CA Identity Manager PAM Integration Fails with Unwilling to Perform Error
Article ID: 234674
Updated On:
Products
Issue/Introduction
When integrating CA Identity Manager (IAM) with CA Privileged Access Manager (PAM), the PAM user account creation may fail even if the associated Active Directory (AD) account is created successfully. This issue is typically characterized by the following error reported in the Provisioning Manager:
ETA_E_0016, Account for Global User 'x' on Endpoint 'CA PAM' creation failed: :ETA_E_0004, Account 'DS' on 'CA PAM' creation failed: Connector Server Add failed: code 53 (UNWILLING_TO_PERFORM)... PAM: peer not authenticated
This article provides steps to resolve this failure, which is often caused by certificate mismatches during the secure handshake.
Environment
Identity Manager 14.x & 15
Cause
The error "PAM: peer not authenticated" often occurs because the "PAM Server" attribute in the Identity Manager endpoint configuration does not match the Subject Alternative Name (SAN) defined in the certificate presented by the PAM server. The connection is rejected by the connector because the certificate identity cannot be verified against the configured endpoint address.
Resolution
To resolve this integration failure, perform the following verification steps:
- Validate Endpoint Configuration: Ensure the value configured in the "PAM Server" attribute within the Identity Manager Endpoint settings matches the exact hostname provided in the PAM Server’s certificate SAN.
- Verify Certificate SAN: Inspect the certificate exported from the PAM server. The "Subject Alternative Name" field must contain the specific hostname or FQDN that you have configured in the Identity Manager "PAM Server" field.
- Note: If you are using an IP address in the configuration, ensure it is explicitly listed as a SAN in the PAM certificate. Using a hostname is recommended for better compatibility.
- Cross-Reference Integration Requirements: Refer to the official Broadcom TechDocs, see Additional Information, for detailed security prerequisites and connector-specific configuration
Additional Information
Feedback
