Tips for finding Knowledge Articles

  • - Enter just a few key words related to your question or problem
  • - Add Key words to refine your search as necessary
  • - Do not use punctuation
  • - Search is not case sensitive
  • - Avoid non-descriptive filler words like "how", "the", "what", etc.
  • - If you do not find what you are looking for the first time,reduce the number of key words you enter and try searching again.
  • - Minimum supported Internet Explorer version is IE9
Home  >
article

KB-8251: Root is Unable to su to a Zone Enabled Account. Error is: user does not exist.

Centrify DirectControl ,  

17 March,17 at 12:44 AM

Applies to:
  
All versions of Centrify DirectControl

Problem:
  
Root is unable to su to a zone enabled account.  The output that is seen in the session is:
# su - tetsu
su: user tetsu does not exist.


adquery user -A tetsu returns a good, zone enabled profile.
dzinfo -A tetsu shows the user has a login role.
  
User-added image

Cause:

This situation can occur if the zone has been moved in Access Manager so that it is no longer a child zone in a hierarchical zone structure, but the location of the zone container in Active Directory is not changed.  In the example below, the child zone is named test and the parent zone is named Global.

In Active Directory, and in the adinfo output below, the test zone still appears to be a child of the Global zone. 
  
User-added image

The adinfo on a machine in the test zone shows the path to the zone.  The path implies that test is a child zone of Global as well.
  
User-added image
  
However, in Access Manager, it can be seen that the test zone is actually parallel with the Global zone.
  
User-added image

When the test zone was moved in the Access Manager, a prompt appeared asking if the location of the zone (inside Active Directory) should be moved as well.  
  
User-added image

In this case, the response was No.  This left the test zone container in the same location in ADUC, giving the wrong impression that the test zone is still a child zone of Global, in both the outputs from adinfo and when looking into ADUC

Resolution:
  
If the zone was moved in error, it can be fixed by reparenting the zone. The following KB article includes the instructions on reparenting a zone.

KB-8384: Best Practices When Reparenting a Zone​

Still have questions? Click here to log a technical support case, or collaborate with your peers in Centrify's Online Community.