Symantec VIP Enterprise Gateway - updating the User Store Bind User password / possible issues

Products

• VIP Service

Issue/Introduction

Symantec VIP Enterprise Gateway - The User store Bind User password change can impact validation servers when there are multiple VIP EGs in the environment when not updated on all servers.

Resolution

You have the option to configure VIP Enterprise Gateway with multiple different user stores, allowing for two-factor authentication across various enterprise services. However, if the password of the AD/LDAP Bind user changes, user validations will start to fail. In an environment with multiple Enterprise Gateways, there are three solutions for updating the password:

Solution 1:

• Update the AD/LDAP bind user password individually in each Gateway. When the password is updated in Gateway-1, the other Gateways will continue to experience failures until the password is updated in all of them.
• If the Gateways are load balanced, you can temporarily remove each Gateway from rotation one by one, update the password, and repeat the process for the remaining Gateways. Once updated, you can add the Gateways back into rotation.

Solution 2:

Set up a new Service Account for the Binding user. This allows you to update each Gateway's password one at a time, ensuring that transactions are not affected. After completing the updates, you can safely delete the old account.

Solution 3:

The VIP Enterprise Gateway REST API was introduced in version 9.11.1. This allows an API call to be sent to each Enterprise Gateway instance without the need to login to each server individually. Among the APIs available is the updateUserStorePassword API to update the user store password. For more information please see the VIP Enterprise Gateway REST API Guide.