Identity Manager: Password Policy Invalid Regular Expression Error

Products

• CA Identity Manager

Issue/Introduction

When configuring or saving a password policy in Identity Manager, the operation fails with the following error message: Invalid regular expression

This issue typically occurs in environments integrated with SiteMinder where the regular expression includes characters or patterns that are permitted in earlier versions of Identity Manager (e.g., 12.5, 12.6) but are not natively compatible with the default regular expression engines in newer releases.

Environment

Identity Manager 14.x

SiteMinder 12.8

 

Cause

Identity Manager and SiteMinder utilize different regular expression formats, which can lead to discrepancies in how specific characters are interpreted. By default, SiteMinder uses the Henry Spencer regular expression format, and the PCRE (Perl Compatible Regular Expressions) format is disabled.

Resolution

To resolve this error, you must enable PCRE support in SiteMinder and modify the regular expression to use escaping that is compatible with both engines.

Step 1: Enable PCRE Format in SiteMinder

1. Access your SiteMinder Policy Server configuration.
2. Enable the PCRE format for regular expressions. Refer to the official documentation for specific registry/configuration steps: Support for Regular Expressions in PCRE Format.
3. Restart the Policy Server service.
4. Flush the Policy Server cache.

Step 2: Update the Password Policy Regular Expression Modify the expression to ensure it is accepted by both Identity Manager and SiteMinder. For example, if using brackets and underscores:

• Original Expression: ^\[a-z-A-Z0-9!@#$&?:;.(){}\[\\_\]\]\*$
• Corrected Expression: ^\[a-zA-Z0-9!@#$&?:;.(){}\\\\\[\\_\\\\\\]\]\*$

Note: The double backslashes (\\) are required to properly escape special characters like [ and ] across both Identity Manager and SiteMinder regular expression patterns.