Provisioning Server Connection Failure with Special Characters in Passwords

Products

• CA Identity Suite

Issue/Introduction

During the deployment or installation of Symantec Identity Suite R15, administrators may encounter connection failures between the Identity Governance and Administration (IGA) component and the Provisioning Server (IMPS). While tools like Jxplorer can successfully connect to the Provisioning Directory (IMPD), IGA fails to authenticate.

Errors such as RC=LDAP_INVALID_CREDENTIALS may be observed in the etatrans logs.

Environment

Product: Symantec Identity Suite / Identity Manager
Version: 15.0
Components: Provisioning Server (IMPS), Provisioning Directory (IMPD)

Cause

A product defect exists where specific special characters in passwords, particularly the dollar sign ($), are not handled correctly during encryption or deployment. The $ character can be misinterpreted as a bash variable or positional parameter, leading to the password being trimmed or modified before it is written to the system registry.

Testing has confirmed:

Affected characters: $ (confirmed cause of failure).
Unaffected characters: @, #, ! (typically successful unless combined with $).

Resolution

The fix is scheduled for inclusion in Identity Suite 15.0 Fix Pack 6.

If an immediate upgrade to Fix Pack 6 is not possible, avoid using the $ character in system or shared passwords for the Provisioning Server and Directory until the patch is applied.

Additional Information

For the latest updates and download information, refer to the Identity Suite 15.0 Release Notes