Return
-
Title
Does the Global Setting "Disable after Inactive for n Days" apply to externally authenticated UserIDs? -
Description
When using the Global Setting "Disable after Inactive for n Days", does this apply to externally authenticated (eg; Active Directory) UserIDs? -
Resolution
This setting "Disable after Inactive for n Days" only applies to TPAM UserIDs that are using local TPAM authentication as the Primary authentication method. A UserID that is configured with a Primary external authentication method (such as Active Directory) will not be disabled by this rule.
Also note that if a UserID is disabled, and is managed by an Auto Discovery LDAP Mapping, this mapping may also re-enable the UserID (unless the LDAP Mapping is using the option to "Ignore" updates to the 'Disabled' field)In addition, a UserID that has never logged in will never be disabled.
WORKAROUND
None
STATUSEnhancement request number BFER 9132 has been submitted to Development for consideration in a future release of the product. This Enhancement Request will review the option of altering the behavior of this global setting to also apply to externally authenticated users. -
Change Request
9111, 9132 -
Additional Information
From Global Settings | Account Login Control| Disable after Inactive for n Days help bubble from 2.5.918 "Possible values are between 14 - 365 in days. If a locally authenticated user has not logged onto TPAM in this number of days, the UserID will be disabled. Users who use any form of external primary authentication are unaffected. Additionally, even if locally authenticated, any user who is mapped to Auto-Discovery may be "un" disabled upon the next execution of the mapping. NOTE: "Disabled" is different than "Locked" in that an Administrator must re-enable a Disabled ID while a Locked ID may unlock itself based on the Account Lockout Duration setting."