Novell IDENTITY MANAGER 3.6.1 - PASSWORD MANAGEMENT User manual

Novell®
www.novell.com
novdocx (en) 13 May 2009
AUTHORIZED DOCUMENTATION
Identity Manager 3.6.1 Password Management Guide
Identity Manager
3.6.1
June 05, 2009
Password Management Guide

novdocx (en) 13 May 2009
Legal Notices
Novell, Inc. makes no representations or warranties with respect to the contents or use of this documentation, and
specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose.
Further, Novell, Inc. reserves the right to revise this publication and to make changes to its content, at any time,
without obligation to notify any person or entity of such revisions or changes.
Further, Novell, Inc. makes no representations or warranties with respect to any software, and specifically disclaims
any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc.
reserves the right to make changes to any and all parts of Novell software, at any time, without any obligation to
notify any person or entity of such changes.
Any products or technical information provided under this Agreement may be subject to U.S. export controls and the
trade laws of other countries. You agree to comply with all export control regulations and to obtain any required
licenses or classification to export, re-export, or import deliverables. You agree not to export or re-export to entities
on the current U.S. export exclusion lists or to any embargoed or terrorist countries as specified in the U.S. export
laws. You agree to not use deliverables for prohibited nuclear, missile, or chemical biological weaponry end uses.
Please refer to the International Trade Services (http://www.novell.com/company/policies/trade_services) for more
information on exporting Novell software. Novell assumes no responsibility for your failure to obtain any necessary
export approvals.
Copyright © 2008-2009 Novell, Inc. All rights reserved. No part of this publication may be reproduced, photocopied,
stored on a retrieval system, or transmitted without the express written consent of the publisher.
Novell, Inc. has intellectual property rights relating to technology embodied in the product that is described in this
document. In particular, and without limitation, these intellectual property rights may include one or more of the U.S.
patents listed on the Novell Legal Patents Web page (http://www.novell.com/company/legal/patents/) and one or
more additional patents or pending patent applications in the U.S. and in other countries.
Novell, Inc.
404 Wyman Street, Suite 500
Waltham, MA 02451
U.S.A.
www.novell.com
Online Documentation: To access the latest online documentation for this and other Novell products, see
the Novell Documentation Web page (http://www.novell.com/documentation).

novdocx (en) 13 May 2009
Novell Trademarks
For Novell trademarks, see the Novell Trademark and Service Mark list (http://www.novell.com/company/legal/
trademarks/tmlist.html).
Third-Party Materials
All third-party trademarks are the property of their respective owners.

4Identity Manager 3.6.1 Password Management Guide
novdocx (en) 13 May 2009

Contents 5
Contents
novdocx (en) 13 May 2009
About This Guide 7
1Overview 9
1.1 Universal Password and Distribution Password. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
1.2 Password Synchronization Flow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
1.3 Password Policy Enforcement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
1.4 Password Policy Enforcement Notifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
1.5 Password Policy Assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
1.6 Password Synchronization Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
1.7 Password Self-Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
2 Password Management Checklist 13
2.1 Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
2.2 Synchronizing Passwords . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
2.3 Password Self-Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
3 Connected System Support for Password Synchronization 15
3.1 Systems That Support Bidirectional Password Synchronization . . . . . . . . . . . . . . . . . . . . . . . 15
3.2 Systems That Accept Passwords from Identity Manager. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
3.3 Systems That Don’t Accept or Provide Passwords By Default . . . . . . . . . . . . . . . . . . . . . . . . 16
3.4 Systems That Don’t Support Password Synchronization. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
4 Configuring Password Flow 19
4.1 Verifying Password Synchronization Settings in iManager . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
4.2 Verifying Password Synchronization Settings in Designer. . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
5 Configuring E-Mail Notification 25
5.1 Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
5.2 Setting Up the SMTP Server to Send E-Mail Notification. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
5.3 Setting Up E-Mail Templates for Notification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
5.4 Providing SMTP Authentication Information in Driver Policies. . . . . . . . . . . . . . . . . . . . . . . . . 28
5.5 Adding Your Own Replacement Tags to E-Mail Notification Templates . . . . . . . . . . . . . . . . . 30
5.5.1 Adding Replacement Tags to Password Synchronization E-Mail Notification
Templates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
5.5.2 Adding Replacement Tags to Forgotten Password E-Mail Notification Templates . . 36
5.6 Sending E-Mail Notifications to the Administrator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
5.7 Localizing E-Mail Notification Templates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

6Identity Manager 3.6.1 Password Management Guide
novdocx (en) 13 May 2009
6 Checking the Password Synchronization Status for a User 39
7 Troubleshooting Password Synchronization 41
A Password Synchronization Scenarios 43
A.1 Scenario 1: Using NDS Password to Synchronize between Two Identity Vaults. . . . . . . . . . . 43
A.1.1 Advantages and Disadvantages of Scenario 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
A.1.2 Setting Up Scenario 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
A.1.3 Troubleshooting Scenario 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
A.2 Scenario 2: Using Universal Password to Synchronize Passwords. . . . . . . . . . . . . . . . . . . . . 45
A.2.1 Advantages and Disadvantages of Scenario 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
A.2.2 Setting Up Scenario 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
A.2.3 Troubleshooting Scenario 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
A.3 Scenario 3: Synchronizing an Identity Vault and Connected Systems, with Identity Manager
Updating the Distribution Password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
A.3.1 Advantages and Disadvantages of Scenario 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
A.3.2 Setting Up Scenario 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
A.3.3 Troubleshooting Scenario 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
A.4 Scenario 4: Tunneling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
A.4.1 Advantages and Disadvantages of Scenario 4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
A.4.2 Setting Up Scenario 4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
A.4.3 Troubleshooting Scenario 4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
A.5 Scenario 5: Synchronizing Application Passwords to the Simple Password . . . . . . . . . . . . . . 68
A.5.1 Advantages and Disadvantages of Scenario 5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
A.5.2 Setting Up Scenario 5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
B Driver Configuration Policies 73
B.1 Policies Required in the Publisher Command Transformation Set . . . . . . . . . . . . . . . . . . . . . 73
B.2 Policies Required in the Publisher Input Transformation Policy Set . . . . . . . . . . . . . . . . . . . . 75
B.3 Policies Required in the Subscriber Command Transformation Policy Set . . . . . . . . . . . . . . . 75
B.4 Policies Required in the Subscriber Output Transformation Policy Set . . . . . . . . . . . . . . . . . . 76

About This Guide 7
novdocx (en) 13 May 2009
About This Guide
This guide provides information about managing passwords through Identity Manager. The guide is
organized as follows:
Chapter 2, “Password Management Checklist,” on page 13
Chapter 1, “Overview,” on page 9
Chapter 3, “Connected System Support for Password Synchronization,” on page 15
Chapter 4, “Configuring Password Flow,” on page 19
Chapter 5, “Configuring E-Mail Notification,” on page 25
Chapter 6, “Checking the Password Synchronization Status for a User,” on page 39
Chapter 7, “Troubleshooting Password Synchronization,” on page 41
Appendix A, “Password Synchronization Scenarios,” on page 43
Appendix B, “Driver Configuration Policies,” on page 73
Audience
This guide is intended for administrators, consultants, and network engineers who require a high-
level introduction to Identity Manager business solutions, technologies, and tools.
Documentation Updates
For the most recent version of this document, see the Identity Manager Documentation Web site
(http://www.novell.com/documentation/idm36/index.html).
Additional Documentation
For additional Identity Manager documentation, see the Identity Manager Documentation Web site
(http://www.novell.com/documentation/idm36/index.html).
Documentation Conventions
In Novell®documentation, a greater-than symbol (>) is used to separate actions within a step and
items in a cross-reference path.
A trademark symbol (®, TM, etc.) denotes a Novell trademark. An asterisk (*) denotes a third-party
trademark.
When a single pathname can be written with a backslash for some platforms or a forward slash for
other platforms, the pathname is presented with a backslash. Users of platforms that require a
forward slash, such as Linux* or UNIX*, should use forward slashes as required by your software.

8Identity Manager 3.6.1 Password Management Guide
novdocx (en) 13 May 2009

Overview
1
9
novdocx (en) 13 May 2009
1
Overview
Identity Manager helps you manage user passwords across multiple accounts. You can synchronize
passwords among systems, allow users to change their passwords, and enable users to recover from
forgotten passwords.
In the following diagram, the Identity Manager system is configured to synchronize passwords for
users who have Active Directory* and iPlanet* accounts. In addition, password self-service is
enabled through the Identity Manager User Application so that users can change their passwords
and, if necessary, recover from forgotten passwords.
Figure 1-1 Password Management with Identity Manager
Identity Manager provides synchronization of passwords between the Identity Vault and connected
systems. It also supports password self-service, which is the ability for users to change their own
passwords and recover from forgotten passwords.
The following sections introduce you to the concepts you need to understand to successfully
implement password synchronization and password self-service:
Section 1.1, “Universal Password and Distribution Password,” on page 10
Driver
Driver
Password
Policies
Password Sync
Entitlements
Metadirectory
Engine
Metadirectory
Server
Domain Controller
or Member Server
Identity
Vault
LDAP
Active
Directory
Remote
Loader
iPlanet Server
User Application
Server
Password
Self-service
Active Directory
Server

10 Identity Manager 3.6.1 Password Management Guide
novdocx (en) 13 May 2009
Section 1.2, “Password Synchronization Flow,” on page 10
Section 1.3, “Password Policy Enforcement,” on page 11
Section 1.4, “Password Policy Enforcement Notifications,” on page 11
Section 1.5, “Password Policy Assignments,” on page 11
Section 1.6, “Password Synchronization Status,” on page 12
Section 1.7, “Password Self-Service,” on page 12
1.1 Universal Password and Distribution
Password
Identity Manager requires Universal Password for both password synchronization and password
self-service. Universal Password synchronizes the various passwords (Universal, NDS®, Simple,
and Distribution) stored in the Identity Vault and provides password policies that define the rules for
creating and replacing passwords in the Identity Vault.
Universal Password is explained in detail in the Novell Password Management 3.2 Administration
Guide (http://www.novell.com/documentation/password_management32).
To control password synchronization between the Identity Vault and connected systems, Identity
Manager uses the Distribution password. When a password is received from a connected system, it
is stored as the Distribution password. When a password is sent to a connected system, the
Distribution password is sent.
You can choose to synchronize the Distribution and Universal passwords or not synchronize them. If
you synchronize the passwords, your Identity Vault passwords and connected system passwords will
be the same. If you don’t synchronize the passwords, your Identity Vault passwords will be different
than your connected system passwords; in essence, you are “tunneling” passwords among connected
systems without affecting the passwords (Universal, NDS, or Simple) in your Identity Vault.
1.2 Password Synchronization Flow
Identity Manager supports the following levels of password synchronization:
Bidirectional: Identity Manager accepts passwords from a connected system and distributes
passwords to the connected system. Users can change their passwords in the connected system
or in the Identity Vault.
Some connected systems can’t provide the user’s actual password, which means they don’t
support full bidirectional password synchronization. However, they can provide data (first
name, last name, and so forth) that the connected system’s driver policies use to create an initial
password. After the initial password is created from connected system data, no more password
information is sent from the connected system. Passwords flow only from the Identity Vault to
the connected system.
To the connected system: Identity Manager distributes passwords from the Identity Vault to
the connected system only.
To the Identity Vault: Identity Manager distributes passwords from the connected system to
the Identity Vault only.