PasswordHistoryTool MAX_WINDOW_Time limits

Products

• CA Identity Suite
• CA Identity Manager

Issue/Introduction

PasswordHistoryTool provide here applies strong encryption for the Password history Data in Identity Manager.

 

One of the attributes you set during configuration of this tool is MAX_WINDOW_TIME.

 

Environment

Identity Manager 14.5, 14.5.1 or 14.5.1 CHF1

Resolution

The value of MAX_WINDOW_TIME should be adjusted in accordance with the number of users in your directory or database.

For example, if your directory or database contains 1 million users, ensure that the value is set appropriately to accommodate this number.

It is important to note that the optimal setting for MAX_WINDOW_TIME may vary based on the specific network environment.

For instance, if your Identity Manager (IM) server and the directory are located in different geographical regions, network latency should be considered as well, and the value should be adjusted accordingly.

 

What happens if the MAX_WINDOW_TIME Value is Insufficient?

If a lower value for MAX_WINDOW_TIME is set (e.g., 0.01 for 1 minute) and the datastore contains a large number of users (e.g., 1 million), performing a scan may result in an error. The Appserver logs will display the following message:

 "Error while processing Userstore: <Userstore_name> has reached the maximum time window allocated while performing the scan. The time window is too short to complete the scan. Please increase the time and try again."

Additionally, the scan output on the console may indicate that the scan was not complete, as shown below. In such cases, it is recommended to increase the MAX_WINDOW_TIME value to allow the scan to complete successfully. Please note that no logs will be generated in the Password Tool output report log (ustore_report.log) if the scan is incomplete.

 

Scan Output Example:

 Please wait... Analyzing Userstore data.


 Userstore name: <Userstore_name>

 - Number of users needing a fix: 0

 - Attribute-level encryption state: Configured for strong encryption

Additional Information