Resolving Repeated Account Lockouts in Harvest SCM

Products

• CA Harvest Software Change Manager
• CA Harvest Software Change Manager - OpenMake Meister

Issue/Introduction

A Harvest account, often used in automated checkout scripts via encrypted .dfo files, experiences repeated lockouts. This typically occurs when a process or script attempts to authenticate with outdated credentials or when the Harvest password policy threshold is met.

Environment

• CA Harvest Software Change Manager (All Versions)
• Operating System: All supported platforms

Cause

• Outdated credentials stored in local .dfo files on specific client machines.
• Harvest Password Policy settings (e.g., MaxPasswordAge or MaxFailedAttempts) triggering a lock.

Resolution

1. Identify the Userid Causing the Problem:

   • Navigate to the %CA_SCM_HOME%\log directory on the Harvest server.
   • Open the HBroker.log files.
   • Search for the string _On User register_.
   • Review the From field in the log entry to identify the specific host name or IP address making the failed attempts.

2. Audit Failed Login Attempts via SQL:

   • Run the following query against the Harvest database to see a history of attempts:
     • Oracle: SELECT USERNAME, SUCCESSFAILURE, TO_CHAR(EVENTTIME, 'mm/dd/yyyy hh:mi:ss') EVENTTIME FROM HARAUDITLOGVIEW WHERE ACTIONOBJID = 411;
     • SQL Server: SELECT USERNAME, SUCCESSFAILURE, EVENTTIME FROM HARAUDITLOGVIEW WHERE ACTIONOBJID = 411;

3. Adjust Password Policy (Optional):

   • Use the hppolget utility to export the current policy to a text file.
   • Review the MaxPasswordAge and MaxFailedAttempts settings.
   • If necessary, modify the values (e.g., set MaxPasswordAge to zero to prevent expiration) and upload the updated policy using hppolset.

4. Update Credentials:

   • On the identified source host, update the encrypted login file using the svrenc command: svrenc -f harlogin.dfo -usr #### -pw ####

Additional Information

See also:

Auditing user access to Harvest system

Resetting passwords in Harvest

Auditing user last login information in Harvest SCM

hppolget Command-Get Password Policy

hppolset Command-Set Password Policy

svrenc Command-Encrypt User and Password Credentials to a File