Summary

Laserfiche Directory Server 10.3 introduced an auditing system for recording changes to a licensing site. The audit recorder can be overzealous recording changes made on an Active Directory or LDAP identity provider on the Identity Providers page in the Directory Server administration site.

This issue can occur when viewing the General tab of an identity provider and updating the Use the following credentials to query the directory server option to use a different username and password. In this situation, Directory Server will record the new username and password in the Directory Server audit log file stored on disk.

Note: The recorded data is not visible from within the Directory Server administration site's reporting view.

Resolution

For Laserfiche Directory Server 10.4.3 (or if you can first upgrade to Directory Server 10.4.3):

1. Please install Directory Server 10.4.3 Update 2.
2. Delete or sanitize the affected log files as detailed below.

Note: Directory Server 10.4.3 Update 2 is included as part of the Laserfiche 10.4.2 installation packages available on the Laserfiche Support Site on or after March 10, 2020. When using the updated installation to install Laserfiche Directory Server 10.4.3 for the first time, the installation process will automatically detect and install the update. If you have not yet installed Laserfiche Directory Server 10.4.3, please download the most recent version of the Laserfiche 10.4.2 installation.

For Laserfiche Directory Server 10.4.2:

1. Please install Directory Server 10.4.2 Update 3.
2. Delete or sanitize the affected log files as detailed below.

For Laserfiche Directory Server version 10.4.1:

1. Please install Directory Server 10.4.1 Hotfix.
2. Delete or sanitize the affected log files as detailed below.

For Laserfiche Directory Server version 10.3.1:

1. Please install Laserfiche Directory Server 10.3.1 Hotfix.
2. Delete or sanitize the affected log files as detailed below.

How to delete or sanitize affected log files

If you do not need to retain the audit log file for changes to identity provider registrations in Laserfiche Directory Server, delete the appropriate log files.

1. As an administrator, browse to the Directory Server's AuditLog folder. By default, the path is C:\ProgramData\Laserfiche\LFDS\AuditLog\.
2. For each Directory Server licensing site, locate and delete all IdentityProviderEvent_ID.log files. Directory Server creates a subfolder for each day's log files (for example, C:\ProgramData\Laserfiche\LFDS\AuditLog\SampleDatabaseName\2020-03-10\IdentityProviderEvent_1.log).

If you cannot delete the log files, use the following PowerShell script to expunge the data from the logs. The script requires administrator rights on the Directory Server host.

KB1014135.zip