KB293435: The out-of-the-box Administrator user inherits the privileges of the LDAP Public / Guest group when the Administrator user is linked to an LDAP user

SUMMARY
This document describes a situation that occurs when linking the Strategy Administrator user to an LDAP user in Strategy 10.x.
 
SYMPTOM
After configuring the Administrator user to use LDAP authentication by specifying a distinguished name under the “LDAP Authentication” field in the user editor, the Administrator loses its default access and privileges to the project and instead inherits the access and privileges of the “LDAP Public / Guest” group.
 
After doing this, the following message will be seen in the Authentication server trace when the Administrator logs in:
 

2016-01-19 13:43:59.336-06:00 [HOST:chl-prodmsl1][PID:81937][THR:2990171904][Authentication Server][Trace] LDAP authentication trace: user xxxxxx login as nonimported LDAP user

 
CAUSE
The behavior occurs because the MSI_LDAP_NO_LINK_TO_PREDEFINED system environment variable is initialized to be false by default in Strategy 10.x.  When this variable is false it prevents out-of-the-box objects such as the Administrator user from successfully being linked to a user account on the LDAP server. 
 
 
ACTION
If the Strategy Intelligence Server is on Windows, add the entry MSI_LDAP_NO_LINK_TO_PREDEFINED to the environment system variables and set the value to be 1.
If the Intelligence Server is on Linux/Unix edit the LDAP.sh file so that entry for MSI_LDAP_NO_LINK_TO_PREDEFINED is set to 1 as seen below:
 

# Environment variable for LDAP disallow linking to predefined MSTR user/groups: 0 for allow, 1 for disallow

MSI_LDAP_NO_LINK_TO_PREDEFINED=0

export MSI_LDAP_NO_LINK_TO_PREDEFINED

  
Alternatively, a copy of the out-of-the-box Administrator can be created and this copied user can be successfully linked to an LDAP user without modifying the environment system variables or the LDAP.sh file.