UnlockUser task behaviour via TEWS in v14.4 vs v14.5

Products

• CA Identity Suite

Issue/Introduction

In Identity Manager v14.4, the 'UnlockUser' task could be executed via TEWS even if the user account status in the user store was active or enabled. However, in v14.5, this same action results in an error. What has changed?

<soapenv:Envelope xsi:schemaLocation="http://schemas.xmlsoap.org/soap/envelope/ http://schemas.xmlsoap.org/soap/envelope/" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:tews="http://tews6/wsdl" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
   <soapenv:Body>
      <soapenv:Fault>
         <faultcode>soapenv:Client</faultcode>
         <faultstring>Error performing operation.</faultstring>
         <detail>
            <tews:ImsException version="6.0">
               <tews:exception>
                  <tews:name/>
                  <tews:code>500</tews:code>
                  <tews:description>Your account is not disabled, you should be able to access your account.
 ProcessStep::BLTHValidate TabName: null ERRORLEVEL::Error</tews:description>
                  <tews:transaction>187234fd-c2902390-7f6d740c-3e44417</tews:transaction>
                  <tews:msgKey>14001</tews:msgKey>
               </tews:exception>
            </tews:ImsException>
         </detail>
      </soapenv:Fault>
   </soapenv:Body>
</soapenv:Envelope>

Environment

Identity Manager v14.5

Resolution

This feature was discontinued due to a security bug. In line with the security model, the unlocking of a user account is now only permitted when the account is in a disabled status. Customers who relied on this feature are asked to update their solutions to align with this new behavior.