Failure to add a target account with error " PAM-CM-0572: An error occurred; if this problem persists then please ask your Administrator to investigate. "

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

Trying to onboard a target account to PAM for a given application results in the following generic error:

"PAM-CM-0572: An error occurred; if this problem persists then please ask your Administrator to investigate.  "

 

Environment

CA PAM all releases

Cause

This is a generic error message, so there may be many underlying causes to it

Here we are focusing in one of the possible reasons for this to happen

The set up causing this is the following

• Target Application A with a Password Composition Policy (PCP A) requiring complexity (for instance a minimal lenght of 8, letters, numbers and one special char)
• Target Application A is associated to Target Server B
• Target Account C is in Target Server B with a simple password, for instance ABC567
• Trying to onboard Account C results in the error message reported

This is caused because of a mismatch between the simple password of Target Account C and the complexity required by PCP A.

Let's imagine the password of Target Account C in Target Server B is ABC567, and the minimal complexity password which would fit PCP A is Abc@567

To onboard Target Account C we need to specify its password in Target Server B, so ABC567, but when trying to do so, PAM will run the password past PCP A, and it is clear that it does not meet the pasword complexity required.

Hence it will fail and it will throw out the error reported

Resolution

There are two possible resolutions

• Ask the owners of Target Server B to change the password for Target Account C so that is meets the criteria of PCP A. Then try to onboard the account again
• Momentarily disable PCP A in Target Application A. This will allow Target Account C to be added with its simple password. Then PCP A can be reenabled in Target Application A, which means that any new password for Target Account C, be it manually added or generated through the "Generate Credentials" button, will have to abide by PCP A