Parametrizing the account deactivation reminder email in CA PAM

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

CA PAM has the possibility to email users some days in advance when their account is going to expire. This can be found under Settings --> Global Settings --> Accounts when the "Email Deactivation Reminder" is checked

 

The mail contains a variable, @DeactivationReminderDays@ which contains the number of days before deactivation when the email is sent.

Under Settings --> Credential Manager Settings --> Email Templates there are similar options with a similar format format (e.g. @TargetAccount.getUserName@):

which allow you to customize in the mail fields such as username, targetaccount, first name, and many other

The question is whether such customization is also possible for the "Email Deactivation Reminder" using similar syntax

Environment

All versions up to CA PAM 4.3.0

Resolution

This is not implemented. The only such variable under "Email Deactivation Reminder" is the said @DeactivationReminderDays@, and this even just in the body of the email. Any attempt at inserting any of the variables used for "Email Templates" under the Credential Manager settings will result in it being treated as a string and being printes literally in the reminder email.

We encourage you to open an idea for this feature under BroadCom communities for future consideration.