Password Sync Agent Version Compatibility and Upgrade Guide

Products

• CA Identity Manager
• CA Identity Governance
• CA Identity Portal
• CA Identity Suite

Issue/Introduction

This article provides guidance on maintaining compatibility and executing upgrades for the Password Sync Agent (Psync) within an Identity Manager environment. It outlines supportability requirements and verification methods for the agent component.

 

Environment

Identity Manager

Resolution

The Password Sync Agent is a standalone component implemented as a Windows Password Filter. It intercepts incoming password updates at the Domain Controller and uses LDAP/LDAPS to communicate with the Provisioning Server to propagate changes.

Compatibility Rules:

• Maintain Version Parity: Always install the same or a newer version of the Password Sync Agent compared to your Identity Manager/Provisioning Server version.
• Supportability: Using an older version of the Password Sync Agent against a newer version of Identity Manager is not supported. This is due to security changes and Java-based TLS cipher updates implemented in newer releases.
• Upgrade Path: If you are upgrading your Identity Manager environment, update all Psync agents to the latest version. This can be done prior to the overall Identity Manager upgrade and will function correctly with earlier versions.

Verification and Downloads:

• Service Verification: Note that the Password Sync Agent does not run as a standalone Windows service. It operates as a DLL (eta_pwdsync.dll) loaded within the lsass.exe process. To verify it is running, use Windows Process Explorer to confirm that eta_pwdsync.dll is loaded into the lsass.exe process.

Additional Information

For IM in version 15 it is possible to run Password Sync Agent in version 14.5.

Password Sync Agent should be upgraded as soon as possible to adhere to the same version requirement.