"User is not active" message when SiteMinder disabled state is != 0 in IDSP

Products

• SITEMINDER
• CA Single Sign-On
• Symantec Identity Security Platform - IDSP (formerly VIP Authentication Hub)

Issue/Introduction

Running SiteMinder, integrated with IDSP, when the SiteMinder user has a disabled state value other than 0, then the user gets the message in the browser:

"User is not active"

The user is not able to authenticate. 
  
The IDSP user directory = SiteMinder User Directory with enabled state attribute configured and Status Encoding set to SITEMINDER.

Environment

IDSP 3.3.5;
Policy Server 12.8SP7;
CA Access Gateway (SPS) 12.8SP7.

Cause

Before SiteMinder 12.9, the password policies were not supported with the VIP Authentication Hub Template (1)(2).

Resolution

Upgrade IDSP to 4.0 or higher and upgrade SiteMinder to 12.9 or higher to fix this issue.

Additional Information

1. Supported Authentication Schemes and Password Policies
    
2. Force password change after x days after VIP Authentication Hub MFA processing