Password Enforcement Missing in CA Identity Portal with Security Enabled

Products

• CA Identity Manager
• CA Identity Governance
• CA Identity Portal

Issue/Introduction

When Identity Governance security is enabled, users may still be able to authenticate in the Identity Portal using any password, appearing as though password enforcement is inactive. This behavior is expected when the application operates in trial or demonstration mode without an integrated external authentication source.

Environment

Identity Governance

Cause

Identity Governance is designed to operate with reduced security enforcement in trial or demo environments when no external authentication source (e.g., AD, LDAP, or Identity Manager) is configured. Consequently, the portal does not verify password contents. In production environments, full enforcement requires an active external authentication source to manage user credentials.

Resolution

To enforce password validation for all users, you must configure an external authentication source. Follow these steps to ensure secure authentication:

1. Configure External Authentication: Ensure one of the following external authentication sources is configured for your environment:

   • Active Directory (AD)
   • LDAP
   • Identity Manager

2. Enable IM Authentication Flag: To explicitly trigger password verification for AD/EAdmin and SSO users, modify the configuration settings:

   • Locate the security configuration file for your application server.
   • Set the following property to false: sage.security.disable.IMAuthentication=false
   • Restart the application server to apply the changes.

3. Verify Configuration:

   • Check eurekify.log to confirm the status of the security enforcement.
   • Attempt to log in with an incorrect password to confirm that access is denied (the system should now perform content verification against the external source).