CA IM Users are disabled after 3 wrong passwords

Products

• CA Identity Manager
• CA Identity Governance
• CA Identity Portal
• CA Identity Suite

Issue/Introduction

The Active Directory (AD) password policy is set to lock a user account after 3 consecutive wrong password attempts.  In other words on the 4th wrong password attempt, the account is locked in AD (not disabled).   

 

However, when actioned via CA Identity Manager the account is disabled (disabled flag set to 1).  The provisioning store shows the account eTIMEnabledState attribute value set to 0, but after performing a modify user action with some value to sync data to AD, the provisioning store, user eTIMEnabledState value is synced to 1 and the user is disabled in AD (userAccountControl=514)

 

Example steps to reproduce (In this scenario there is no password policy set IM):

1. Configure Active Directory Authentication Module
2. Configure AD Password Policy to lock account after 3 password attempts
3. Create a test user
4. Successfully lock out user via IDM UI by entering in the wrong password 3 times

Results:

• IDM corporate user store user is disabled (imEnabledState = 1)
• IMPS Global user is enabled.
• AD user is locked but enabled.

 

 

Cause

Programmatic issue.

Environment

Release : 14.1 CP9

Component : IdentityMinder(Identity Manager)

Resolution

CA Identity Manager has supplied a test-fix (DE441255_TF_VAPP.zip) to address this issue.

HF-DE445661-20200206-0001.tgz.gpg" as the final GA (General availability) hotfix and we will go ahead and close this case.
 

Additional Information

DE441255_TF_VAPP.zip is available on request.

While the Test fix has been shown to address the issue, but there are some supplementary issues regarding the synchronization error messages between IM and IP. 
"HF-DE445661-20200206-0001.tgz.gpg" has been released to address this supplementary issue.