.2, r12.1, and r12.5 releases of Service Desk do not provide support for multiple group mappings. If there are Access Types in Service Desk mapped to groups in LDAP, and a user belongs to more than one of those same LDAP groups, Service Desk is unable to determine which one to use. It chooses the first LDAP group it finds for the Access Type or it does not populate the contact's Access Type at all.

In the case of the Access Type not being populated on the contact, the user receives the access and permissions of the Access Type in Service Desk marked as the "Default".

Environment

Release:
Component: ARGIS