Differentiating Provisioning Server and Connector Server Connections in ConnectorXpress

Products

• CA Identity Suite
• CA Identity Manager
• CA Identity Governance

Issue/Introduction

This article clarifies the appropriate use cases for connecting to a Provisioning Server versus a direct Connector Server within ConnectorXpress. Using the incorrect connection type based on your product architecture can lead to data discrepancies, communication errors, and unexpected behaviors in Identity Manager or Identity Governance environments.

Environment

Identity Manager 14.x & 15

Cause

Customers have reported the following issues when using incorrect connection types:

• "Communication Error" when attempting to connect directly to a Connector Server (JCS/CCS).
• Errors such as java.lang.IllegalArgumentException: Not a full DN: "dc=etasa" during endpoint discovery.
• Unable to access connector server URLs or import certificates via ConnectorXpress.
• Discrepancies where new accounts are visible in the Connector Server but missing from the Provisioning Manager/Identity Manager console.

Connecting directly to a Connector Server in an environment managed by a Provisioning Server bypasses the Provisioning Repository. This prevents the Provisioning Server from synchronizing updates across all managed nodes and updating its own internal data store, leading to data inconsistency.

Resolution

Follow these guidelines to select the correct connection method in the ConnectorXpress right-panel:

1. Identity Manager / Identity Suite Environments

   • Action: Use Add Provisioning Server.
   • Requirement: Always connect to the Provisioning Server (typically ports 20389 or 20390).
   • Reason: The Provisioning Server acts as the central authority. It ensures all updates are committed to the Provisioning Repository and automatically propagates changes to all associated Java or C++ Connector Servers.

2. Standalone Identity Governance Environments

   • Action: Use Add Connector Server.
   • Requirement: Connect directly to the Java Connector Server (typically ports 20410 or 20411).
   • Reason: Use this method only when Identity Governance communicates directly with a JCS without an intermediate Identity Manager/Provisioning layer.

3. Best Practices for Connectivity

   • Verify connectivity to the target port using telnet or ping before attempting to add the server in ConnectorXpress.
   • Ensure firewall rules allow traffic between the ConnectorXpress workstation and the server ports (20389/20390 for Provisioning; 20410/20411 for JCS).
   • For vApp-based environments, ensure the correct Provisioning Server node is targeted to avoid "mismatched shared secret" errors during inbound synchronization.