Service Account Lockout During Identity Manager Startup Due to Directory Attribute Mismatch

Products

• CA Identity Manager
• CA Identity Suite

Issue/Introduction

During the startup process of Identity Manager, the service account may become locked, accompanied by the following exception error in the logs:

com.netegrity.llsdk6.imsapi.exception.SmApiWrappedException javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C090453, comment: AcceptSecurityContext error, data 775]

This issue typically occurs when the configuration incorrectly references a user attribute that does not align with the LDAP authentication requirements.

Environment

Identity Manager 14.x

Cause

The error is caused by a misconfiguration in the directory.xml file. The identity store is configured to use the userPrincipalName attribute for authentication, whereas the Identity Manager service account requires the distinguishedName attribute.

Resolution

To resolve this issue, you must update the directory.xml file to point to the correct attribute.

1. Locate the directory.xml file on your Identity Manager server.
2. Open the file in a text editor.
3. Locate the section defining the directory attributes.
4. Change the attribute from userPrincipalName to distinguishedName.
5. Save the changes and restart the Identity Manager service.