Edit Dial-in Network Access Permission setting

Question

Greetings.
My goal is to set for some ADSAccount users property Network Access Permission(same in Manager 'Dial-up permitted') to 'Control access throught NPS Network Policy' (tab 'Dial-in' in ADUC; tab 'RAS' in OneIM Manager).

When i try to manage this attribute in OneIM get an error in JobQueueInfo:
[1777018] Error running synchronization project (Active Directory Domain (DC=my,DC=LOCAL))'s workflow (Provisioning).
[1777124] Error running synchronization step (user) of synchronization configuration (Provisioning (Provisioning)).
[1777004] Method (Update object (Update)) could not be run successfully.
[2226223] Error writing RAS properties of user account ras_test_user to server ad.my.local. (Error: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED)))

I thought that there was a bug in OneIM version installed in my production environment.
So I install brand new deployment OneIM 8.2 with fresh connection to my test Active Directory domain.
for user account for accessing Active Directory had been granted domain admin rights
but still have same issues when try to provisioning mentioned attribute.

when sychronize object from Active Directory domain all fine

Has anyone ever encountered such a problem?
any suggestions or recommendations

Markus Weiss-Ehlers · Answer

As mentioned in the documentation here 
 Users and permissions for synchronizing with Active Directory 
 https://support.oneidentity.com/technical-documents/identity-manager/9.1.1/administration-guide-for-connecting-to-active-directory/2 
 "Setting Remote Access Service (RAS) properties requires Remote Procedure Calls (RPC) which are run in the context of the One Identity Manager Service user account. To read or write these properties, the One Identity Manager Service user account must have the necessary permissions." 
 does the One Identity Manager Service user account needs the permissions to set the RAS properties.

si aksenov · Answer

It was really hard, but I made it.
At first I thought about limited delegation, but that was a dead end
Therefore, if the “Single Identity Manager Service User Account” does not match the “User to Access Active Directory”, then to be able to edit the RAS settings OOTB for "Single Identity Manager Service User Account" need read & write permissions on user objects in Active Directory:
account restrictions
msRADIUS-FramedIpv6Route
msRADIUS-FramedIpv6Prefix
msRADIUS-FramedInterfaceId
msRADIUS-SavedFramedIpv6Route
msRADIUS-SavedFramedIpv6Prefix
msRADIUS-SavedFramedInterfaceId
msRADIUSCallbackNumber
msRADIUSFramedIPAddress
msRADIUSFramedRoute
msRADIUSServiceType
msRASSavedCallbackNumber
msRASSavedFramedIPAddress
msRASSavedFramedRoute
msNPAllowDialin
msNPCallingStationID
msNPSavedCallingStationID

to make some of these attributes to appear in dsa.msc need to edit %systemroot%\System32\dssec.dat file

Edit Dial-in Network Access Permission setting

Top Replies

Users and permissions for synchronizing with Active Directory

Users and permissions for synchronizing with Active Directory