ALERT: Some images may not load properly within the Knowledge Base Article. If you see a broken image, please right-click and select 'Open image in a new tab'. We apologize for this inconvenience.

User Store :: Disable Flag : Behavior among AD and LDAP

book

Article ID: 49860

calendar_today

Updated On:

Products

CA Single Sign On Secure Proxy Server (SiteMinder) CA Single Sign On SOA Security Manager (SiteMinder) CA Single Sign-On

Issue/Introduction

Description:

I am running Policy Server with Active Directory as User Store.

I would like to know:

  • Should the value of the disabled flag also be "0" in AD in order to have SiteMinder consider user as enabled?
  • Is there a difference in the way the user account is "read" by SiteMinder which could explain the successful attempt in LDAP and failure in AD?

Solution:

You need to keep in mind that the "disabled flag" attribute is a SiteMinder mechanism.

The directory server's own account status takes precedence over anything SiteMinder might configure. Therefore, if the user is disabled in Active Directory, no amount of SiteMinder configuration can fix that.

By design, SiteMinder must honor the user directory's position on the account disabled state before its own. Otherwise, SiteMinder would risk authenticating and authorizing a user that was disabled intentionally by the administrator and therefore cause a security breach.

When the user is disabled in Directory Server (both LDAP and AD), then irrespective of SM configuration user is not allowed to login. This is because SM "binds" to LDAP with the supplied credentials. This is same for AD & LDAP as well. For example, if a user is disabled in SunOne LDAP (right click user in SunOne console and make inactive), "bind" would fail - which means SM can't authenticate that user anymore.

Environment

Release:
Component: SMPLC
Powered by Wolken Software