Novell IDENTITY MANAGER 3.6.1 - PASSWORD MANAGEMENT User manual

Novell®

www.novell.com

novdocx (en) 13 May 2009

AUTHORIZED DOCUMENTATION

Identity Manager 3.6.1 Password Management Guide

Identity Manager

3.6.1

June 05, 2009

Password Management Guide

novdocx (en) 13 May 2009

Legal Notices

Novell, Inc. makes no representations or warranties with respect to the contents or use of this documentation, and

specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose.

Further, Novell, Inc. reserves the right to revise this publication and to make changes to its content, at any time,

without obligation to notify any person or entity of such revisions or changes.

Further, Novell, Inc. makes no representations or warranties with respect to any software, and specifically disclaims

any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc.

reserves the right to make changes to any and all parts of Novell software, at any time, without any obligation to

notify any person or entity of such changes.

Any products or technical information provided under this Agreement may be subject to U.S. export controls and the

trade laws of other countries. You agree to comply with all export control regulations and to obtain any required

licenses or classification to export, re-export, or import deliverables. You agree not to export or re-export to entities

on the current U.S. export exclusion lists or to any embargoed or terrorist countries as specified in the U.S. export

laws. You agree to not use deliverables for prohibited nuclear, missile, or chemical biological weaponry end uses.

Please refer to the International Trade Services (http://www.novell.com/company/policies/trade_services) for more

information on exporting Novell software. Novell assumes no responsibility for your failure to obtain any necessary

export approvals.

stored on a retrieval system, or transmitted without the express written consent of the publisher.

Novell, Inc. has intellectual property rights relating to technology embodied in the product that is described in this

document. In particular, and without limitation, these intellectual property rights may include one or more of the U.S.

patents listed on the Novell Legal Patents Web page (http://www.novell.com/company/legal/patents/) and one or

more additional patents or pending patent applications in the U.S. and in other countries.

Novell, Inc.

404 Wyman Street, Suite 500

Waltham, MA 02451

U.S.A.

www.novell.com

Online Documentation: To access the latest online documentation for this and other Novell products, see

the Novell Documentation Web page (http://www.novell.com/documentation).

novdocx (en) 13 May 2009

Novell Trademarks

For Novell trademarks, see the Novell Trademark and Service Mark list (http://www.novell.com/company/legal/

trademarks/tmlist.html).

Third-Party Materials

All third-party trademarks are the property of their respective owners.

4Identity Manager 3.6.1 Password Management Guide

novdocx (en) 13 May 2009

Contents 5

Contents

novdocx (en) 13 May 2009

About This Guide 7

1Overview 9

1.1 Universal Password and Distribution Password. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

1.2 Password Synchronization Flow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

1.3 Password Policy Enforcement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

1.4 Password Policy Enforcement Notifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

1.5 Password Policy Assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

1.6 Password Synchronization Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

1.7 Password Self-Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

2 Password Management Checklist 13

2.1 Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

2.2 Synchronizing Passwords . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

2.3 Password Self-Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

3 Connected System Support for Password Synchronization 15

3.1 Systems That Support Bidirectional Password Synchronization . . . . . . . . . . . . . . . . . . . . . . . 15

3.2 Systems That Accept Passwords from Identity Manager. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

3.3 Systems That Don’t Accept or Provide Passwords By Default . . . . . . . . . . . . . . . . . . . . . . . . 16

3.4 Systems That Don’t Support Password Synchronization. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

4 Configuring Password Flow 19

4.1 Verifying Password Synchronization Settings in iManager . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

4.2 Verifying Password Synchronization Settings in Designer. . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

5 Configuring E-Mail Notification 25

5.1 Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

5.2 Setting Up the SMTP Server to Send E-Mail Notification. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

5.3 Setting Up E-Mail Templates for Notification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

5.4 Providing SMTP Authentication Information in Driver Policies. . . . . . . . . . . . . . . . . . . . . . . . . 28

5.5 Adding Your Own Replacement Tags to E-Mail Notification Templates . . . . . . . . . . . . . . . . . 30

5.5.1 Adding Replacement Tags to Password Synchronization E-Mail Notification

Templates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

5.5.2 Adding Replacement Tags to Forgotten Password E-Mail Notification Templates . . 36

5.6 Sending E-Mail Notifications to the Administrator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

5.7 Localizing E-Mail Notification Templates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

6Identity Manager 3.6.1 Password Management Guide

novdocx (en) 13 May 2009

6 Checking the Password Synchronization Status for a User 39

7 Troubleshooting Password Synchronization 41

A Password Synchronization Scenarios 43

A.1 Scenario 1: Using NDS Password to Synchronize between Two Identity Vaults. . . . . . . . . . . 43

A.1.1 Advantages and Disadvantages of Scenario 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

A.1.2 Setting Up Scenario 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

A.1.3 Troubleshooting Scenario 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45

A.2 Scenario 2: Using Universal Password to Synchronize Passwords. . . . . . . . . . . . . . . . . . . . . 45

A.2.1 Advantages and Disadvantages of Scenario 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

A.2.2 Setting Up Scenario 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

A.2.3 Troubleshooting Scenario 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51

A.3 Scenario 3: Synchronizing an Identity Vault and Connected Systems, with Identity Manager

Updating the Distribution Password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55

A.3.1 Advantages and Disadvantages of Scenario 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56

A.3.2 Setting Up Scenario 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56

A.3.3 Troubleshooting Scenario 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60

A.4 Scenario 4: Tunneling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64

A.4.1 Advantages and Disadvantages of Scenario 4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65

A.4.2 Setting Up Scenario 4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65

A.4.3 Troubleshooting Scenario 4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67

A.5 Scenario 5: Synchronizing Application Passwords to the Simple Password . . . . . . . . . . . . . . 68

A.5.1 Advantages and Disadvantages of Scenario 5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70

A.5.2 Setting Up Scenario 5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70

B Driver Configuration Policies 73

B.1 Policies Required in the Publisher Command Transformation Set . . . . . . . . . . . . . . . . . . . . . 73

B.2 Policies Required in the Publisher Input Transformation Policy Set . . . . . . . . . . . . . . . . . . . . 75

B.3 Policies Required in the Subscriber Command Transformation Policy Set . . . . . . . . . . . . . . . 75

B.4 Policies Required in the Subscriber Output Transformation Policy Set . . . . . . . . . . . . . . . . . . 76

About This Guide 7

novdocx (en) 13 May 2009

About This Guide

This guide provides information about managing passwords through Identity Manager. The guide is

organized as follows:

Chapter 2, “Password Management Checklist,” on page 13

Chapter 1, “Overview,” on page 9

Chapter 3, “Connected System Support for Password Synchronization,” on page 15

Chapter 4, “Configuring Password Flow,” on page 19

Chapter 5, “Configuring E-Mail Notification,” on page 25

Chapter 6, “Checking the Password Synchronization Status for a User,” on page 39

Chapter 7, “Troubleshooting Password Synchronization,” on page 41

Appendix A, “Password Synchronization Scenarios,” on page 43

Appendix B, “Driver Configuration Policies,” on page 73

Audience

This guide is intended for administrators, consultants, and network engineers who require a high-

level introduction to Identity Manager business solutions, technologies, and tools.

Documentation Updates

For the most recent version of this document, see the Identity Manager Documentation Web site

(http://www.novell.com/documentation/idm36/index.html).

Additional Documentation

For additional Identity Manager documentation, see the Identity Manager Documentation Web site

(http://www.novell.com/documentation/idm36/index.html).

Documentation Conventions

In Novell®documentation, a greater-than symbol (>) is used to separate actions within a step and

items in a cross-reference path.

A trademark symbol (®, TM, etc.) denotes a Novell trademark. An asterisk (*) denotes a third-party

trademark.

When a single pathname can be written with a backslash for some platforms or a forward slash for

other platforms, the pathname is presented with a backslash. Users of platforms that require a

forward slash, such as Linux* or UNIX*, should use forward slashes as required by your software.

8Identity Manager 3.6.1 Password Management Guide

novdocx (en) 13 May 2009

Overview

novdocx (en) 13 May 2009

Overview

Identity Manager helps you manage user passwords across multiple accounts. You can synchronize

passwords among systems, allow users to change their passwords, and enable users to recover from

forgotten passwords.

In the following diagram, the Identity Manager system is configured to synchronize passwords for

users who have Active Directory* and iPlanet* accounts. In addition, password self-service is

enabled through the Identity Manager User Application so that users can change their passwords

and, if necessary, recover from forgotten passwords.

Figure 1-1 Password Management with Identity Manager

Identity Manager provides synchronization of passwords between the Identity Vault and connected

systems. It also supports password self-service, which is the ability for users to change their own

passwords and recover from forgotten passwords.

The following sections introduce you to the concepts you need to understand to successfully

implement password synchronization and password self-service:

Section 1.1, “Universal Password and Distribution Password,” on page 10

Driver

Password

Policies

Password Sync

Entitlements

Metadirectory

Engine

Metadirectory

Server

Domain Controller

or Member Server

Identity

Vault

LDAP

Active

Directory

Remote

Loader

iPlanet Server

User Application

Server

Password

Self-service

Active Directory

Server

10 Identity Manager 3.6.1 Password Management Guide

novdocx (en) 13 May 2009

Section 1.2, “Password Synchronization Flow,” on page 10

Section 1.3, “Password Policy Enforcement,” on page 11

Section 1.4, “Password Policy Enforcement Notifications,” on page 11

Section 1.5, “Password Policy Assignments,” on page 11

Section 1.6, “Password Synchronization Status,” on page 12

Section 1.7, “Password Self-Service,” on page 12

1.1 Universal Password and Distribution

Password

Identity Manager requires Universal Password for both password synchronization and password

self-service. Universal Password synchronizes the various passwords (Universal, NDS®, Simple,

and Distribution) stored in the Identity Vault and provides password policies that define the rules for

creating and replacing passwords in the Identity Vault.

Universal Password is explained in detail in the Novell Password Management 3.2 Administration

Guide (http://www.novell.com/documentation/password_management32).

To control password synchronization between the Identity Vault and connected systems, Identity

Manager uses the Distribution password. When a password is received from a connected system, it

is stored as the Distribution password. When a password is sent to a connected system, the

Distribution password is sent.

You can choose to synchronize the Distribution and Universal passwords or not synchronize them. If

you synchronize the passwords, your Identity Vault passwords and connected system passwords will

be the same. If you don’t synchronize the passwords, your Identity Vault passwords will be different

than your connected system passwords; in essence, you are “tunneling” passwords among connected

systems without affecting the passwords (Universal, NDS, or Simple) in your Identity Vault.

1.2 Password Synchronization Flow

Identity Manager supports the following levels of password synchronization:

Bidirectional: Identity Manager accepts passwords from a connected system and distributes

passwords to the connected system. Users can change their passwords in the connected system

or in the Identity Vault.

Some connected systems can’t provide the user’s actual password, which means they don’t

support full bidirectional password synchronization. However, they can provide data (first

name, last name, and so forth) that the connected system’s driver policies use to create an initial

password. After the initial password is created from connected system data, no more password

information is sent from the connected system. Passwords flow only from the Identity Vault to

the connected system.

To the connected system: Identity Manager distributes passwords from the Identity Vault to

the connected system only.

To the Identity Vault: Identity Manager distributes passwords from the connected system to

the Identity Vault only.

This manual suits for next models

Table of contents

Other Novell Software manuals

Novell

Novell LINUX ENTERPRISE SERVER STARTER SYSTEM User manual

Novell

Novell LINUX ENTERPRISE SERVER 10 SP2 - ARCHITECTURE-SPECIFIC INFORMATION... Manual

Novell

Novell LINUX ENTERPRISE DESKTOP 11 - ADMINISTRATION GUIDE... User guide

Novell

Novell LINUX ENTERPRISE SERVER 10 SP3 -... Manual

Novell

Novell BUSINESS CONTINUITY CLUSTERING 1.2.1 -... Instruction Manual

Novell

Novell EDIRECTORY 8.8 - GUIDE User manual

Novell

Novell LINUX ENTERPRISE SERVER 11 - DEPLOYMENT Quick reference guide

Novell

Novell PLATESPIN ORCHESTRATE 2.0.2 - ADMINISTRATOR REFERENCE... Service manual

Novell

Novell SENTINEL LOG MANAGER 1.0.0.5 - S Instruction Manual

Novell

Novell GROUPWISE 7 - SECURITY POLICIES User manual

Novell

Novell ZENWORKS LINUX MANAGEMENT 7.2 IR2 - ... User manual

Novell

Novell GROUPWISE 8 - MONITOR User manual

Novell

Novell APPARMOR 2.1 - User manual

Novell

Novell ACCESS MANAGER 3.1 SP2 - README 2010 User manual

Novell

Novell BUSINESS CONTINUITY CLUSTERING 1.1 SP1 - 9-21-2010 ADMINISTRATION GUIDE FOR OPEN ENTERPRISE SERVER 1 SP2... Instruction Manual

Novell

Novell LINUX ENTERPRISE DESKTOP 10 SP2 - KDE... User manual

Novell

Novell eBook Reader Instruction Manual

Novell

Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - COMMAND LINE UTILITIES REFERENCE 10.3... User manual

Novell

Novell EDIRECTORY 8.8 SP2 User manual

Novell

Novell ACCESS MANAGER 3.1 SP2 - J2EE AGENT GUIDE... User manual

Novell

Novell ZENWORKS PATCH MANAGEMENT 6.4 SP2 - SERVER User manual

Novell

Novell GROUPWISE 7 - MESSAGE TRANSFERT AGENT User manual

Novell

Novell ZENWORKS HANDELD MANAGEMENT 7 SP1 IR4 Instruction Manual

Novell

Novell SUSE LINUX ENTERPRISE SERVER 10 STORAGE User manual

Popular Software manuals by other brands

COMPRO

COMPRO COMPROFM manual

Muratec

Muratec OFFICEBRIDGE ONLINE user guide

Oracle

Oracle Contact Center Anywhere 8.1 installation guide

Adobe

Adobe 65007312 - Photoshop Lightroom Programmer's guide

Avaya

Avaya NULL One-X for RIM Blackberry user guide

HP ProLiant BL420c user guide

PS Audio

PS Audio PowerPlay Programming manual

Brady

Brady LOCKOUT PRO 3.0 Administrator's guide

Avaya

Avaya Interaction Center user guide

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Guide book

Oracle

Oracle Application 9i Configuration guide

Acer

Acer RDM user guide

Canon

Canon Vixia HF21 instruction manual

Canon

Canon ZR950 instruction manual

Samsung

Samsung Auto Backup user manual

Polycom

Polycom Vortex EF2201 Application note

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c user manual

Lexmark

Lexmark Apps Administrator's guide