Resolving LDAP Error 53 During Password Reset - Identity Manager

Products

• CA Identity Manager
• CA Identity Governance
• CA Identity Portal
• CA Identity Suite

Issue/Introduction

This article addresses an LDAP error (code 53: WILL_NOT_PERFORM) encountered during user password resets. This issue typically occurs when there is a mismatch between the Active Directory endpoint security settings and the Identity Manager Authentication Module properties.

Environment

Identity Manager 14.5 & 15

Cause

The LDAP error code 53 (WILL_NOT_PERFORM) occurs when the Identity Manager Environment is configured to communicate via non-SSL (Port 389) while the Active Directory endpoint is strictly configured to enforce SSL communication.

Resolution

1. Navigate to the Identity Manager Management Console > Environments.
2. Select the relevant environment and proceed to Advanced Settings > User Console > Authentication Properties.
3. In the Module Properties section, verify the current settings for the Active Directory configuration.
4. Update the Port field to 636 (or the appropriate secure LDAP port).
5. Set the SSL property to True.
6. Click Save twice, ensure the Active Directory configuration is selected, and click Restart Environment.
7. Import the Active Directory CA certificate into the Identity Manager keystore on both the Provisioning Server and Identity Manager Server machines: keytool -importcert -file <cert_file> -keystore $JAVA_HOME/jre/lib/security/cacerts
8. Restart the Identity Manager service. For Virtual Appliance deployments, use the stop_im / start_im aliases.

Additional Information

For further information, see the documentation Manage Authentication Module Properties - 14.5 or Manage Authentication Module Properties - v15

To speak with a customer representative or a Support Engineer see Contact Support. Scroll to the bottom of the page and click on your respective region.