Unable to login successfully when multiple users share the same PAM client installation

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

We are not able to login to CAPAM app and it keeps on asking for credentials.

After 4 to 5 attempts it logs in and shows only blank screen.

Environment

Release : 3.4

Component : PRIVILEGED ACCESS MANAGEMENT DOCUMENTATION

Cause

The PAM client was installed on one Windows server, and an application launcher was configured for all users to launch this one PAM client. This is not supported by the current PAM client installation, which uses lock files and cache folders in the PAM client installation folder, not in individual user's AppData or TEMP folder. The PAM client log shows errors like:

2021-04-26 01:48:54 INFO  - 01:48:54 SEVERE: [0426/014854.744:ERROR:cache_util_win.cc(20)] Unable to move the cache: 5     syserr [Chromium Process Logger]
2021-04-26 01:48:54 INFO  - 01:48:54 SEVERE: [0426/014854.744:ERROR:cache_util.cc(134)] Unable to move cache folder C:\CA\temp\web-cache to C:\CA\temp\old_web-cache_000     syserr [Chromium Process Logger]
2021-04-26 01:48:54 INFO  - 01:48:54 SEVERE: [0426/014854.744:ERROR:disk_cache.cc(169)] Unable to create cache     syserr [Chromium Process Logger]
2021-04-26 01:48:55 INFO  - 01:48:55 SEVERE: [0426/014855.119:ERROR:gpu_process_transport_factory.cc(1019)] Lost UI shared context.     syserr [Chromium Process Logger]

Resolution

If you want to use shared PAM client installations rather than have each PAM user install their own client, please make sure that your configuration adheres to the requirement of one concurrent user per PAM client. As of April 2021 this is not clearly stated in online PAM documentation yet, but a request has been submitted to add such a statement.