Recovering UNIX v2 Endpoint Configuration After IP Address Change

Products

• CA Identity Manager
• CA Identity Governance
• CA Identity Portal
• CA Identity Suite

Issue/Introduction

If a UNIX v2 Endpoint IP address is modified without first updating the endpoint configuration in Identity Manager, the Provisioning Manager may lose connectivity. Attempting to open the configuration in this state will result in an "Endpoint read failed" error, preventing further management of the endpoint. This article outlines the manual recovery procedure using a third-party LDAP browser.

 

Environment

Release : 14.x

Component : Identity Manager

Cause

The Provisioning component maintains a configuration record of the endpoint, including its host IP address, within the Provisioning Directory. When the underlying endpoint IP address is modified externally without first updating this configuration in Identity Manager, the Java Connector Server (JCS) attempts to communicate with the endpoint using the obsolete, stale IP address. Because this connection fails, the Provisioning Manager UI cannot successfully "read" the endpoint state, causing the management console to lock the property sheet and block further configuration updates.

Resolution

Caution: Modifying the Provisioning Directory directly via an LDAP browser is a high-risk operation. Ensure you have a valid backup of the Provisioning Directory before proceeding. Incorrect edits may cause permanent data loss.

1. Launch JXplorer or a similar LDAP browser to access the Provisioning Directory using the following connection parameters:
   • URL: ldap://#prov_server_host#:20391
   • User DN: eTDSAContainerName=DSAs,eTNamespaceName=CommonObjects,dc=etadb
   • Password: Use the Provisioning Directory Shared Secret.
2. Navigate to the following path: etadb > im > UNIX v2.
3. Select the target UNIX v2 Endpoint and update the following attributes:
   • eTDYNHost: Update this to the new IP address of the UNIX endpoint.
   • eTDYNPassword: Input the plain-text password or passphrase required to access the UNIX v2 endpoint.
4. Restart the Java Connector Server (JCS) service and wait for the service to initialize fully.
5. Access the endpoint configuration again using the Provisioning Manager.
6. Re-enter and save the password in the UI. This triggers the JCS to re-encrypt the value in the eTDYNPassword attribute, securing your credentials.

Additional Information

Contact Support If you are unable to restore connectivity or if the "Endpoint read failed" error persists after these steps, please Contact Support for assistance with your Provisioning Directory configuration.