Switching from LDAP to LDAP+RADIUS not working on DEV PAM instance

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

PAM Admin is using PAM with LDAP integration successfully, however they want to know use LDAP+Radius.  They have deleted and re-imported with LDAP+Radius. However they still get the error:  PAM-CMN-0900 - Bad User ID or Password.

 

Environment

Release : 3.4.x, 4.x

Component : PRIVILEGE ACCESS MANAGEMENT

Resolution

Their Radius integration into their LDAP is done of the sAMAccountName attribute.  In PAM the userid wasn't getting imported with the correct username.

We therefore updated PAM LDAP Attributes setting:

(PAM UI >> Configuration >> 3rd Party >> LDAP >> "Double clicked on LDAP Domain" - here their Attributes Tab and updated the Unique Attributes to sAMAccountName=

we then deleted and re-imported the LDAP+Radius groups again and re-imported.

Additional Information

Note: LDAP logins work with any login attribute (distinguishedname, userPrincipalName, sAMAccountName) - but the Radius integration into their LDAP was only using sAMAccountName