HCP System Management Help


Group account collisions

Each HCP group account you create in an HCP system has an internal ID that uniquely identifies it. As a result, two group accounts created on different systems are different from each other, even if they are created from the same Active Directory group and are defined for the same HCP tenant. (An HCP group account always has the same name as the AD group it’s created from, so group accounts created from the same AD group on two different systems have the same name as each other.)

A group account collision occurs when the replication service tries to replicate a group account from one system to another system that already has a different group account created from the same AD group, where both group accounts are defined for the same tenant.

Here’s a scenario that shows how a group account collision can cause the replication service to pause replication of a tenant. In this scenario:

System A and system B replicate to each other over active/active link AB.

Link AB includes tenant T1, so T1 exists on both systems.

These events occur in the order shown:

1.On system A, you create an HCP group account for T1 from the AD group named AD1. The name of the group account you create is AD1.

2.Before AD1 is replicated to system B, you create an HCP group account for T1 from the AD group named AD1 on system B. The name of the group account you create is AD1.

3.The replication service tries to replicate the HCP group account named AD1 to system B. The replication is unsuccessful because a different group account named AD1 already exists on system B. As a result, the service automatically pauses replication of T1 on link AB.

To recover from a group account collision, you can delete the group account on either of the systems involved in the link.

© 2017 Hitachi Vantara Corporation. All rights reserved.