IRS Active Directory works for some user but not for others

[RaoulMahtani]

Active Directory Authentication works for some users but not for other in the same AD group.

Logs from IRS indicate the following:

20 Feb 2020 22:11:59.141 JettyServer[qtp648525677-2668] WARN o.e.jetty.jaas.JAASLoginService -
javax.security.auth.login.FailedLoginException: Could not lookup groups in Active Directory for user {user}: javax.nam
ing.NamingException - [LDAP: error code 1 - 000020D6: SvcErr: DSID-031007E5, problem 5012 (DIR_ERROR), data 0
]
at org.eclipse.jetty.jaas.spi.UCAActiveDirectoryLoginModule.commit(UCAActiveDirectoryLoginModule.java:360) ~[ui-
server
.jar:na]
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[na:1.8.0_152]
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[na:1.8.0_152]
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[na:1.8.0_152]
at java.lang.reflect.Method.invoke(Method.java:498) ~[na:1.8.0_152]
at javax.security.auth.login.LoginContext.invoke(LoginContext.java:755) ~[na:1.8.0_152]
at javax.security.auth.login.LoginContext.access$000(LoginContext.java:195) ~[na:1.8.0_152]
at javax.security.auth.login.LoginContext$4.run(LoginContext.java:682) ~[na:1.8.0_152]
at javax.security.auth.login.LoginContext$4.run(LoginContext.java:680) ~[na:1.8.0_152]
at java.security.AccessController.doPrivileged(Native Method) ~[na:1.8.0_152]
at javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:680) ~[na:1.8.0_152]
at javax.security.auth.login.LoginContext.login(LoginContext.java:588) ~[na:1.8.0_152]
at org.eclipse.jetty.jaas.JAASLoginService.login(JAASLoginService.java:233) ~[jetty-jaas-9.4.8.v20171121.jar:9.4
.8.v20
171121]
at org.eclipse.jetty.security.authentication.LoginAuthenticator.login(LoginAuthenticator.java:61) [jetty-securit
y-9.4.
8.v20171121.jar:9.4.8.v20171121]
at org.eclipse.jetty.security.authentication.FormAuthenticator.login(FormAuthenticator.java:192) [jetty-security
-9.4.8
.v20171121.jar:9.4.8.v20171121]
at org.eclipse.jetty.security.authentication.FormAuthenticator.validateRequest(FormAuthenticator.java:284) [jett
y-secu
rity-9.4.8.v20171121.jar:9.4.8.v20171121]
at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:483) [jetty-security-9.4.8.v20171121.j
ar:9.4
.8.v20171121]
at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:132) [jetty-server-9.4.8.v20171121
.jar:9
.4.8.v20171121]
at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:190) [jetty-server-9.4.8.v201711
21.jar
:9.4.8.v20171121]
at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:1595) [jetty-server-9.4.8.v20171
121.ja
r:9.4.8.v20171121]
at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:188) [jetty-server-9.4.8.v201711
21.jar
:9.4.8.v20171121]
at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1253) [jetty-server-9.4.8.v20171
121.ja
r:9.4.8.v20171121]
at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:168) [jetty-server-9.4.8.v2017112
1.jar:
9.4.8.v20171121]
at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:473) [jetty-servlet-9.4.8.v20171121.jar:
9.4.8.
v20171121]
at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:1564) [jetty-server-9.4.8.v201711
21.jar
:9.4.8.v20171121]
at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:166) [jetty-server-9.4.8.v2017112
1.jar:
9.4.8.v20171121]
at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1155) [jetty-server-9.4.8.v201711
21.jar
:9.4.8.v20171121]
at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141) [jetty-server-9.4.8.v20171121.j
ar:9.4
.8.v20171121]
at org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.java:126) [jetty-server-9.4.8.v20
171121
.jar:9.4.8.v20171121]
at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:132) [jetty-server-9.4.8.v20171121
.jar:9
.4.8.v20171121]
at org.eclipse.jetty.server.Server.handle(Server.java:530) [jetty-server-9.4.8.v20171121.jar:9.4.8.v20171121]
at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:347) [jetty-server-9.4.8.v20171121.jar:9.4.8.v20
171121
]
at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:256) [jetty-server-9.4.8.v20171121.jar
:9.4.8
.v20171121]
at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:279) [jetty-io-9.4.8.v
201711
21.jar:9.4.8.v20171121]
at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:102) [jetty-io-9.4.8.v20171121.jar:9.4.8.v201711
21]
at org.eclipse.jetty.io.ssl.SslConnection.onFillable(SslConnection.java:289) [jetty-io-9.4.8.v20171121.jar:9.4.8
.v2017
1121]
at org.eclipse.jetty.io.ssl.SslConnection$3.succeeded(SslConnection.java:149) [jetty-io-9.4.8.v20171121.jar:9.4.
8.v201
71121]
at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:102) [jetty-io-9.4.8.v20171121.jar:9.4.8.v201711
21]
at org.eclipse.jetty.io.ChannelEndPoint$2.run(ChannelEndPoint.java:124) [jetty-io-9.4.8.v20171121.jar:9.4.8.v201
71121]
at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.doProduce(EatWhatYouKill.java:247) [jetty-util-9.4.8.v2
017112
1.jar:9.4.8.v20171121]
at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.produce(EatWhatYouKill.java:140) [jetty-util-9.4.8.v201
71121.
jar:9.4.8.v20171121]
at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.run(EatWhatYouKill.java:131) [jetty-util-9.4.8.v2017112
1.jar:
9.4.8.v20171121]
at org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:382) [jet
ty-uti
l-9.4.8.v20171121.jar:9.4.8.v20171121]
at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:708) [jetty-util-9.4.8.v20171121.
jar:9.
4.8.v20171121]
at org.eclipse.jetty.util.thread.QueuedThreadPool$2.run(QueuedThreadPool.java:626) [jetty-util-9.4.8.v20171121.j
ar:9.4
.8.v20171121]

[toddg1]

OK - this is very interesting, but not something we can troubleshoot via a forum such as this.  Your best bet is going to be to open a support case to get official help with this.

I will show this to the team ahead of time - so they know it is coming, but we can't work something like this via a forum.

Thanks for your understanding!

[anish_m_a]

This issue need to be diagnosed to understand better, please contact the HPE support team and log a ticket so that it can be analysed.

https://www.hpe.com/in/en/pdfViewer.html?docId=a00039121&parentPage=/in/en/services/get-connected&resourceTitle=Technical+Support+Phone+Numbers+support+matrix

Thanks.