Issue: When PAM is configured for user authentication from the Advanced Authentication (AA) server, the provisioning/deprovisioning of Entitlement requests results in the user name being provisioned into PAM UserGroup objects without the domain name. As a result, users with UserGroup entitlements are unable to access PAM.
Workaround: Customize the IDM driver Command Control policy to add the Advanced Authentication domain name as a prefix.
NOTE:It is advisable for administrators to use the Access Control policy engine and UserRole entitlement for seamless usage of the product.