Password should be changed today message with CA PAM SC

Products

• CA Privileged Identity Management Endpoint (PIM)

Issue/Introduction

In an endpoint with CA PAM SC installed where the password has been configured with a certain interval, for instance

so password(rules(interval(30))

on reaching the interval every time a user logs in there is a message indicating that the password is expired and must be changed, or if logging in at a later date, for instance a day after the period is exhausted, indicating that the password should have been changed one day before

This is happening even though 

so list

shows that the PASSWORD class is disabled

Also, the messages about password change are just informative: final user can log in as many times as needed after password expiration

Environment

CA PAM SC and PIM, all versions

Cause

This behaviour is controlled by as setting in seos.ini, call_segrace

; If this token is set to "yes", segrace is called upon any login to the 
; system, provided CA Privileged Access Manager Server Control password quality control is on.
; Valid values are "yes" or "no".
; Default Value: No
; call_segrace = No

If this setting is not commented or set to No, segrace will be called every time a user logs in and it will result in the password age being evaluated and this message being shown at login time

Resolution

To prevent this message from popping up, make sure call_segrace is set to No or commented in seos.ini