MSSQL User Password Management and Rotation in CA ITCM.

Products

• CA Client Automation - IT Client Manager

Issue/Introduction

Users may attempt to integrate internal CA Client Automation (ITCM) database accounts with Active Directory for automated credential management or password rotation policies (e.g., 90-day rotation).

When attempting to automate this, administrators find no native option within the product to link these accounts to an external identity provider.

Environment

• Product: CA Client Automation (ITCM)
• Version: 14.x and higher
• Database: Microsoft SQL Server (MSSQL)
• Accounts: ca_itrm, cicuser, ca_itrm_ams

Cause

The database accounts utilized by CA Client Automation are standard SQL Server logins. They are not integrated with Active Directory by design, and the application does not currently feature a native mechanism for automated password rotation or synchronization with external credential managers.

Resolution

Because automated rotation via Active Directory is not supported, the passwords must be managed manually. If a password rotation is required for compliance, follow these steps to synchronize the database and application.

Step 1: Update the Password in SQL Server

1. Connect to the SQL Server instance hosting the MDB (Management Database) using SQL Server Management Studio (SSMS).
2. Navigate to Security > Logins.
3. Right-click the target user (e.g., ca_itrm) and select Properties.
4. Update the password and click OK.
   • Note: Avoid using special characters like &, |, <, or > as they may cause issues with the command-line utility in the next step.

Step 2: Update the Application Credentials

After changing the password in the database, you must update the application's connection settings on the Domain Manager.

[!WARNING] Failure to perform this step will result in application services being unable to connect to the database, leading to system downtime.

1. Open a command prompt on the Domain Manager.
2. Execute the following command to update the ca_itrm credentials:
   
   
   

   cadsmcmd setDBCredentials passwd=<New_Password>

3. Verify the output returns OK.
4. Restart the CA Client Automation services to ensure the new credentials are in use.