Active Directory RC4 Deprecation Impact on Identity Manager

Products

• CA Identity Suite
• CA Identity Manager

Issue/Introduction

Microsoft is phasing out RC4 Kerberos encryption. You need to understand the required actions for CA Identity Manager (IM) when the Active Directory (AD) endpoint disables RC4, specifically whether you must re-enter passwords for all AD endpoints.

Environment

• Identity Manager 14.X and 15.X
• Active Directory Endpoint

Cause

Microsoft security hardening (such as CVE-2022-37966) enforces the use of AES128/AES256 encryption, deprecating the weaker RC4 protocol. If the IM's C++ Connector Server is not configured to negotiate these stronger ciphers, communication with the AD endpoint fails.

Resolution

You do not generally need to re-enter endpoint passwords if the underlying communication (LDAP over SSL/TLS) successfully negotiates AES. The C++ Connector Server must be configured to support cipher suites that include AES128 and AES256.

Follow these steps to verify and update your configuration:

1. Locate the im_ccs.conf file on your C++ Connector Server. This is typically found in the <CCS install location>\Connector Server\data\ directory.
2. Open the file and locate the TLSCipherSuite parameter.
3. Ensure the configuration supports HIGH and MEDIUM strength ciphers while explicitly disabling insecure protocols.
   • Example Configuration: TLSCipherSuite HIGH:MEDIUM:!SSLv3:!SSLv2:!3DES
4. Restart the Symantec Identity Manager - Connector Server (C++) service to apply the changes.
5. Verify that your Active Directory Service Account attribute msDS-SupportedEncryptionTypes is configured to support AES encryption (Value 24 or 0x18).

For detailed syntax on configuring specific cipher strings, you may refer to the OpenSSL Ciphers Documentation.