Adding newer versioned CentOS Provisioning Server vApp node into an older CentOS vApp cluster is caused credential corruption in Provisioning Directory

Products

• CA Identity Suite
• CA Identity Manager

Issue/Introduction

After deploying a new CentOS 8 Provisioning Server vApp node into the existing Centos6 environment (as part the the Centos Migration), Provisioning Server cannot connect to Provisioning Directory and etatrans log shows similar to the following message

      ldaps://impd-machine-name:20391. Failed to connect: RC=LDAP_INVALID_CREDENTIALS (0x31) Retry=0
      ***** STARTUP ERROR [EtaServer] *****: Required directory DSA 'impd-main' is not available.  Shutting down IM Provisioning Server.
      ***** SHUTDOWN of Identity Manager Provisioning Server initiated *****

Identity Manager fails to connect to Provisioning Server using etaadmin, and Identity Manager server log shows similar to the following message

 ERROR [stderr] (MSC service thread 1-10) javax.naming.NamingException: JBAS011843: Failed instantiate InitialContextFactory com.sun.jndi.ldap.LdapCtxFactory from classloader ModuleClassLoader for Module "deployment.iam_im.ear.user_console.war:main" from Service Module Loader [Root exception is javax.naming.AuthenticationException: [LDAP: error code 49 - :ETA_E_0302<BGU>, Bind to provisioning server as 'etaadmin' failed: Invalid credentials or Global User is locked ]]

 

Environment

Identity Suite Virtual Appliance 14.x
Identity Manager 14.x

Resolution

To workaround Provisioning Server connection issue to Provisioning Directory, first set the access to 'Anonymous' then login and modify the userPassword as described in the documentation.

Reset Provisioning Directory Credentials

After those changes, restart Provisioning Server.

 

 

To workaround  Identity Manager connection issue to Provisioning Server, create a tempuser that has Domain Administrator profile as per below KB article and login as the tempuser to recreate or reset etaadmin password using Provisioning Manager

How to re-create inadvertently-deleted etaadmin in Provisioning Manager?

After those changes, restart Identity Manager