BLTH change password fails with "javax.net.ssl.SSLHandshakeException: (certificate_unknown) PKIX path building failed" in Identity Manager 15.0

Products

• CA Identity Manager

Issue/Introduction

When executing the "Change Password" task in CA Identity Manager v15, the operation fails with "error changing password." The following error appears in the JBoss/Wildfly logs:
`ERROR [com.MYCUSTOM.IDM.BLTH.Provider.BLTH_ChangeADUserPassword] (default task-3039) Problem changing password: javax.naming.CommunicationException: simple bind failed: [LDAP_SERVER]:6636 [Root exception is javax.net.ssl.SSLHandshakeException: (certificate_unknown) PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target]`

Environment

* Product: CA Identity Manager
* Version: 15.0.0-22 Fix Pack 2
* OS: RHEL 9
* Application Server: JBoss 8.1
* Component:** Business Logic Task Handler (BLTH)

Cause

A defect in the MYCUSTOMBLTH_ChangeADUserPassword class code prevents the system from properly validating the LDAP server certificate, even when the certificate has been correctly imported into the Java cacerts and the IGX dashboard truststore.

Resolution

The issue is resolved in Identity Manager v15 Fix Pack 5

To resolve the issue:
1.  Verify the current environment version.
2.  Download and apply Identity Manager v15 Fix Pack 5 or later.
3.  Confirm that the LDAP server's root and intermediate certificates are present in the following locations:
- IGX Truststore: /opt/brcm/iga/cluster_conf/properties/trust.p12
- Java cacerts: /opt/brcm/iga/conda/envs/main/java/lib/security/cacerts
4.  Restart the application server services.