Tips for finding Knowledge Articles

  • - Enter just a few key words related to your question or problem
  • - Add Key words to refine your search as necessary
  • - Do not use punctuation
  • - Search is not case sensitive
  • - Avoid non-descriptive filler words like "how", "the", "what", etc.
  • - If you do not find what you are looking for the first time,reduce the number of key words you enter and try searching again.
  • - Minimum supported Internet Explorer version is IE9
Home  >

KB-1957: Permissions setting for ZPA account over SFU Zone

Authentication Service ,  

12 April,16 at 11:47 AM



Applies to: All versions of Centrify DirectControl ZPA running on all Windows platforms.




After setting the documented permissions on the ZPA account for an SFU Zone, I see the following error?


Zone: Centrify.dt/UNIX/Centrify-Zones/Global_Namespace [Global] 

Details: Access denied to user test00007@Centrify.dt in SFU zone Centrify.dt/UNIX/Centrify-Zones/Global_Namespace [Global]. To avoid this, delegate write access on the Active Directory user object. 

[Thu 03 10:45:25.762:Centrify ZPA:Centrify.Provisioning.Agent.exe:Verbose:<4>] DomainPoller.Poll: Access denied on sfu user 'test00007@Centrify.dt' in zone 'Centrify.dt/UNIX/Centrify-Zones/Global_Namespace [Global]' : 'System.UnauthorizedAccessException: Access is denied. 

at System.DirectoryServices.Interop.UnsafeNativeMethods.IAds.SetInfo() 

at System.DirectoryServices.DirectoryEntry.CommitChanges() 

at Centrify.Cfw.DirectoryServices.DirectoryObject.Commit() 

at Centrify.DirectControl.Api.ADData`1.CommitChanges(DirectoryObject dsObject) 

at Centrify.DirectControl.Api.UserProfile2.Commit() 

at Centrify.Provisioning.ZoneWorker.Run()' 

Exception details: System.UnauthorizedAccessException: Access is denied. 




This is a bug in ZPA user account handling.  The usual permissions required are :


1) Write uid

2) Write uidNumber

3) Write gidNumber

4) Write loginShell

5) Write unixHomeDirectory

6) Write msSFU30Name

7) Write msSFU30Domain

8) SFU Zone Change Zone Rights.


but until this issue is resolved, please also grant these additional permissions to the SFU Zone:

9) Write displayName

10) Write msSFU30NisDomain




This will be fixed in a future ZPA release.