Accepting Passwords from Connected Systems

As in previous versions of DirXML® and Identity Manager, any connected system can publish a password to the Identity Vault.

You can specify which connected system applications Identity Manager accepts passwords from. You can even choose whether Identity Manager updates the password for users in the same Identity Vault where Identity Manager is running, or whether Identity Manager simply acts as a conduit or “tunnel,” synchronizing passwords only between connected systems. This means that it is possible to keep the Identity Vault password separate from the password that Identity Manager distributes to connected systems, if desired.

Some connected systems (AD, other Identity Vaults, NT, and NIS) can provide the user's actual password, which means that when a user changes a password on a connected system, the change can be synchronized to Identity Manager and back out to other connected systems.

Other connected systems don't support providing the user's actual password, but you can configure them to provide to Identity Manager a password that is manufactured in a style sheet, such as an initial password based on last name or employee ID.

Distributing Passwords to Connected Systems

Identity Manager Password Synchronization can distribute a common password to connected systems.

In previous versions of Identity Manager, a driver could send passwords to Identity Manager from a user account on a connected system, and the password could be used to update the corresponding user in eDirectory. But because the NDS password in eDirectory is non-reversible, you couldn't push a password out from the central Identity Manager Identity Vault to multiple connected systems. You could obtain the eDirectory password only by capturing the password before it was stored in eDirectory, such as through the Novell Client.

The Universal Password provided by eDirectory 8.7.3 is reversible. Because of this, Identity Manager can accept a password from a connected system, then distribute the password from the Identity Vault to connected systems that support setting initial password for new accounts and modifying a password.

Regardless of where the password comes from, Identity Manager uses the Distribution Password as the repository from which it distributes passwords to connected systems. The Distribution Password, like the Universal Password, lets you enforce password policies.

For information about using Universal Password and Distribution Password when synchronizing passwords, see Implementing Password Synchronization.

As with other attributes of a user, you can decide which systems are authoritative sources for passwords. Identity Manager distributes the passwords from the authoritative source to the other connected systems.

You can set up bidirectional password synchronization among connected systems that support it.

Enforcing Password Policies in the Data Store and on Connected Systems

By making calls to NMAS, Identity Manager can enforce password policies on incoming passwords. If the password being published from a connected system to Identity Manager does not comply, you can specify that Identity Manager not accept the password into the Identity Vault. This also means that passwords that don't comply with your policies are not distributed to other connected systems.

In addition, Identity Manager can enforce password policies on connected systems. If the password being published to Identity Manager does not comply with rules in a policy, you can specify that Identity Manager not only does not accept the password for distribution, but actually resets the noncompliant password on the connected system by using the current Distribution Password in the Identity Vault.

For example, you want to require passwords to include at least one numeric character. However, the connected system does not have the ability to enforce such a policy. You specify that Identity Manager resets passwords that flow from the connected system but do not comply with rules in the policy.

If you are using Advanced Password Rules and Identity Manager Password Synchronization, we recommend that you research the password policies for all the connected systems to make sure that the Advanced Password Rules in the eDirectory password policy are compatible. This research helps ensure that passwords are synchronized successfully.

Keep in mind that you must make sure that the users who are assigned NMAS password policies match with the users you want to participate in Password Synchronization for connected systems.

NMAS password policies are assigned with a tree-centric perspective. In contrast, Password Synchronization is set up per driver. Also, drivers are installed on a per-server basis and can manage only those users who are in a master or read/write replica. To get the results you expect from Password Synchronization, make sure the containers that are in a master or read/write replica on the server running the drivers for Password Synchronization match the containers where you have assigned password policies with Universal Password enabled. Assigning a password policy to a partition root container ensures that all users in that container and subcontainers are assigned the password policy.

For information about how NMAS password policies are assigned to users, see “Assigning Password Policies to Users” in the Password Management Administration Guide.

Scenarios for Synchronizing Passwords

Identity Manager enables you to specify which systems should be authoritative sources for passwords. Also, you decide how you want passwords to flow.

Much of the functionality of Identity Manager Password Synchronization relies on Universal Password, the reversible password functionality provided by the Identity Vault. However, some scenarios don't require you to deploy Universal Password.

Identity Manager Password Synchronization also relies on the Distribution Password. As with Universal Password, a policy can be enforced on the Distribution Password.

For basic ways that you can implement password synchronization, see Implementing Password Synchronization. You can combine these scenarios to meet the needs of your environment.

Synchronizing Passwords on Windows without the Novell Client

A Novell Client is no longer required for password synchronization with Active Directory and NT Domain.

Notifying Users of Password Synchronization Failures

The Enforcing Password Policies in the Data Store and on Connected Systems explains that Identity Manager can enforce password policies by not accepting (from connected systems) passwords that don't comply.

Using the e-mail notification feature, you can specify that Identity Manager notify the user when a password change that the user made was not successful.

Before you can use this feature, you must set up the e-mail server and templates. You can customize the following:

For more information, see Configuring E-Mail Notification.

Checking the Password Synchronization Status for a User

Identity Manager enables you to query connected systems to check a user’s password synchronization status. If the connected system supports the check password feature, you can find out whether passwords are synchronizing successfully.

For information on how to check passwords, see Checking the Password Synchronization Status for a User.

For a list of which systems support checking passwords, see Connected System Support for Password Synchronization.