PAM error PAM-CM-1209: Not permitted to login from here

Products

• CA Privileged Access Manager - Cloakware Password Authority (PA)
• CA Privileged Access Manager (PAM)

Issue/Introduction

When configuring synchronized target accounts for an Active Directory application, you may encounter the error "PAM-CM-1209: Not permitted to login from here." This article explains the cause and the resolution for this error.

Cause

This error occurs because the service account is restricted from logging on to the specific Active Directory domain controllers. To manage passwords in Active Directory, PAM must verify the stored password by attempting a logon to Active Directory with the account name and password, even when a different account is configured to update the password.

If the account is not permitted to "logon to" the domain controllers, authentication fails with LDAP error 49/531 (RESTRICTED_TO_SPECIFIC_MACHINES).

Resolution

1. Identify the account encountering the error in your logs.
2. Review the Tomcat logs for the specific error code.
   • Example: LDAP: error code 49 - 80090308: LdapErr: DSID-0C090449, comment: AcceptSecurityContext error, data 531, v3839
3. Update the user rights assignment for the service account in your Active Directory Group Policy.
4. Ensure the account is granted the "Allow log on locally" or appropriate logon rights for the domain controllers from which the PAM server connects.
5. Retry the password synchronization in PAM.