Global User Password Updates via Provisioning Manager Force "User Must Change Password at Next Login"

Products

• CA Identity Manager

Issue/Introduction

When updating a Global User's password using the Provisioning Manager, the associated Windows NT account on the Access Control Endpoint is automatically configured with the "User must change password at next login" option. This behavior occurs because the Provisioning Manager performs updates with Administrator privileges, which does not trigger the eTSelfChange attribute required to suppress this password change flag.

Environment

Identity Manager

Cause

This is working by design. The Provisioning Manager logs in as the etaadmin administrator to update the password. Since the update is not initiated by the user, the eTSelfChange attribute (which signals a user-initiated change) is not sent to the target system. By default, the target system interprets this as an administrative reset, which mandates a password change at the next login.

Resolution

To prevent the "User must change password at next login" option from being enabled, you can use one of the following methods:

Method 1: Identity Manager User Console (Recommended) Perform the password update via the Identity Manager User Console's Reset User Password task. This method correctly propagates the eTSelfChange=1 attribute.

Method 2: etautil Command If you must use the command line, use the etautil utility to include the eTSelfChange=1 modifier. Run the following command on the Provisioning Server machine:

etautil -d im -u etaadmin -p <etaadmin_password> update 'eTGlobalUserContainerName=Global Users,eTNamespaceName=CommonObjects,dc=im,dc=eta' eTGlobalUser eTGlobalUserName=<Global_User_Name> to eTSyncAccounts=1 eTSelfChange=1 eTPassword=<New_Password>

Note: Replace <etaadmin_password>, <Global_User_Name>, and <New_Password> with your specific environment values.