Handling password while initial load process

Question

Dear Experts,
This is about password handling in IDM. While doing initial load, I do not want to bring passwords from my target systems (AD/SAP) into IDM.
So which password(s) the users will use to login into target systems (AD/SAP) after initial load ? What can be achieved with pass "update system privilege trigger attribute" which is available in initial load job ?
Is it something like, IDM creates a default password on initial load which is sent back to target systems(from which initial load was done) which changes the password for the target systems to this new default password ?
Can we handle this default password being sent to target systems with the help of this pass "update system privilege trigger attribute" in initial load? so that this default password is not sent to target systems ??
So if the default password is not sent back to target systems after initial load, then users will keep using their existing passwords for their login in the target systems. After that, If I need to assign UMEJAVA only privilege to the users, the password for the target systems will be changed with the default password being sent on email to the users. Since the password on AD is now changed, how the users gonna login into AD to check their emails for the
new password ?
It seems I have written a BIG query here .... sorry for that. But please let me know if any thing above does not make any sense.
Also please share your views/expertise/best practice on the same.
Many thanks in advance!
Naveen
Version: IDM 7.2

Answer 1

Hi Naveen,
Firstly to answer your query on what basis we decide he backend type for your UMEJAVA repository, its the business. If you want users to authenticate against AD, when they try to login to IDM UI, you have to configure the LDAP as backend and you have to choose datasource as Microsoft ADS (Deep Hierarchy) + Database (ume database).
If you want the Users to authenticate against UME database, by default ume points to UME database and you need to create the users in the UME database.
So, if you have configured AS JAVA with ADS+Database, in IDM you have to select the repository as SAP netweaver as Java (ldap backend)
In the repository constants, there is an attribute called BACKED_REPOSITORY which should be your AD repository name that is configured.
If you have a look at the AS JAVA connectors in the provisionign framework, in the create user plugin, IDM first checks for backend type. If it is LDAP backend, it just sets the JAVA account attibute, If the backend type is DB, IDM will create the user in the UME database.
Considering your system details, i would suggest you the below approach.
1. Configure your UMEJAVA with Microsoft ADS (Deep Hierarchy) + Database (ume database). For more information on how to configure your     
    UMEJAVA with LDAP backend refer to this link
2. So, now the users who try to login to IDM UI or any app on AS Java, will be authenticated against your active directory.
3. Perform the initial load from HR.
4. Perform the initial load from AD.
5. Perform the initial load from you AS UMEJAVA.
6. Now, all the user information/role assignment information is loaded to IDM.
7. Now lets discuss about password management. There are two things here
  a. Change password (by user)  - User changes password in IDM --> password changes are provisioned to AD and user can login with new password.
  b .Password reset self service. - User resets password in IDM --> password changes in AD (as UME is configured to use AD)
Change password (by user)
By default the users who are successfully authenticated when they try to login to IDM UI, will get access to self-services tab. To allow users to change the password on their own, you create the corresponding ordered tasks and maintain the access control tab for selfservice.
So that when users wants to change their passwords, they can change on their own.
How IDM will provision the new password to target system is something you have to configure the logic. For example, my sandbox looks like this.
Password reset self-service.
The user can reset their password on their own if they cannot remember their password. To implement this, look at this document. http://scn.sap.com/docs/DOC-17111
Hope this helps. please let me know for any further queries.
~ Krishna.