> Source: [sk178832](https://support.checkpoint.com/results/sk/sk178832)

# sk178832 - Identity Awareness fails to authenticate user when the account unit contains branches that are not of the same domain

| Property | Value |
|----------|-------|
| Solution ID | sk178832 |
| Date Created | 2022-04-20 |
| Last Modified | 2026-03-04 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82, R81.20, R81.10 (EOS), R81 (EOS) |
| OS | Gaia |

## Symptoms

- * After an upgrade from a version lower than R80.40 to version R80.40 and higher, Identity Awareness fails to authenticate all users and machines, from all Identity Sources.
* In SmartConsole log files, "`Failed Login`" logs appear with this error message: "`Group membership of the required account (user or machine) could not be retrieved from the AD. Make sure the account exists in the AD.`"
* Debug files for the Policy Decisoin Point (PDP) Gateway show these error messages (or similar):

  ```
  [62276 4057958272]@ELFW02[18 Apr 14:48:09] res_errno: 10, res_error: <0000202B: RefErr: DSID-031007F9, data 0, 1 access points
  	ref 1: 'co.il'
  >, res_matched: <>
  ```

## Cause

In R80.40, a new mechanism was introduced to reduce the load from the PDP Gateway that performs the LDAP searches to the domain controllers.  

This feature starts the LDAP search from the common path of all the branches defined in the Account Unit.  

For example, in the Account Unit for a specific domain, this is the configuration of the branches:  

```
OU=Marketing,OU=users,DC=company,DC=co,DC=il

OU=Engineers,OU=users,DC=company,DC=co,DC=il

OU=Marketing,OU=computers,DC=company,DC=co,DC=il

OU=Engineers,OU=computers,DC=company,DC=co,DC=il
```

<br />

The common path of all these branches is **DC=company,DC=co,DC=il**   
In versions R80.40 and higher, the PDP starts the LDAP search at this path instead of at the root of the AD forest. The new path is more efficient.  

An issue may occur when the branches in the account unit do not all have the same common path.  

For example:  

```
OU=Marketing,OU=users,DC=mycompany,DC=co,DC=il

OU=Engineers,OU=users,DC=yourcompany,DC=co,DC=il

OU=Marketing,OU=computers,DC=mycompany,DC=co,DC=il

OU=Engineers,OU=computers,DC=yourcompany,DC=co,DC=il
```

<br />

In this example, there are branches of two different domains. The common path is "`DC=co,DC=il`" This is **not** avalid branch because there is no active directory domain called "`co.il`".The LDAP server sends a referral in response to the request from PDP. The authentication fails because the PDP does not follow referrals.  

An error in the PDP debug sshow:  

```
[62276 4057958272]@ELFW02[18 Apr 14:48:09] res_errno: 10, res_error: <0000202B: RefErr: DSID-031007F9, data 0, 1 access points

� � ref 1: 'co.il'

>, res_matched: <>
```

<br />

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content