CA Identity Manager Generating the OTP for Forgotten password on a User-based

Products

• CA Identity Manager

Issue/Introduction

One of the customer's Security Team has reported an issue with OTP generation for forgotten password, as it's generating the OTP on a session-based and not on used user-based. They suggested implementing OTP generation on User user-based. The steps for replicating the issue. 

Environment

Non-vapp 14.5.1 on Red Hat Linux

Cause

The OTP generation for forgotten password is generating the otp on a session-based

Resolution

The Engineering Team has Provided an HF that will generate the OTP based on the User-Session instead of Session-based.

Raise a support ticket for the HF

HF-DE628865.zip

 

Additional Information

Reference Defect# DE628865