Switching SDM to SAML Authentication; Users With Access to SDM and ITAM Show Duplicated

Products

• CA Process Automation Base
• Process Automation Manager

Issue/Introduction

We are preparing to switch our Service Desk Manager, Service Catalog, and xFlow Analyst to a SAML authentication and it is working properly. However, ITAM and PAM would still be using EEM, since SAML is not available. Since our EEM connects to our Active Directory which uses userIDs as the username and our SAML connection to Okta uses email addresses as email addresses, I found that users who have access to both SDM and ITAM had issues after the userid values were updated. I logged into ITAM and authorized my account from EEM and was able to log into that, but I found I have two records in ca_contact now. This will cause some confusion when users are selecting contacts in SDM. Is there anyway to authorize EEM users in ITAM without creating duplicate contacts in SDM?

Environment

Release : 17.3

Component : ITAM - EEM

Resolution

Here is how to convert ITPAM and ITAM users to enable login using the email address instead of the userid:

In EEM:

- Change User Store attribute mapping so that UserName maps to the email address field in LDAP
- Re-assign application groups to the necessary records for PAM

In the MDB:

- Update the contact records usernames

For communication between the applications:

- Generate a new SOAP web services policy and usmcertfiles
- Restart services

For CA Process Automation and CA Service Catalog update the user credentials in the Options Manager:
  - caextwf_ws_user
  - caextwf_ws_password
  - casc_user
  - casc_user_password

And then recycle SDM services to update the NX.env files on all servers.