Novell IDENTITY MANAGER 3.6.1 - PASSWORD MANAGEMENT Manuel utilisateur

Novell®

www.novell.com

novdocx (en) 13 May 2009

AUTHORIZED DOCUMENTATION

Identity Manager 3.6.1 Password Management Guide

Identity Manager

3.6.1

June 05, 2009

Password Management Guide

novdocx (en) 13 May 2009

Legal Notices

Novell, Inc. makes no representations or warranties with respect to the contents or use of this documentation, and

specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose.

Further, Novell, Inc. reserves the right to revise this publication and to make changes to its content, at any time,

without obligation to notify any person or entity of such revisions or changes.

Further, Novell, Inc. makes no representations or warranties with respect to any software, and specifically disclaims

any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc.

reserves the right to make changes to any and all parts of Novell software, at any time, without any obligation to

notify any person or entity of such changes.

Any products or technical information provided under this Agreement may be subject to U.S. export controls and the

trade laws of other countries. You agree to comply with all export control regulations and to obtain any required

licenses or classification to export, re-export, or import deliverables. You agree not to export or re-export to entities

on the current U.S. export exclusion lists or to any embargoed or terrorist countries as specified in the U.S. export

laws. You agree to not use deliverables for prohibited nuclear, missile, or chemical biological weaponry end uses.

Please refer to the International Trade Services (http://www.novell.com/company/policies/trade_services) for more

information on exporting Novell software. Novell assumes no responsibility for your failure to obtain any necessary

export approvals.

stored on a retrieval system, or transmitted without the express written consent of the publisher.

Novell, Inc. has intellectual property rights relating to technology embodied in the product that is described in this

document. In particular, and without limitation, these intellectual property rights may include one or more of the U.S.

patents listed on the Novell Legal Patents Web page (http://www.novell.com/company/legal/patents/) and one or

more additional patents or pending patent applications in the U.S. and in other countries.

Novell, Inc.

404 Wyman Street, Suite 500

Waltham, MA 02451

U.S.A.

www.novell.com

Online Documentation: To access the latest online documentation for this and other Novell products, see

the Novell Documentation Web page (http://www.novell.com/documentation).

novdocx (en) 13 May 2009

Novell Trademarks

For Novell trademarks, see the Novell Trademark and Service Mark list (http://www.novell.com/company/legal/

trademarks/tmlist.html).

Third-Party Materials

All third-party trademarks are the property of their respective owners.

4Identity Manager 3.6.1 Password Management Guide

novdocx (en) 13 May 2009

Contents 5

Contents

novdocx (en) 13 May 2009

About This Guide 7

1Overview 9

1.1 Universal Password and Distribution Password. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

1.2 Password Synchronization Flow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

1.3 Password Policy Enforcement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

1.4 Password Policy Enforcement Notifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

1.5 Password Policy Assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

1.6 Password Synchronization Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

1.7 Password Self-Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

2 Password Management Checklist 13

2.1 Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

2.2 Synchronizing Passwords . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

2.3 Password Self-Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

3 Connected System Support for Password Synchronization 15

3.1 Systems That Support Bidirectional Password Synchronization . . . . . . . . . . . . . . . . . . . . . . . 15

3.2 Systems That Accept Passwords from Identity Manager. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

3.3 Systems That Don’t Accept or Provide Passwords By Default . . . . . . . . . . . . . . . . . . . . . . . . 16

3.4 Systems That Don’t Support Password Synchronization. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

4 Configuring Password Flow 19

4.1 Verifying Password Synchronization Settings in iManager . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

4.2 Verifying Password Synchronization Settings in Designer. . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

5 Configuring E-Mail Notification 25

5.1 Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

5.2 Setting Up the SMTP Server to Send E-Mail Notification. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

5.3 Setting Up E-Mail Templates for Notification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

5.4 Providing SMTP Authentication Information in Driver Policies. . . . . . . . . . . . . . . . . . . . . . . . . 28

5.5 Adding Your Own Replacement Tags to E-Mail Notification Templates . . . . . . . . . . . . . . . . . 30

5.5.1 Adding Replacement Tags to Password Synchronization E-Mail Notification

Templates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

5.5.2 Adding Replacement Tags to Forgotten Password E-Mail Notification Templates . . 36

5.6 Sending E-Mail Notifications to the Administrator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

5.7 Localizing E-Mail Notification Templates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

6Identity Manager 3.6.1 Password Management Guide

novdocx (en) 13 May 2009

6 Checking the Password Synchronization Status for a User 39

7 Troubleshooting Password Synchronization 41

A Password Synchronization Scenarios 43

A.1 Scenario 1: Using NDS Password to Synchronize between Two Identity Vaults. . . . . . . . . . . 43

A.1.1 Advantages and Disadvantages of Scenario 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

A.1.2 Setting Up Scenario 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

A.1.3 Troubleshooting Scenario 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45

A.2 Scenario 2: Using Universal Password to Synchronize Passwords. . . . . . . . . . . . . . . . . . . . . 45

A.2.1 Advantages and Disadvantages of Scenario 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

A.2.2 Setting Up Scenario 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

A.2.3 Troubleshooting Scenario 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51

A.3 Scenario 3: Synchronizing an Identity Vault and Connected Systems, with Identity Manager

Updating the Distribution Password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55

A.3.1 Advantages and Disadvantages of Scenario 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56

A.3.2 Setting Up Scenario 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56

A.3.3 Troubleshooting Scenario 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60

A.4 Scenario 4: Tunneling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64

A.4.1 Advantages and Disadvantages of Scenario 4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65

A.4.2 Setting Up Scenario 4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65

A.4.3 Troubleshooting Scenario 4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67

A.5 Scenario 5: Synchronizing Application Passwords to the Simple Password . . . . . . . . . . . . . . 68

A.5.1 Advantages and Disadvantages of Scenario 5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70

A.5.2 Setting Up Scenario 5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70

B Driver Configuration Policies 73

B.1 Policies Required in the Publisher Command Transformation Set . . . . . . . . . . . . . . . . . . . . . 73

B.2 Policies Required in the Publisher Input Transformation Policy Set . . . . . . . . . . . . . . . . . . . . 75

B.3 Policies Required in the Subscriber Command Transformation Policy Set . . . . . . . . . . . . . . . 75

B.4 Policies Required in the Subscriber Output Transformation Policy Set . . . . . . . . . . . . . . . . . . 76

About This Guide 7

novdocx (en) 13 May 2009

About This Guide

This guide provides information about managing passwords through Identity Manager. The guide is

organized as follows:

Chapter 2, “Password Management Checklist,” on page 13

Chapter 1, “Overview,” on page 9

Chapter 3, “Connected System Support for Password Synchronization,” on page 15

Chapter 4, “Configuring Password Flow,” on page 19

Chapter 5, “Configuring E-Mail Notification,” on page 25

Chapter 6, “Checking the Password Synchronization Status for a User,” on page 39

Chapter 7, “Troubleshooting Password Synchronization,” on page 41

Appendix A, “Password Synchronization Scenarios,” on page 43

Appendix B, “Driver Configuration Policies,” on page 73

Audience

This guide is intended for administrators, consultants, and network engineers who require a high-

level introduction to Identity Manager business solutions, technologies, and tools.

Documentation Updates

For the most recent version of this document, see the Identity Manager Documentation Web site

(http://www.novell.com/documentation/idm36/index.html).

Additional Documentation

For additional Identity Manager documentation, see the Identity Manager Documentation Web site

(http://www.novell.com/documentation/idm36/index.html).

Documentation Conventions

In Novell®documentation, a greater-than symbol (>) is used to separate actions within a step and

items in a cross-reference path.

A trademark symbol (®, TM, etc.) denotes a Novell trademark. An asterisk (*) denotes a third-party

trademark.

When a single pathname can be written with a backslash for some platforms or a forward slash for

other platforms, the pathname is presented with a backslash. Users of platforms that require a

forward slash, such as Linux* or UNIX*, should use forward slashes as required by your software.

8Identity Manager 3.6.1 Password Management Guide

novdocx (en) 13 May 2009

Overview

novdocx (en) 13 May 2009

Overview

Identity Manager helps you manage user passwords across multiple accounts. You can synchronize

passwords among systems, allow users to change their passwords, and enable users to recover from

forgotten passwords.

In the following diagram, the Identity Manager system is configured to synchronize passwords for

users who have Active Directory* and iPlanet* accounts. In addition, password self-service is

enabled through the Identity Manager User Application so that users can change their passwords

and, if necessary, recover from forgotten passwords.

Figure 1-1 Password Management with Identity Manager

Identity Manager provides synchronization of passwords between the Identity Vault and connected

systems. It also supports password self-service, which is the ability for users to change their own

passwords and recover from forgotten passwords.

The following sections introduce you to the concepts you need to understand to successfully

implement password synchronization and password self-service:

Section 1.1, “Universal Password and Distribution Password,” on page 10

Driver

Password

Policies

Password Sync

Entitlements

Metadirectory

Engine

Metadirectory

Server

Domain Controller

or Member Server

Identity

Vault

LDAP

Active

Directory

Remote

Loader

iPlanet Server

User Application

Server

Password

Self-service

Active Directory

Server

10 Identity Manager 3.6.1 Password Management Guide

novdocx (en) 13 May 2009

Section 1.2, “Password Synchronization Flow,” on page 10

Section 1.3, “Password Policy Enforcement,” on page 11

Section 1.4, “Password Policy Enforcement Notifications,” on page 11

Section 1.5, “Password Policy Assignments,” on page 11

Section 1.6, “Password Synchronization Status,” on page 12

Section 1.7, “Password Self-Service,” on page 12

1.1 Universal Password and Distribution

Password

Identity Manager requires Universal Password for both password synchronization and password

self-service. Universal Password synchronizes the various passwords (Universal, NDS®, Simple,

and Distribution) stored in the Identity Vault and provides password policies that define the rules for

creating and replacing passwords in the Identity Vault.

Universal Password is explained in detail in the Novell Password Management 3.2 Administration

Guide (http://www.novell.com/documentation/password_management32).

To control password synchronization between the Identity Vault and connected systems, Identity

Manager uses the Distribution password. When a password is received from a connected system, it

is stored as the Distribution password. When a password is sent to a connected system, the

Distribution password is sent.

You can choose to synchronize the Distribution and Universal passwords or not synchronize them. If

you synchronize the passwords, your Identity Vault passwords and connected system passwords will

be the same. If you don’t synchronize the passwords, your Identity Vault passwords will be different

than your connected system passwords; in essence, you are “tunneling” passwords among connected

systems without affecting the passwords (Universal, NDS, or Simple) in your Identity Vault.

1.2 Password Synchronization Flow

Identity Manager supports the following levels of password synchronization:

Bidirectional: Identity Manager accepts passwords from a connected system and distributes

passwords to the connected system. Users can change their passwords in the connected system

or in the Identity Vault.

Some connected systems can’t provide the user’s actual password, which means they don’t

support full bidirectional password synchronization. However, they can provide data (first

name, last name, and so forth) that the connected system’s driver policies use to create an initial

password. After the initial password is created from connected system data, no more password

information is sent from the connected system. Passwords flow only from the Identity Vault to

the connected system.

To the connected system: Identity Manager distributes passwords from the Identity Vault to

the connected system only.

To the Identity Vault: Identity Manager distributes passwords from the connected system to

the Identity Vault only.

Ce manuel convient aux modèles suivants

Table des matières

Autres manuels Novell Logiciel

Novell

Novell EDIRECTORY 8.8 - GUIDE 09-2006 Manuel utilisateur

Novell

Novell ZENWORKS APPLICATION VIRTUALIZATION - V8.0.3 INTEGRATION AND STREAMING... Manuel utilisateur

Novell

Novell IDENTITY MANAGER 3.6.1 Manuel utilisateur

Novell

Novell APPARMOR 2.1 - Mode d’emploi

Novell

Novell ZENWORKS SUITE 7SP1 IR4 - GETTING STARTED GUIDE... Manuel utilisateur

Novell

Novell CLIENT LOGIN EXTENSION 3.7 - ADMINISTRATION Mode d’emploi

Novell

Novell LINUX ENTERPRISE DESKTOP 11 - ADMINISTRATION GUIDE... Mode d’emploi

Novell

Novell IDENTITY MANAGER 3.6.1 - ENTITLEMENTS Manuel utilisateur

Novell

Novell APPARMOR 2.0 Mode d’emploi

Novell

Novell GROUPWISE 8 - SECURITY POLICIES Manuel utilisateur

Novell

Novell ZENWORKS ENDPOINT SECURITY MANAGEMENT 4.0 -... Manuel utilisateur

Novell

Novell PLATESPIN ORCHESTRATE 2.0.2 - ADMINISTRATOR REFERENCE... Manuel de service

Novell

Novell GROUPWISE 8 - MONITOR Mode d’emploi

Novell

Novell GROUPWISE 8 - MONITOR Manuel utilisateur

Novell

Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - NETWORK DISCOVERY DATABASE... Guide rapide

Novell

Novell CLIENT FOR LINUX 1.2 Manuel utilisateur

Novell

Novell LINUX ENTERPRISE SERVER STARTER SYSTEM Manuel utilisateur

Novell

Novell ZENWORKS APPLICATION VIRTUALIZATION 8.0.2 - INTEGRATION AND STREAMING GUIDE... Manuel utilisateur

Novell

Novell GROUPWISE 8 - POST OFFICES Manuel utilisateur

Novell

Novell LINUX ENTERPRISE DESKTOP 11 - ADMINISTRATION GUIDE... Guide de l'utilisateur

Novell

Novell ZENWORKS 7.2 LINUX MANAGEMENT - SCENARIOS 2... Manuel utilisateur

Novell

Novell ZENWORKS PATCH MANAGEMENT 6.4 - S Manuel utilisateur

Novell

Novell ACCESS MANAGER 3.1 SP2 - README 2010 Manuel utilisateur

Novell

Novell LINUX ENTERPRISE DESKTOP 10 SP1 - KDE... Manuel utilisateur

Manuels Logiciel populaires d'autres marques

COMPRO

COMPRO COMPROFM Manuel utilisateur

Muratec

Muratec OFFICEBRIDGE ONLINE Manuel utilisateur

Oracle

Oracle Contact Center Anywhere 8.1 Manuel utilisateur

Adobe

Adobe 65007312 - Photoshop Lightroom Manuel

Avaya

Avaya NULL One-X for RIM Blackberry Manuel utilisateur

HP ProLiant BL420c Manuel utilisateur

PS Audio

PS Audio PowerPlay Manuel du propriétaire

Brady

Brady LOCKOUT PRO 3.0 Manuel de service

Avaya

Avaya Interaction Center Manuel utilisateur

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Manuel

Oracle

Oracle Application 9i Manuel utilisateur

Acer

Acer RDM Manuel utilisateur

Canon

Canon Vixia HF21 Manuel utilisateur

Canon

Canon ZR950 Manuel utilisateur

Samsung

Samsung Auto Backup Manuel utilisateur

Polycom

Polycom Vortex EF2201 Instructions d'installation et d'utilisation

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Manuel utilisateur

Lexmark

Lexmark Apps Manuel de service