Possible to update any attribute through Bulk Loader client.

Products

• CA Identity Manager

Issue/Introduction

When sending updates through Bulk Loader it is possible to update any attribute, including attributes marked sensitive.   How can we prevent this and allow only the attributes designated be updated through bulk loader?

 

Environment

CA Identity Manager 14.x

Cause

By default the Bulk Loader client does not verify attributes loaded.   This is due to backwards compatibility concerns for clients that have upgraded from earlier versions. 

Resolution

Add the attribute EnableBulkLoaderAttributeValidation = true to the Bulk Loader tasks:

 

This is discussed in the documentation under Default System Tasks

• Bulk Loader tasks
  Uploads feeder files that are used to manipulate large numbers of managed objects simultaneously. By default, Bulk Loader tasks validate attributes from the input file header with the appropriate task's screen. To disable this for legacy behavior, set the configuration property EnableBulkLoaderAttributeValidation to false under the Bulk Loader task.
  
  

  Validation skips screen logical attributes.

  Bulk Load Client will not support screen validation: you are expected to use the Bulk Loader Task in the User Console UI to validate your file before performing the actual bulk load via the Bulk Loader Client.