Password Sync Agent Fails to Propagate Passwords - Identity Manager

Products

• CA Identity Manager
• CA Identity Governance
• CA Identity Portal

Issue/Introduction

This article outlines the resolution for instances where the Password Synchronization Agent (PSync) fails to propagate password updates to synchronized accounts, typically signaled by "LDAP error: Invalid credentials" in the logs.

Environment

Identity Manager 14.5 & 15
Password Sync Agent

Cause

The issue occurs because the etapwd service account password used by the Password Sync Agent has expired, or the password was updated in the Provisioning Manager without corresponding updates to the configuration file on the Domain Controller.

Resolution

1. Verify etapwd Account Status

1. Log in to the Provisioning Manager using a Super User account.
2. Search for the etapwd user.
3. Right-click the user and select Properties.
4. Select the Password tab.
5. Check if Enable explicit password expiration date is enabled.
6. If enabled, either reset the password or disable the expiration option.

2. Synchronize Password on Domain Controller

If the etapwd password was changed, update it on the machine where the Password Synchronization Agent is installed:

1. Navigate to the installation directory (default: \_password\_sync\_folder\_\bin).
2. Run the PwdSyncConfig.exe tool.
3. Provide the new etapwd credentials as prompted.

Additional Information

For more information about Password Synchronization, please see the documentation Synchronizing Passwords on Endpoints - 14.5 or Synchronizing Passwords on Endpoints - v15

Related Articles: 

KB 52161 PSync Agent Configuration Best Practices

KB 249339 LDAP error: Invalid credentials during PYNC Password update

 

To speak with a customer representative or a Support Engineer see Contact Support. Scroll to the bottom of the page and click on your respective region.