Target account name impact on Active Directory password rotation - PAM
Article ID: 263552
Updated On:
Products
Issue/Introduction
A third-party software uses the PAM API to get an Active Directory target account name. However, the account name comes back as <account name> rather than <account name>@<domain>, which causes issues with the third-party software. If the target account name was updated to be <account name>@<domain>, would it have an impact on PAM's ability to rotate the password?
Environment
CA Privileged Access Manager (PAM) Credential Management for Active Directory accounts
Resolution
When PAM rotates an Active Directory account's password, it uses the Distinguished Name configured under the Active Directory tab to make the LDAP connection.
If the target account name is changed and the Distinguished Name still matches the user in Active Directory, then PAM will still be able to rotate the account's password in Active Directory. If the account in PAM is used for Credential Management only, the account name can be changed to meet the needs of the third-party software.
However, if there is an access policy associated with the target account, the RDP auto-connect will stop working. As such, this change can only be done for AD target accounts without access policies.
To accommodate both use cases, the code calling the PAM API to get target account details would have to be updated to get the domain name from the distinguished name, which is part of the target account details, or it could get the ID of the associated target application from the account details, make another call to get the target application and get the domain name from the target application details.
Additional Information
An attempt to launch an RDP access session with a target account configured for auto-login that uses account name syntax <name>@<domain> will fail with the following error:
The Windows security event log on the RDP server will show an Audit Failure event with ID 4625 and contents similar to the following:
Feedback
