Identity Manager Object Store: Architecture, Data Writes, and Credential Storage FAQ

Products

• CA Identity Manager
• CA Identity Suite

Issue/Introduction

The Identity Manager Object Store is a specialized database used to store environment-level configuration data. This FAQ addresses common questions regarding data persistence, maintenance requirements, and credential security within the Object Store.

Environment

Identity Manager 14.x & v15

Resolution

Database Write Operations 

The Identity Manager environment primarily reads from the Object Store during runtime to load environment settings and UI components. Writes occur only during specific configuration events, including:

• Importing or updating Role Definitions.
• Creating or modifying Provisioning Roles.
• Configuring or updating Admin Tasks and Task Screens.
• Importing environment-level Directory XML (directory.xml) files.
• System initialization (minor updates such as startup timestamps).
  
  

Cleanup and Garbage Collection 

The Object Store is designed to remain small, containing primarily metadata for the environment layout.

• Maintenance: There is no requirement for periodic cleanup or garbage collection for the Object Store.
• Script Compatibility: Garbage collection scripts intended for the Task Persistence database should never be run against the Object Store. These scripts target runtime task history, which is not present in the Object Store.
  
  

User Credential Storage and Security 

A common point of confusion is whether user passwords reside in the Object Store.

• Storage Location: User IDs and passwords for native framework authentication are stored in the User Store (e.g., CA Directory, Active Directory), not the Object Store.
• Environment Credentials: The Object Store does contain the service credentials used to connect to the User Store. These are stored in the IM_DIR_CONNECTION table.
• Encryption: Credentials stored in the database are encrypted using RC2 or JSAFE algorithms. If you cannot access the Management Console to update these, use the pwdtools utility found in the Identity Manager installation \tools directory to generate new encrypted values for the database.