Authentication Fails with "Illegal characters in username"

Products

• CA Single Sign On Agents (SiteMinder)

Issue/Introduction

Valid users fail authentication unexprectedly.  When the policy server traces are analyzed the trace logs show that authentication failed due to 'illegal characters' in the user name.

===========================

[08/22/2024][16:49:19.674][3152][9168][Sm_Auth_Message.cpp:5947][CSm_Auth_Message::FormatAttribute][s75/r6][transpolaragent][][<UserName>][][<Realm>][<Domain>][][][][][][][][][][][][][Illegal characters in username][Send response attribute 158, data size is 30][][][][][][][][<AuthScheme>][][][][][][][<UserName>][][<Realm_OID>][][][][][][][][][][][Login][49 6c 6c 65 67 61 6c 20 63 68 61 72 61 63 74 65 72 73 20 69 6e 20 75 73 65 72 6e 61 6d 65 ][][][][][][][][][]

[08/22/2024][16:49:19.674][3152][9168][Sm_Auth_Message.cpp:5439][CSm_Auth_Message::SendReply][s75/r6][transpolaragent][][<UserName>][][Reservations_Realm][Transpolar-Domain][][][][][][][][][][][][][][** Status: Authentication Attempt Failed. Illegal characters in username][][][][][][Illegal characters in username][][<AuthScheme>][][][][][][][<UserName>][][<Realm_OID>][][][][][][][][][][][][][][][][][][][][][]

[08/22/2024][16:49:19.674][3152][9168][Sm_Auth_Message.cpp:5443][CSm_Auth_Message::SendReply][][][][][][][][][][][][][][][][][][][][][Leave function CSm_Auth_Message::SendReply][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][00:00:00.000000][]

[08/22/2024][16:49:19.674][3152][9168][Sm_Auth_Message.cpp:944][CSm_Auth_Message::AuthenticateUser][][][][][][][][][][][][][Illegal characters in username][][][][][][][][Leave function CSm_Auth_Message::AuthenticateUser][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][00:00:00.000000][]

===========================

Environment

PRODUCT: Siteminder

COMPONENT: Policy Server

VERSION: ANY

OPERATING SYSTEM: ANY

USER STORE: ANY

Cause

In Siteminder the Asterisk (*) is an illegal character in a User Name. 

Resolution

User Names cannot include an asterisk (*) as part of the user name.  This introduces unexpected results since asterisk is a reserved character used as a wildcard.  This can introduce issues with queries.