Could a read only Microsoft AD work as user store for CA SiteMinder Single sign on policy server?
We are trying to configure a AD server which is read only(not writable ) as user store for SiteMinder policy servers, but its not working. Any one has tried that?
We have policy server version as R12.52Sp1Cr06
I think we would need write permissions for the admin user since we update couple of attributes in AD during the authentication.
For ex: passwordblob, lastlogintime etc
Refer : Directory Attributes Overview - CA Single Sign-On - 12.52 SP1 - CA Technologies Documentation
Some features require read or write access to seven CA Single Sign-On attributes. The attribute values are in the user directories that are connected to the Policy Server. You map the directory user attributes to CA Single Sign-On attributes in the User Attributes section. You can also use attribute mapping to define your own common names. You can map each name to user attribute names in multiple user directories.
Each CA Single Sign-On attribute is associated with a data type and one or more directory types that are described in the following table. (R) indicates that the attribute requires read access. (RW) indicates that the attribute requires read/write access.
Theoretically, if we are not using any PASSWORD SERVICES functionality then a read only AD should work. But this is something CA would not have tested. Hence though we may be using an AD which succeeds on the criterion of Support Matrix Compatibility Check, if we run into issues CA would have the right to highlight this factor of a Read Only AD (not tested / not supported).
A read only AD may suffice in the scenario where we are not using CA SSO Password Policy and we are not utilizing inbuilt AD Password Services (and / or AD Enhanced Password Services). But again there may be scope creeps. What do I mean by that, 'what if AD has set an account as must change password and user logs in'? So if I see in overall perspective you may end up having to need some level of RW access.
But whatever you opt to choose, test it comprehensively to avoid pitfalls.
Thank you All !!
I guess conclusion is we need to have RW AD to configure it as user store. I will work with my AD admins to promote the server as RW and then try again.
We did promoted our AD servers as RW, but still SiteMinder is not able to make connection to AD server and its not working.
We did check the certificate in cert8 DB, created host entries in etc hosts. but noting worked out.
1. Is there any firewall between Policyserver and AD server ? are you able to ping/telnet ?
2. If SSL is an issue, did you try to connect using Non-SSL port from adminUi ?
3. Did you try to make connection from any of the LDAP browsers(eg: jXplorer, softerra) ?