Password Change Failure: Global User Account Authentication Error ETA_E_0008

Products

• CA Identity Manager
• CA Identity Suite

Issue/Introduction

When attempting to modify an account password on a managed endpoint in CA Identity Manager, the operation fails if the system is configured to use the administrator's credentials but the corresponding administrator account does not exist on that specific endpoint.

Environment

Identity Manager 14.x

Cause

This issue occurs when the Use logged in Administrator's Credentials setting is enabled in the Directory Settings tab of the endpoint properties.

When this setting is active, any administrative action (such as a password reset) performed via the Admin UI must authenticate against the endpoint using the credentials of the currently logged-in Global User. For example, if you are logged in as etaadmin and attempt to change a user's password, the system tries to use an etaadmin account on the endpoint to authorize the change. If that account does not exist on the endpoint, the ETA_E_0008 error is returned.

Resolution

Follow one of the two methods below to resolve the authentication error:

Method 1: Disable Administrator Credential Inheritance

1. Navigate to the Endpoint Properties screen in the Identity Manager Admin UI.
2. Select the Directory Settings tab.
3. Locate the Use logged-in administrator's credentials check box.
4. Uncheck the box and click Submit/Save. The system will now revert to using the service account configured for the endpoint to perform modifications.
   
   
   
   
   

Method 2: Create the Administrative Account on the Endpoint

1. Create a user account on the target endpoint (e.g., etaadmin) that matches the Global User ID exactly.
2. Assign the account the necessary permissions/privileges on the endpoint to manage user objects and passwords.
3. Ensure this endpoint account is correlated to the corresponding Global User in Identity Manager.