Password Synchronization Across Connected Systems with
Nsure® Identity Manager 2

Trevor Roskewich Solutions Lead

Novell Inc.

Hicham Mourad

Solutions Lead

Novell Inc.

Kevin Boogert

Sr. Software Engineer

Novell Inc.

Session Agenda

What is Password Synchronization?

Features of Password Synchronization with Identity Manager 2.0

eDirectory™ and the Universal Password

Unidirectional Password Synchronization

Bidirectional Password Synchronization

Password Synchronization Scenarios

Live Demonstration – Deploying Password Synchronization and Management Features

Question & Answer Period

What is Password Synchronization?

A mechanism to replicate a user's password amongst multiple directories: eDirectory, Active Directory, NT 4, Lotus Notes, LDAP, etc..

A password update in one system is applied to the other participating systems

Access Security is relaxed for the sake of convenience

Password Synchronization
Product Requirements

The minimum product requirements must be met for a complete password synchronization solution:

eDirectory 8.7.3 or higher

Identity Manager 2.0

NMAS 2.3 or higher

NICI 2.6 or higher

iManager 2.0.2 or higher

LDAP server 8.7.3 or higher

If using Novell client, must be 4.9 or higher (3.4 for Win9x)

Password Synchronization with
Identity Manager 2.0 - Features

Unidirectional and Bidirectional Password Flow

Can enforce eDirectory and Connected System Password Policies on Synchronizing Passwords

Can check the synchronization status of a user's password

Includes several Password Synchronization scenarios

Includes User Password Self Service

Includes Forgotten Password Recovery

Can invoke notification or action on Password Set Failure

eDirectory
Universal and Distributed Passwords

New feature of eDirectory 8.7.1 and higher

Password is stored in an encrypted, but reversible format

Novell Modular Authentication Service (NMAS) policies determine how Universal, Distributed and NDS hashed passwords are updated and maintained

They can be synchronized or isolated

Introduction of Universal Password has allowed Password Synchronization to be integrated with Identity Manager 2.0

Password Architecture
eDirectory 8.7.1 and higher

NMAS 2.3

Distribution

Password

Universal

Password

NDS

Password

Simple

Password

iManager

iManager Self

-Service Console

Novell Client

Universal Password Enabled

LDAP

eGuide

ConsoleOne®

(Universal Password enabling

depends on Client or NetWare)

Novell Client™

not Universal Password enabled

Password Digest in
Connected Systems

Connected Systems store passwords in different formats:

NT 4 / Active Directory (AD) – MD5 Digest / Hash

NIS – UNIX crypt, Blowfish, MD5, 3rd Party Algorithm

Therefore, password synchronization cannot be accomplished by simply synchronizing a single attribute between eDirectory and connected systems!

Most of these formats are irreversible. The clear text value of password cannot be determined from the hash

Unidirectional Password
Synchronization

Refers to Identity Manager connectors that can distribute passwords to connected systems ONLY

Can set initial password for created account and/or change password in connected system

Connectors include:

GroupWise®

LDAP

Lotus Notes

SAP User Management

JDBC

Distributing Passwords
How it works

Identity Manager detects a change in Universal or Distributed Password (or new account creation)

The password value is decrypted and sent to the Identity Manager connector (or as defined in an IDM policy)

The Identity Manager connector makes API-based password change call(s) to the connected system

The connected system performs the password change and stores it in the native format

Bidirectional Password
Synchronization

Identity Manager 2.0 introduces bidirectional password synchronization with the following systems:

Active Directory

eDirectory

NIS

NT Domain

School Interoperability Framework (SIF)

Identity Manager can distribute passwords to and can accept passwords from these connected systems

Accepting Passwords
How It Works

A password change is performed in the connected system

The IDM2 password filter intercepts the clear-text value of the password and passes it to the IDM2 connector

NT4 / Active Directory (.dll on all domain controller(s))

NIS (PAM module)

The connected system commits the password change while IDM2 passes the password value to NMAS

NMAS applies the password policy (if the IDM2 setting mandates) and performs the password change in eDirectory

Password Synchronization
Configuration Requirements

Password Synchronization capabilities are declared in the connector's “Driver Manifest” section

Also in the Password Management / Password Synchronization view in iManager

Password Synchronization settings must be set in the connector's “Global Configuration Values” section

Filters (Publisher / Subscriber channels) on the connected systems

Password policies must be defined and assigned in eDirectory for NMAS / Universal Password

Password Synchronization Configuration Utility

Password Synchronization Filters (Domain Controllers / NIS)

NOTE: The combination of the Identity Manager 2.0 Connector and the Password Policy options determines password synchronization behavior

Password Synchronization
Configuration Requirements (cont.)

NDS

Password

Password Synchronization
(Identity Manager 2.0) - Configuration Options – Scenario 1

eDirectory to eDirectory

password synchronization

using NDS password (key pair)

NMAS 2.3

Distribution

Password

Universal

Password

NDS

Password

Simple

Password

eDirectory

eDirectory

DirXML® Driver for eDirectory

Password Synchronization
(Identity Manager 2.0) - Configuration Options – Scenario 2

Synchronizing Universal password

NMAS 2.3

Distribution

Password

Universal

Password

NDS

Password

Simple

Password

IDM 2

Connected

Systems

Password Synchronization
(Identity Manager 2.0) - Configuration Options – Scenario 3

Password synchronization between eDirectory and connected systems using Distribution Password

NMAS 2.3

Distribution

Password

Universal

Password

NDS

Password

Simple

Password

IDM 2

Connected

Systems

Password Synchronization
(Identity Manager 2.0) - Configuration Options – Scenario 4

Password Tunneling: Synchronizing passwords between connected systems but not with eDirectory. Identity Manager 2.0 updates Distribution password

NMAS 2.3

Distribution

Password

Universal

Password

NDS

Password

Simple

Password

IDM 2

Connected

Systems

Password Synchronization
(Identity Manager 2.0) - Configuration Options – Scenario 5

Synchronizing Application Password to Simple Password

Clear Text, SHA, MD5, UNIX crypt

Publish to SAS:Login Configuration attribute

NMAS 2.3

Distribution

Password

Universal

Password

NDS

Password

Simple

Password

IDM 2

Connected System

with Hashed or Clear Text

Password

Connected System

Authentication via LDAP

NMAS 2.3.5 and higher introduces Universal Password expiration with an administrative password change

Configuring password publication to Universal Password mimics a password change by the administrator

Universal Password will be expired

Configuring password publication to Distribution Password mimics a password change by the user

Universal Password will NOT be expired

Note: Publishing to Distribution Password will be desired in most cases

Configuration Considerations
NMAS 2.3.5 and Higher

Live Demonstration

Question & Answer

General Disclaimer

This document is not to be construed as a promise by any participating company to develop, deliver, or market a product. Novell, Inc., makes no representations or warranties with respect to the contents of this document, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc., reserves the right to revise this document and to make changes to its content, at any time, without obligation to notify any person or entity of such revisions or changes. All Novell marks referenced in this presentation are trademarks or registered trademarks of Novell, Inc. in the United States and other countries. All third-party trademarks are the property of their respective owners.

No part of this work may be practiced, performed, copied, distributed, revised, modified, translated, abridged, condensed, expanded, collected, or adapted without the prior written consent of Novell, Inc. Any use or exploitation of this work without authorization could subject the perpetrator to criminal and civil liability.

This means that no work is lost with either the Novell Nsure UDDI corporate or testing solution.

Enterprises that build their UDDI solutions with Novell Nsure UDDI Server, are not only leveraging the deep experience Novell Identity Management foundation brings to the standard, they are securing their own future by building on an open standard implementation that will grow and scale with their corporate needs.

2003-12-08T12:43:39