Resetting the Provisioning Repository Password on Linux - Identity Manager

Products

• CA Identity Manager
• CA Identity Governance
• CA Identity Portal

Issue/Introduction

This article provides the recovery procedure for resolving a credential mismatch between the Identity Manager Provisioning Directory (IMPD) and the local registry file, which prevents the Identity Manager Provisioning Server (IMPS) service from starting.

Environment

Identity Manager 14.5

Cause

A mismatch between the password stored in the IMPD and the local registry file prevents the Provisioning Server from authenticating, typically resulting in an LDAP_INVALID_CREDENTIALS error in the etatrans log.

Resolution

Phase 1: Enable Anonymous Access

Perform these steps on all Provisioning Repository machines.

1. Switch to the dsa user: sudo su - dsa
2. Stop all DSAs: dxserver stop all
3. Edit $DXHOME/config/settings/impd.dxc and change set min-auth = clear-password; to set min-auth = none;.
4. Edit the following knowledge files in $DXHOME/config/knowledge/:
   • *-impd-co.dxc
   • *-impd-inc.dxc
   • *-impd-main.dxc
   • *-impd-notify.dxc
   • *-imps-router.dxc
5. Update auth-levels from clear-password to auth-levels = anonymous, clear-password.
6. Start the repository DSAs: dxserver start all

Phase 2: Reset the LDAP Password

1. Connect to the Provisioning Repository machine on port 20391 anonymously using an LDAP browser.
2. Update the userPassword value for the following entries:
   • eTDSAContainerName=DSAs,eTNamespaceName=CommonObjects,dc=etadb
   • eTDSAContainerName=DSAs,eTNamespaceName=CommonObjects,dc=im,dc=etadb

Phase 3: Clear Registry Settings

Perform these steps on all machines hosting the Provisioning Server.

1. Switch to the imps user: sudo su - imps
2. Delete the following files:
   • /opt/CA/SharedComponents/EnterpriseCommonServices/registry/hkey_local_machine/software/computerassociates/identity_manager/provisioning_server/domains/eta/etpassworddb
   • /opt/CA/SharedComponents/EnterpriseCommonServices/registry/hkey_local_machine/software/computerassociates/identity_manager/provisioning_server/domains/im/etpassworddb

Phase 4: Re-establish Repository Password

1. Start the Provisioning Server service.
2. Review the etatrans log to confirm the system is using anonymous access.
3. Switch to the imps user (sudo su - imps) and navigate to ~/bin.
4. Run the pwdmgr utility for both the eta and im domains:

   ./pwdmgr

5. Follow the prompts to set the new password. Ensure the "Password host" matches the DbHost value found in data/im_ps.conf.
6. Restart the Provisioning Server.

Phase 5: Disable Anonymous Access

Perform these steps on all Provisioning Repository machines.

1. Revert the min-auth setting in $DXHOME/config/settings/impd.dxc back to clear-password.
2. Update the auth-levels in the knowledge files listed in Phase 1 back to clear-password.
3. Reload configurations: dxserver init all
4. Stop and start the Provisioning Server to verify the configuration.

Additional Information

1. Usage Scenarios: This recovery procedure is intended only for situations where a credential mismatch exists between the Identity Manager Provisioning Directory (IMPD) and the local registry file. For routine password rotation, use the standard pwdmgr utility.
2. Password Host Configuration: When utilizing pwdmgr for routine maintenance, ensure the "Password host" value matches the DbHost entry defined in the im_ps.conf file.
   • In Virtual Appliance (vApp) environments, the DbHost may be defined as an alias rather than an IP address or the system hostname (e.g., ca-prov-srv).
   • Failure to align the "Password host" with the DbHost value will prevent the Provisioning Server from starting and result in an LDAP_INAPPROPRIATE_AUTH (0x30) error.
3. Cross-Platform Guidance: For procedures specific to the Windows operating system, refer to the related knowledge article: How to reset the Provisioning Repository password for IMPS on Windows