Identity Manager: UNIX v2 Account Creation Defaults to 0 for Password Attributes

Products

• CA Identity Suite
• CA Identity Manager

Issue/Introduction

During account creation on a UNIX v2 endpoint, several password-related attribute fields are automatically populated with a value of 0, even when the associated Account Template has no values defined. Users typically expect these fields to remain empty so the endpoint’s local operating system (OS) password patterns can take effect. This article explains the design behavior of the UNIX v2 connector regarding default values and how to align Identity Manager with OS-level requirements.

Environment

Identity Manager 14.x & v15

Cause

This behavior is "working as designed" within the UNIX v2 Connector metadata. The connector is configured with hardcoded default values for specific password parameters. For example, the metadata XML for Password Max Age specifies default=true and value=0. If no explicit value is provided during the account creation process, the Java Connector Server (JCS) sends the default value defined in the metadata rather than an empty value.

Resolution

To ensure that new accounts receive the desired security settings, you must explicitly define them in Identity Manager rather than relying on the OS defaults.

1. Sync Account Templates with OS Patterns:

   • Identify the specific password policy values configured on your UNIX operating system.
   • Update the corresponding Account Template in Identity Manager with these exact values.
   • During account creation, these template values will override the connector's 0 default and pass the correct configuration to the endpoint.

2. Product Enhancement Requests:

   • Currently, the connector does not support sending "empty" values for these fields to allow the OS to use its internal defaults.
   • If you require the ability to send null/empty values, please submit a product enhancement request (Idea) via the Broadcom Software Ideation portal under the Symantec IGA category.