Resolving Password Synchronization Agent 'Account Not Found' Warnings

Products

• CA Identity Manager
• CA Identity Suite

Issue/Introduction

This article outlines the steps to resolve warnings reported by the Password Synchronization Agent (PSA) indicating that an eTrust Admin user account could not be found. This issue typically occurs when the PSA is misconfigured to communicate with the incorrect Provisioning Server or is searching an incorrect directory path.

20180504.19:24:43. TID=####. * Password Quality Check for user=test01
20180504.19:24:43. TID=####. * PasswordChangeNotify(user=test01)
20180504.19:24:43. TID=####. ! Warning: eTrust Admin user account 'test01' has not been found.
LDAP error: No such object.
Administrator DN: 'eTGlobalUserName=etapswad,eTGlobalUserContainerName=Global Users,eTNamespaceName=CommonObjects,dc=im,dc=eta'.
Search from DN: 'eTADSDirectoryName=ABC-DC01,eTNamespaceName=ActiveDirectory,dc=im,dc=eta'.
Scope: 'LDAP_SCOPE_SUBTREE'.
Filter: '(&(eTADSsAMAccountName=test01)(objectClass=eTADSAccount))'.
Attribute: 'objectClass'.
Attr. only: 'false'.

 In Provisioning Manager, the user exists and is correlated to the ADS account. Also the users exists as confirmed by  a directory search via jxplorer or another LDAP browser tool.

Environment

Identity Manager 14.x & 15

Cause

When a user attempts to change their password on the endpoint, the PSA log displays the following warning:

! Warning: eTrust Admin user account '[username]' has not been found. LDAP error: No such object.

 

The warning indicates a communication or configuration mismatch between the PSA and the Provisioning Server. Common causes include:

• The PSA configuration file is pointing to the wrong Provisioning Server host.
• The search location defined in the PSA configuration does not match the actual directory location of the user account.

Resolution

To resolve this issue, verify and update the PSA configuration using the following steps:

1. Verify Provisioning Server Connectivity: Ensure the PSA is configured to point to the correct Provisioning Server. Review the configuration file and confirm that the host and port settings match your environment's architecture.

2. Verify User Directory Location: Use an LDAP browser (e.g., jXplorer) to confirm the exact Distinguished Name (DN) path where the user objects reside within the directory.

3. Update PSA Configuration: Navigate to the Password Synchronization Agent configuration file and update the following settings to match your findings from the previous steps:

   • Provisioning Server: Ensure the correct host is specified.
   • Search From (DN): Update this value to reflect the correct directory path where user accounts are stored.

4. Validate Synchronization: After saving the changes, attempt a password change for the affected user and monitor the PSA logs to confirm the warning is no longer generated.