Reset Provisioning Directory Credentials - Identity Manager

Products

• CA Identity Suite
• CA Identity Manager

Issue/Introduction

In this article you can reset the Provisioning Directory credentials in the Identity Manager 15.x

Environment

Identity Manager 15.x

Cause

If you are not able to connect to Provisioning Directory or forgot the password, this is the article to change the Provisioning Directory password.

Resolution

Below the steps to reset the Provisioning Directory password in the Identity Manager 15.x

1. Run the two commands to avoid the files be restored to default after restarting them.
   touch /opt/brcm/iga/patches/impd/skip_reconfigure
   touch /opt/brcm/iga/patches/impr/skip_reconfigure
   
   
2. Restart the services
   igactl restart impd
   igactl restart impr
   
   
3.  In $DXHOME/config/settings/impd.dxc, change the min-auth setting from:
   
   set min-auth = clear-password;
   to:
   set min-auth = none;
   
   
4. Edit all the Provisioning Directory DSAs knowledge files in $DXHOME/config/knowledge folder:
   
   -impd-co.dxc
   
   -impd-inc.dxc
   
   -impd-main.dxc
   
   -impd-notify.dxc
   
   -imps-router.dxc
   
   
   Change the auth-levels setting of each DSA from
   auth-levels = clear-password
   to:
   auth-levels = anonymous, clear-password
   
   
5.  Restart the services impd and impr

   igactl restart impd
   igactl restart impr
   
   
6. From JXplorer or any other LDAP Browser, set the Provisioning Directory IP address and Port 20391, Level anonymous
   
   
7. Change the userPassword on eTDSAContainerName=DSAs,eTNamespaceName=CommonObjects,dc=im,dc=etadb entry
   
   
8. Change userPassword to a new password on the following 2 entries. Ensure that the password algorithm is SSHA.
   - eTDSAContainerName=DSAs,eTNamespaceName=CommonObjects,dc=etadb
   - eTDSAContainerName=DSAs,eTNamespaceName=CommonObjects,dc=im,dc=etadb
   
   
9. Ensure that the JXplorer can connect to the Provisioning Directory on port 20391 with the new password.
   
   
10. If you are able to connect to the JXPlorer with the new password, you can delete the files created in step 1
    - rm /opt/brcm/iga/patches/impd/skip_reconfigure
    - rm /opt/brcm/iga/patches/impr/skip_reconfigure
    
    
11. Restart the impd and impr services
    igactl restart impd
    igactl restart impr
    
    
12. The changes in the .dxc files will be restored to the default values

Additional Information

For further information about skip_reconfigure file, see documentation, section Reconfigure

To speak with a customer representative or a Support Engineer see Contact Support. Scroll to the bottom of the page and click on your respective region.