RACF Passwords Remain Expired After Change via Identity Manager. LDAP: error code 80 - ICH30001I UNABLE TO LOCATE USER ENTRY

Products

• CA Identity Suite

Issue/Introduction

Passwords changed through CA Identity Manager (IDM) remain in an Expired state in the RACF environment, requiring a password reset upon login. The following error is observed in the CA LDAP / RACF connector logs:

javax.naming.NamingException: [LDAP: error code 80 - ICH30001I UNABLE TO LOCATE USER ENTRY ####]; remaining name 'etracuserid=####,eTRACAdminGrp=Users,host=mf-sysa,o=org,c=us'

Environment

• Product: CA Identity Suite / CA Identity Manager 14.5, v15
• Connector: RACF v2 Connector

Cause

This issue occurs when the CA LDAP server is not configured to explicitly include the NOEXPIRE keyword during RACF ALTUSER commands. Without specific parameters in the slapd.conf file, RACF treats the password change as an administrative reset, which defaults to leaving the password in an expired state.

Additionally, an invalid or non-existent OWNER attribute in the environment can cause lookup failures (ICH30001I), preventing the connector from correctly processing the account update as a self-service or optimized change.

Resolution

1. Update slapd.conf Configuration

To ensure password changes do not trigger the RACF expiration flag, add the following parameters to the slapd.conf file. These should be placed immediately after the suffix line for your RACF database:

text

suffix "host=mf-sysa,o=org,c=us"enableNoExpirePswdenableNoExpirePswdResume

• enableNoExpirePswd: Automatically adds the NOEXPIRE operand to the RACF ALTUSER command.
• enableNoExpirePswdResume: Ensures accounts suspended due to expiration are resumed without the password being flagged as expired.

2. Restart CA LDAP

A restart of the CA LDAP server is required for these configuration changes to take effect.

3. Verify OWNER Attribute

Ensure that the OWNER attribute for RACF accounts in Production is set to a valid RACF user or group (e.g., matching the connector user ID).

4. Validation

After the restart, perform a test password change through Identity Manager and verify that the user can log in to TSO without being prompted to change their password.

Additional Information

1. enableNoExpirePswd: When this is enabled in slapd.conf, the CA LDAP server automatically adds the NOEXPIRE operand to the RACF ALTUSER command during a password change. Without it, RACF defaults to an administrative reset which leaves the password expired.
2. enableNoExpirePswdResume: This ensures that if an account is suspended due to expiration, it is resumed without the password being flagged as expired during the change.
3. Interaction with eTSelfChange:  eTSelfChange and the OWNER attribute, these slapd.conf parameters act as a "global override" at the LDAP backend level. If they are missing, the backend will not generate the NOEXPIRE keyword, regardless of what IDM sends.