Change user authentication to internal wipes out passwords

Products

• CA Harvest Software Change Manager - OpenMake Meister
• CA Harvest Software Change Manager
• CA Harvest Software Change Manager - OpenMake Meister

Issue/Introduction

After converting from internal security (authentication) to external security (authentication), if things go bad, and I revert it to internal security (authentication) with the script, its not working.

To convert Harvest users from Internal Security (authentication) to External Security (authentication)

%CA_SCM_HOME%\husrmgr -b <brokername> -usr <userid> -ow -ae="Y" userlist.txt

--------- This command is working correctly.

Backout Plan - To convert Harvest users back to Internal Security (authentication)

%CA_SCM_HOME%\husrmgr -b <brokername> -usr <userid> -ow -ae="N" ad-users.txt   

--------- This command is not working.... It complains that password needs to be provided.    

Why is this?

Environment

CA Harvest SCM all versions and platforms

Resolution

1. Why is the husrmgr utility is asking to update user passwrods when switching from external authentication to internal authentication (-ae="N")? 
   
   When you switch a user from internal authentication to LDAP authentication, the password is no longer maintained within the SCM database. Since users under internal authentication rules must have a password, the husrmgr utility is assuming this information needs to be updated.
   
   
2. How do I effectively backout without any outage? 
   
   - One possibility is to set a default password and enable the feature that would force each user to change their password when logging on for the next time.  The risk with this plan is that another user could could guess the default password and gain access to Harvest that way.
   
   - Another possibility would be to backup the table in the Harvest database containing the user passwords and the flag that indicates whether the user is internally authenticated or externally authenticated.  You could then restore that table from the backup if the switch to LDAP authentication had to be backed out. The one challenge with this approach is that it is an all-or-nothing change. You would not be able to back-out this change for some users but not for others.
   
   
3. Is there a table that I can back up or download the data?
   
   The HARUSERDATA table would be the one to use for backup and restore.
   
   
4. How soon I can revert it back to Internal Security (authentication)? 
   
   You should restore the table and revert back as soon as possible after the back out decision is made. 

Additional Information

More information about the husrmgr command is found here: husrmgr Command-User Manager