Applies to: All versions of Centrify DirectControl ZPA running on all Windows platforms.

Question:

After setting the documented permissions on the ZPA account for an SFU Zone, I see the following error?

Zone: Centrify.dt/UNIX/Centrify-Zones/Global_Namespace [Global] 

Details: Access denied to user test00007@Centrify.dt in SFU zone Centrify.dt/UNIX/Centrify-Zones/Global_Namespace [Global]. To avoid this, delegate write access on the Active Directory user object. 

[Thu 03 10:45:25.762:Centrify ZPA:Centrify.Provisioning.Agent.exe:Verbose:<4>] DomainPoller.Poll: Access denied on sfu user 'test00007@Centrify.dt' in zone 'Centrify.dt/UNIX/Centrify-Zones/Global_Namespace [Global]' : 'System.UnauthorizedAccessException: Access is denied. 

at System.DirectoryServices.Interop.UnsafeNativeMethods.IAds.SetInfo() 

at System.DirectoryServices.DirectoryEntry.CommitChanges() 

at Centrify.Cfw.DirectoryServices.DirectoryObject.Commit() 

at Centrify.DirectControl.Api.ADData`1.CommitChanges(DirectoryObject dsObject) 

at Centrify.DirectControl.Api.UserProfile2.Commit() 

at Centrify.Provisioning.ZoneWorker.Run()' 

Exception details: System.UnauthorizedAccessException: Access is denied. 

Answer:

This is a bug in ZPA user account handling.  The usual permissions required are :

1) Write uid

2) Write uidNumber

3) Write gidNumber

4) Write loginShell

5) Write unixHomeDirectory

6) Write msSFU30Name

7) Write msSFU30Domain

8) SFU Zone Change Zone Rights.

but until this issue is resolved, please also grant these additional permissions to the SFU Zone:

9) Write displayName

10) Write msSFU30NisDomain

Resolution:

This will be fixed in a future ZPA release.