Does CA PAM user Broadcom's propriety API calls for operations related to Active Directory users?

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

How does CA PAM manage the connection to the Active Directory Server and how does it manage the password change and password verification of the users that are imported into CA PAM from Active Directory? Does Broadcom use it's own proprietary API or calls for this?

Environment

All supported versions of CA PAM.

Resolution

Broadcom users the standard LDAP calls for making connection to the Active Directory (AD) and also for the password management of the users that are imported into CA PAM.

CA PAM communicates with external Active Directory (AD) using the standard Lightweight Directory Access Protocol (LDAP) and secure LDAP (LDAPS) protocols, not proprietary APIs in the typical sense of a developer library. The communication involves standard LDAP operations for user authentication and password management.

CA PAM utilizes standard LDAP operations (often referred to as LDAP APIs in documentation) over ports like 389 (LDAP) or 636 (LDAPS)

List of few of the LDAP Calls that are being used (These are Industry Standard LDAP calls)

• ldap_bind (and unbind): Establishes and terminates a connection and authenticates the "bind user" (a service account CA PAM uses to connect to AD). This is a fundamental operation used in both verification and update processes.
  
  
• ldap_search: Used to find user objects in the directory, primarily during user authentication/verification to locate the user's Distinguished Name (DN) and read attributes like sAMAccountName, cn, mail, etc..
  
  
• ldap_compare: Can be used as part of the authentication process to compare a provided password against the password stored (hashed) in the directory.
  
  
• ldap_modify: The key operation used for updating user attributes, specifically the unicodePwd attribute in Active Directory when changing a password.