Forgotten Password TEWS Search Failure in Clustered Environments

Products

• CA Identity Manager

Issue/Introduction

In a clustered environment, the ForgottenPasswordSearch TEWS call may fail when the Password Hint answer is processed. The Identity Manager application server logs report the following error:

ERROR [com.netegrity.ims.tabhandlers.ForgottenPasswordSearchHandler] (default task-4) search(): Could not find a user matching the information provided

This occurs even when the user information is correct.

Environment

• Product: CA Identity Manager
• Component: TEWS API / Forgotten Password Task
• Release: 14.x
• Configuration: Multiple Identity Manager (IM) nodes in a cluster behind a Load Balancer or Proxy Server.

Cause

By design, the full sequence of TEWS calls for the Forgotten Password public task must be processed by the same Identity Manager node. If a Load Balancer or Proxy Server redirects the Password Hint call to a different node than the one that initiated the search, the task context is lost, resulting in a failure to find the matching user.

Resolution

To ensure task continuity, you must configure your network infrastructure to maintain session affinity (stickiness) for the duration of the public task.

Configure the Load Balancer or Proxy Server to ensure that the complete set of TEWS calls for a single Forgotten Password transaction is routed to the same Identity Manager node.

This can typically be achieved by:

1. Enabling Session Persistence or Sticky Sessions based on source IP or session cookies.
2. Ensuring the timeout for the persistent session is long enough to cover the user's interaction time for answering hints and resetting the password.

 

Additional Information

Documentation: Forgotten Password Admin Tasks SOAP Calls via TEWS API