dxPwdLoginTime Attribute Cleared by 'Change My Password' Task

Products

• CA Identity Manager
• CA Identity Governance
• CA Identity Portal
• CA Identity Suite

Issue/Introduction

When the "Change My Password" task is executed within Identity Manager, the dxPwdLoginTime operational attribute on the user object in the CA Directory UserStore may be unexpectedly cleared. This attribute is typically used to capture the user's last login time. This article explains why this occurs and how to configure the environment to maintain the attribute's value.

Environment

Identity Manager

Cause

The dxPwdLoginTime attribute is cleared because of how CA Directory handles password updates.

• Self-service changes: If a user changes their own password, the attribute is preserved.
• Administrative/Proxy changes: Identity Manager uses a "proxy ID" to perform updates. When this proxy ID submits a password change for another user, CA Directory treats it as an administrative change and clears the dxPwdLoginTime value.

Resolution

To prevent the dxPwdLoginTime attribute from being cleared during password changes initiated by Identity Manager, ensure the CA Directory password-proxy-user setting is correctly configured.

1. Identify the Proxy User: Locate the user ID configured as the proxy in your Identity Manager UserDir.xml configuration file.

2. Configure CA Directory: Configure the CA Directory DSA to recognize this proxy user as an authorized administrator for password changes. You must set the password-proxy-user parameter to match the DN (Distinguished Name) of the Identity Manager proxy user.

3. Verify Settings: Once the password-proxy-user is set, CA Directory will maintain the dxPwdLoginTime attribute during password updates initiated by Identity Manager.

4. Reference: For additional configuration details, refer to the following documentation: Use Password Settings to Administer User Accounts.