Limitation of " smapsLoginHistory " for " LDAP " repository which is available in ODBC type as indicated in the documentation.

Products

• SITEMINDER
• CA Single Sign On Secure Proxy Server (SiteMinder)
• CA Single Sign On Agents (SiteMinder)
• CA Single Sign On Federation (SiteMinder)

Issue/Introduction

Advanced Password Services (APS) connected to an LDAP-based backend user store (Active Directory) encounters "smapsLoginHistory" attribute growth when invalid credentials are provided during login.

While an option exists to clear this login history when using a "Database" (ODBC) backend user store, this functionality is not available for LDAP repositories.

The "APS.cfg" file controls APS behavior.

- Snippets from APS.cfg file:

Environment

Component: SMPLC (Advanced Password Services (APS))
Release: 12.8 SP08 CR01 (Applicable to all the supported releases)

Resolution

"smapsLoginHistory" is a multi-valued attribute where a new entry is added for every login success or failure. APS does not control multi-valued attributes, whereas "smapsHistory" is a single-valued attribute that the APS stores and updates until a maximum length is reached.

The "smapsLoginHistory" field can be cleared from the "APSAdmin UI" using "Clear" under login history.

APS does not utilize the "smapsLoginHistory" field for any functional purpose. A login entry is added when the login history option is enabled. As per product design, no out-of-the-box (OOTB) solution exists to clear this login history or limit the size, unlike the ODBC configuration.

The recommended approach is to use the LDAP delete command to clear the data. The "smapsLoginHistory" field is not utilized for any functional purpose.

Additional Information

Help Desk Interface (APSAdmin)

- Help Desk Interface (APSAdmin) - 12.52.xx.xx release documentation

Help Desk Interface (APSAdmin)

- KB Document for reference:

How to configure APS (Advanced Password Services) Help Desk Interface (APSAdmin)