Sometimes when logging in to CA PAM and trying to carry out any LDAP operation, the process results in failure. At the same time, the dashboard shows a message indicating that "PAM-CMN-0628: An LDAP operation is in progress" 

The system stays in this state for a long time suggesting that a process may be hung. For as long as LDAP Sync is in progress but stuck, neither refreshes of existing device or user groups, nor import of new LDAP groups, is possible.

PAM launches a separate process to refresh LDAP groups at the time intervals configured on the Configuration > 3rd Party > LDAP page.

The same process is launched when a PAM Administrator tries to refresh an existing group or import a new group. PAM allows only one instance, so while an instance is running, the PAM administrator will not be able to do a refresh or import.

In September 2020 a problem was identified that may cause the LDAP import/refresh process to hang. All releases supported as of September 2020, including the latest maintenance releases 3.4.1 and 3.3.4, are affected.

CA Privileged Access Management versions up to 3.3.4 and 3.4.1.

If cluster cannot be restarted and/or primary site lead node (where LDAP import takes place) cannot be restarted either, please engage Broadcom Support so that they can access your system and correct the issue manually by killing the appropriate processes.

As a preventive action, in case this is caused by excessive LDAP synchronization time causing two successive processes to overlap, increase the LDAP refresh interval under the Third Party options in Configuration.

A problem that may cause the process to hang has been identified and will be fixed in 3.4.2 and later releases.