CA SiteMinder’s “DisallowForceLogin” registry key demystified

Warning: This page deals with one of the vague Policy Server flags and assumes certain level of familiarity with the dark soul of CA SiteMinder.

Is is pretty hard to understand the meaning of the DisallowForceLogin registry key for SiteMinder Policy Server from the official documentation, even when you have plenty of time and manuals. This page pretends to summarize all that you may need to know about it, should you have to deal with this functionality some day.

History and Functionality

In a pre-R6 environment, when a user submits a password change request that contains an invalid current password, the Password Change Information screen appears with a message stating that the old password is incorrect. The user can provide the correct credential and change the password.

In R6 and R12, the Policy Server redirects the user to the login screen without the message (that is, ”forces login screen”). Enabling the DisallowForceLogin registry key allows the old behavior in a new environment. When enabled, the Policy Server properly redirects users who have submitted a password change request that contains an invalid current password to the Password Change Information screen. This screen displays the invalid current password message. When disabled, the Policy Server redirects users to:

  • The login page that does not display the invalid current password message. This redirect occurs if an On-Auth-Reject-Redirect response is not bound to the policy configured with the user directory.
  • The URL associated with the On-Auth-Reject-Redirect response bound to the policy configured with the user directory

According to R6SP5 README, there are three cases affected by the DisallowForceLogin value:

  • Force password change or password expired.
  • Self Password change.
  • Optional password change.

Configuration

The registry key DisallowForceLogin should be located under:

HKEY_LOCAL_MACHINE\SOFTWARE\Netegrity\SiteMinder\CurrentVersion\PolicyServer

If the key does not exist, create a new key with type REG_DWORD and the value 0x0 (disabled) or 0x1 (enabled). The registry key is disabled by default. If a value other than 0x1 is configured, the feature is disabled. If the registry key is disabled, the new behavior is in effect.

What is affected?

The SiteMinder works as described in the documentation. The following table summarizes system behavior when incorrect old password is submitted.

Flow Value = 0x0 or absent (default behavior) Value = 0x1 (obsolete behavior)
Password Expiry Notification Password change page with 3 input boxes and skip option, no error message. Password change page with 3 input boxes and informative error message.
Forced Password Change Password change page with 3 input boxes, no error message.
User-Initiated Password Change Password change page with 4 input boxes, no error message.

References

As usual, the access to the references requires login to CA support site.

Leave a Reply