Provisioning Reference Guide › Pluggable Authentication Module (PAM) › Using PAM and Password Expiration

Using PAM and Password Expiration

If your environment is configured for PAM, you must inform PAM through the etapam_id.conf configuration file if the endpoint PAM is to consult has been acquired in CA IdentityMinder as a managed endpoint. This allows CA IdentityMinder to update a user's account password on this managed endpoint every time users or administrators update their global user passwords. For more information, see Update Global User Passwords.

If you configure PAM to consult an endpoint that has not been acquired in CA IdentityMinder as a managed endpoint, disable the password expiration features. If you do not disable the password expiration feature, your users will be confused as they are asked to change their global user password although that password is not used for authentication.

To disable password expiration

1. Click the System Task button in the Provisioning Manager.
2. Click Password Profile.
3. Click the Expiration/Locking tab.
4. Clear the Expiration Period and click Apply.