PAM-UI-2551 When Trying to Connect With Some Target Accounts

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

When trying to use credentials to RDP or SSH to respective servers, the end user gets "PAM-UI-2551: Password view request error. Please contact your system administrator" after 2 minutes of waiting for it to connect. This is happening for some target accounts, but not for others.

Cause

The password view policy configured for the affected target accounts had the "Change Password On View", "Change Password on Auto Connect" and "Check-out/Check-in" options enabled, unaffected target accounts used the default password view policy that did not utilize these options.

When any of these three options are used in a PVP, PAM will create a scheduled job to either change the account password and/or check the account in. In this instance, there were previous check-in scheduled jobs that were stuck in the scheduled status despite the dates to run them being months prior.

To confirm if the issue is with the scheduled jobs in the database, attempt to create a test scheduled job to rotate the password of a test account. In this instance, creating the scheduled job failed with the "PAM-UI-1009: Communication failure" error.

Resolution

Resyncing the primary cluster site allowed the previous scheduled jobs to run and the passwords could now be viewed. Auto-login connections to the target account were also successful.

To resync a cluster site, go to Configuration > Clustering > Status, select the site, and click Re-sync Site.