RSA Archer LDAP sync shows group-members from the

Question

My team just "inherited" an Archer setup with 2 ADs and LDAP sync setup for each of them. The LDAP sync works fine individually; we are able to see the users/groups as per the LDAP configuration's filters. However, we have some groups in AD#1, that contain users from AD#2 and the LDAP sync is only showing/pulling users from 1 AD in Archer. I'm on Archer 6.4.

My question:

1. Is it possible at all in Archer to get the groups to show members from the 2 AD's?
2. Does the LDAP service account need any special permissions?
3. Anything else that I'm missing, or any viable workarounds?

I have looked at this question which talks about some possibilities but it's quite old so starting a new question. Any help is greatly appreciated.

Answer 1

Hahn, I'm uncertain how Archer handles users from two different AD's that members in the same group found in the first AD.

It's best to reach out to Archer support and pose the question to them.

I'm also seen a simlar question in RSA Partner Community. Support may respond to that post then here or other clients that have had the same issue.

Answer 2

The question you referenced is related to Archer v5.x and v6.x, so everything I mentioned there is still valid as of 2019-04-26.

Back to the questions you asked:

1. Is it possible at all in Archer to get the groups to show members from the 2 AD's?

The answer is "Yes", but not that simple. If you check tables on the back end you can see that there are two type of groups:

1. Manually created groups by Archer admins. These groups are not part of any LDAP source and you can't synch these groups/users.

2. Groups created via LDAP Synch. These groups and users are synched with LDAP Synch configuration.

In your case, if you have two LDAP synchs configured then you will have two sets of LDAP groups and two sets of LDAP users, assuming LDAP synch is configured to add and synch groups and users using filters correctly.

Based on what you shared if you have group "ABC" in both LDAP sources you will have two groups added to Archer. On the back end in the table tblGroup they will have different "ldap_config_id" values, but same name.

Same applies for users - if you have user "User1" in both LDAP sources you will end up with two users with different domains and different "ldap_config_id".

Back to your question - Yes, if you have two LDAP sources with same group name you will end up with two groups with same name, each group should have users from corresponding LDAP assigned, if you configured both LDAP synchs to add and synch groups and users. If this doesn't work this way for you, then review your LDAP synch configuration. Your may not have an option enabled to synch groups or don't have any filters in place to get them.

2. Does the LDAP service account need any special permissions?

In Archer - no, but in LDAP source (Active Directory) the account you specified in LDAP configuration should have access to query certain areas. The account you use for 2nd LDAP may not have access to query groups. I'm not an expert in AD security, you should talk to AD admin on this matter.

Anything else that I'm missing, or any viable workarounds?

See the old question/answer you referenced. LDAP synch principals in Archer v5 and v6 are the same as I know.

Best solution in my opinion is to establish "virtual link" or trust between both Active Directories. Third AD can be created with both AD#1 and AD#2 merged or linked. This way you can query AD#3 and have groups and users provided for you by using only one LDAP synch configuration/Domain. This is the simplest solution for you, but your AD admin will have to do some work.

You can check other options in the old question as well.

P.S: the instance I develop for had 2 LDAP sources, but I configured them to have unique group names and unique users. This way collisions don't occur.

Good luck!