Release Notes › Changes to Existing Features in CA Identity Manager r12.5 SP2 › UNIX Remote Agent can be Called by Non-root Users

UNIX Remote Agent can be Called by Non-root Users

If the UNIX Remote Agent is enabled, use of CAM commands by the root user may change file ownership causing errors. For example, to authorize a Connector Server to have access to a UNIX endpoint, you would run this command:

cafthost -a <connector-server-hostname>

This command writes to cafthost.cfg in CAM's installation directory. If the root user issues the command, the file will be owned by the "root" user and group. However, when CAM is configured to run as a non root user, it will be owned by the "cam" user and group, and this account cannot read the file written with root's credentials.

Workaround

After running the "cafthost" command, run:

chown cam:cam cafthost.cfg

Following this, CAM (and CAFT which runs on top of CAM) should be restarted. As the superuser, run the following commands:

CAM_HOME=`cat /etc/catngcampath`; export CAM_HOME
$CAM_HOME/bin/caftclse
$CAM_HOME/bin/camclose
su - cam -c $CAM_HOME/bin/cam
su - cam -c $CAM_HOME/bin/caft

CAM is a common dependency of CA products, however this configuration has been tested only with the CA Identity Manager UNIX Provisioning Agent. If you have CA products that use CAM, check their support for this configuration with CA Support before installation.

This functionality can be enabled on new installations of the UNIX Remote Agent. Upgrade installations do not support changing of install time configuration parameters.