SiteMinder and Identity Manager Password Policy Integration with Separate Authentication and Authorization Directories

Products

• CA Identity Manager
• SITEMINDER
• CA Identity Suite

Issue/Introduction

When integrating SiteMinder (SM) and Identity Manager (IM), password policy failures may occur if the environment uses separate directories for authentication and authorization.

This document explains why password services may fail to apply correctly and provides remediation options.

Environment

Identity Manager 14.x

Cause

Identity Manager defines and manages password policies for users located in its configured corporate store (the authorization directory). However, SiteMinder can be configured to authenticate users against a different directory.

Because IM processes password policy checks prior to authentication, it attempts to verify password reset status and policy validity against the authorization store. Since the actual user credentials reside in the separate SiteMinder authentication store—which is unknown to Identity Manager— the policies cannot be verified or applied correctly.

Resolution

To resolve password policy failures in a split-directory configuration, choose one of the following methods:

• Define Policies in SiteMinder: Shift password policy management from Identity Manager to SiteMinder. This ensures policies are defined and executed directly on the authentication directory where the credentials reside.
• Develop a TEWS Custom Page: Create a custom Task Execution Web Service (TEWS) page that triggers upon IM authentication. This page must be programmed to query the separate authentication directory for user details and extend the returned user object with the necessary information for IM to process.