RACF v2 connector: Identity Manager reports success on failed password change due to forbidden words

Products

• CA Identity Suite
• CA Identity Manager
• LDAP SERVER FOR Z/OS

Issue/Introduction

This is not a Identity Manager issue, but a CA LDAP Server (Mainframe) issue

A user attempts to change their password or passphrase using the Identity Manager, the IdM reports that the task completed successfully RACF v2 connector not erroring.

The password change actually fails on the mainframe with RACF returning rc4 and message ICH21038I PASS PHRASE CHANGE REJECTED BY INSTALLATION PASS PHRASE EXIT RACF v2 connector not erroring.

Environment

CA Identity Manager 14.5.1

CA LDAP Server for z/OS

Cause

From the Provisioning Server log we got the error:

ETA_E_0008<MAC>, User Account 'TEST_USER' on 'RACF_Endpoint' modification failed: Connector Server Modify failed: code 80 (OTHER-LdapNamingException): failed to modify entry: eTDYNAccountName=TEST_USER,eTDYNAccountContainerName=Users,eTDYNDirectoryName=RACF_Endpoint,eTNamespaceName=RACF v2,dc=im,dc=etasa: JCS@my-jcs-machine: JNDI: [LDAP: error code 80 - ICH21016I PASSWORD CHANGE FOR 'TEST_USER' SUPPRESSED BY INSTALLATION PASSWORD EXIT.]: failed to modify etracuserid=TEST_USER,eTRACAdminGrp=Users,host=prod,o=my_company,c=xx(ldaps://10.10.10.10:20411)

Resolution

Please, open a support case and ask for PTF LU19517 (Defect DE661033) to the CA LDAP mainframe environment