Unlock Authentication Lockout

Products

• CA Service Management - Service Desk Manager
• CA Service Desk Manager

Issue/Introduction

While modifying the Access Type settings, the configuration was set so that no one, including admin users, are able to log back in.  The end users or Admin user is locked out due to updates made to Access Type in Web UI.

This document describes how to address a lockout, to allow the Admin user back in, in order to correct the configuration

Environment

All releases
CA Service Desk Manager

Resolution

1. Take a backup of the database before making these changes.
   
   
2. Take a backup of the existing Access_Type_v2 table.  In the SDM Server, on an Admin command prompt, run this command to perform the backup.
   

   pdm_extract Access_Type_v2 > access_type_v2-backup.dat

3. Run this command to pull just the "Administration" Access type into a generated admin1.dat file.
   

   pdm_extract -f "Select user_auth, id, sym from Access_Type_v2 where sym = 'Administration'" > admin1.dat

4. Edit the admin1.dat file in Notepad.  It will look something like this:
   

   TABLE Access_Type_v2
       user_auth id sym
       { "2" ,"10002" ,"Administration" }

5. Modify the first entry to change the user_auth value to "1".  This will set the authentication to Open - Always allow access, no password needed.  The change is shown in the example below (highlighted)
   

   TABLE Access_Type_v2
       user_auth id sym 
       { "1" ,"10002" ,"Administration" }

6. Save the admin1.dat file
   
   
7. Load the admin1.dat file into SDM by running:
   

   pdm_load -f admin1.dat

8. Verify that the setting has changed by running
   

   pdm_extract -f "Select user_auth, id, sym from Access_Type_v2 where sym = 'Administration'"

You should then be able to login to SDM as a user with the Administration Access Type, without needing to enter a password.

Additional Information

This will unlock such access for all users under the given Administration Access Type.  Merely knowing a qualifying userid will be sufficient to access the product with such privileges.  It is advised to make this change during low production times and once completed, login to the product and adjust the Authentication setting for the Administration Access Type away from "Open-always allow access" to reduce the chance of a security breach.

For reference, these are the possible user_auth values that may exist. 
0:  No access
1:  Open - Always allow access (no password)
2:  OS Auth
3:  PIN Field Auth