Resolving Identity Manager and Siteminder Integration Conflicts

Products

• CA Identity Manager
• CA Identity Suite

Issue/Introduction

When attempting to integrate Identity Manager with a Siteminder Policy Server, the process may fail if an environment object with the same name already exists on the target Policy Server. The integration will report an error stating that the environment already exists, preventing the creation of necessary objects.

Environment

Identity Manager

Cause

Siteminder Policy Server requires unique identifiers for environment objects during integration. If you attempt to point a new Identity Manager installation at an existing Policy Store that already contains objects with names matching the new environment (e.g., "IdentityEnv," "IDM"), the Policy Server rejects the API call to prevent duplication.

Resolution

To resolve this integration conflict, you must manually clean up the conflicting objects in the Siteminder Policy Store.

1. Access XPSExplorer: Use the XPSExplorer tool (located in the Siteminder bin directory) to identify and delete conflicting objects.

2. Delete Conflicting Objects: Remove the following objects associated with the conflicting environment name (e.g., "IdentityEnv"):

   • IMS Environment
   • IMS Domain
   • IMS Auth Schemes

   Note: These objects can be deleted via XPSExplorer or the Siteminder AdminUI.

3. Verify Clean Store: Run an XPSExport command to create a full dump of the Siteminder Policy Store and confirm the conflicting property name no longer exists:

   XPSExport full_dump.xml -xb

4. Restart and Sync:

   • Restart the Identity Manager server.
   • Access the Identity Manager User Interface.
   • Proceed with creating the environment objects to sync them with the Policy Server.