Administrative user creation with etaadmin or dsaadmin privileges - CA Identity Suite

Products

• CA Identity Manager
• CA Identity Governance
• CA Identity Portal
• CA Identity Suite

Issue/Introduction

Instructions are required to create new administrative users that possess the same privileges as the default 'etaadmin' and 'dsaadmin' accounts. This requirement typically arises from internal auditing policies that mandate unique user accounts for administrative actions.

Environment

• Release : 14.X
• Component : CA IDENTITY SUITE (VIRTUAL APPLIANCE)

Resolution

CA Directory (dsaadmin)

The 'dsaadmin' user (cn=dsaadmin,ou=im,ou=ca,o=com) is defined as a super-user using CA Directory access controls.  While it is possible to configure multiple super-users, it is recommended to configure an 'admin-user' with specific subtree permissions instead.

1. Log in as the 'dsa' OS user. (su - dsa from config user)
2. Edit the access control configuration file: /opt/CA/Directory/dxserver/config/access/vapp-default.dxc.
3. Locate the settings for the 'imadmin' user.
4. Uncomment the set admin-user command.
5. Define the required sub-tree and restricted permissions for the new user.

See CA Directory Access Controls for detailed configuration options.

Provisioning (etaadmin)

The 'etaadmin' user is a provisioning administrator. The most efficient method for creating a new administrator with these rights is to duplicate the existing user.

1. Log in to the IM Provisioning Manager as the 'etaadmin' user.
2. Navigate to Users > Search.
3. Select the 'etaadmin' user.
4. Right-click and choose Duplicate from the context menu.
5. Enter the username and password for the new administrative user.