"No password" on resource in IDM 8

Dear all,
i am just creating a resource to pull userdata from an oracle table ( actually view but doesn't matter here ) but i do not want to manage a password, therefore i disabled the password feature. But i still getting an error when trying to save the resource saying
"No password column specified. If you do not want to manage passwords on this resource, please enable No Passwords. Otherwise, return to the Database Columns page and select a password column."
Can anyone tell me what i have to do to get a ressource working without a password
Regards
Soeren
Edited by: mso
Edited by: mso

Hi,
thanks very much, i thought disabling the feature on the last page is enough, anyways, it works now
soeren

Similar Messages

Full Reconciliation resets user password on resource?

I am new to IDM and thus have limited expertise, I would appreciate if you guys can help me out.
I would like to import all the users from LDAP resource through Full Reconciliation. Everything works well except that Full Reconciliation actually resets all the user password (I wonder why IDM does this). Does anyone know how can I remove this feature?

I have found out that it was not reconciliation that does the reset password, but Enable User workflow that I have defined in Per-account Workflow which resets the password.
Sorry for the misundersrtanding.

Getting error while re-setting password of user in IDM 7.1

Hi All,
We are getting below error in job log while resetting password of users through IDM UI in IDM 7.1.
Please note that user has been created in backend through IDM only and we are putting 7 character long password only.
Also, password reset task has been maintained in Password Policy Tab.
The attribute values maintained in Pass for password reset are:
logonuid %MSKEYVALUE%
password $FUNCTION.sap_getPassword(%MX_ENCRYPTED_PASSWORD%)$$
changetype modify
Also, scripts maintained are: sap_encryptPassword and sap_getPassword
Could you please help!!!
Job log:
putNextEntry failed storing90000004
Exception from Modify operation:com.sap.idm.ic.ToPassException: User 90000004 does not exist Password is not long enough (minimum length: 7 characters) Internal error: FM SUSR_USER_READ, exception: 1 Inconsistency with address
Thanks
Aditi

Hi Steffi,
Yes, we have tried with 7, 8, 9 and 10 character long passwords, but no one worked.
Yes, the user existed, however we tried with another user and this time the error is:
putNextEntry failed storing9PATHAKR
Exception from Modify operation:com.sap.idm.ic.ToPassException: Password is not long enough (minimum length: 7 characters).
Attached is screen shot of password policy tab.
Thanks
Aditi

Password Hook Configuration in IdM

Dear Experts,
Currently I'm working on an IDM password hook implementation. I'm very new to this and need you expert advice on how to implement this scenario.The customer already have a CUA in the landscape and they are would also continue using it. They want IDM only to synchronize the ABAP password with that of windows AD using the password hook functionality of IDM.
I've installed the IDM runtime engine.MC and the dispatcher on a seperate machine. Now I've to install the password hook on AD and then create provisioning jobs from IC to synchronize the password to the connected ABAP systems
I've some specific qustions on this -
1 - The inital load from the CUA works fine but do I also need to read the passwords from CUA.
2 - How will the AD know where the IDM is located. Do I need to install runtine components on AD also.
3 - The pssword hook configuration will be done on the AD.
4 - Once this is complete, how do I create a job that picks up this changed password and updates the Identity Store
Any help on this would be highly appreciated.
Regards,
Amlan
Edited by: Amlan Dutta on Jan 21, 2011 9:15 AM

Hi Amlan,
I've created a how to guide on my on, extending the existing guide, or make it more clearly. But my experiences are from the PasswordHook of IDM 7.0. In my opinion this tool hasn't changed deeply.
l hope, it will be helpful to you.
1. You have to Install the PasswordHook and the DSERT (Data Synchronisation Engine RunTime) on one of your DCs.
2. You have to check each configuration step within the regestry. For this please use the following regestry key (may be it differs from your setting):
My Computer\HKEY_LOCAL_MACHINE\System\controlset001\control\lsa\MxPwdHook
3. Within the argument line, please encapsulate the argument %1 with "" to make sure, that in case of <Space>-charakters within the loginname the right string used for the argument %2.
4. for every field, not containing any content, please ensure by using the registry, that this field is realy empty. During my tests I found out, that some fields are containing <Space>-charakters that can't deleted by the configuration programm.
If you have any further questions, don't hesitate.
Kind regards,
Achim

How to synchronize password of resource?

Hi Gurus,
I configured 10 Unix machine ( 5 Sloaris and 5 AIX) as managed resouces. All are connected via root/<password>.
I assigned 5 Solaris root accounts to one person, Tom, another 5 AIX root accounts to another person, Peter.
Both Tom and Peter can change and synchonize their root passwords at one time. But once the root password changed, the resources must be updated again.
Is there anyway to synchronized resource password automatically?
Cheers!
Good_mine

I don't think that is safe assign root accounts to identities.... anyway you can use the sudo facility, configuring IDM to manage the resource without the root account.
giovanni

Unable to reset password of user through IDM UI (IDM 7.1)

Hello,
We are unable to reset password of users in SAP Backend System through IDM UI.
The moment we enter new password and submit, we are getting below dump.
Any idea???
java.lang.NullPointerException
at com.sap.idm.wd.wf.task.TaskCompView.onActionSave(TaskCompView.java:172)
at com.sap.idm.wd.wf.task.wdp.InternalTaskCompView.wdInvokeEventHandler(InternalTaskCompView.java:223)
at com.sap.tc.webdynpro.progmodel.generation.DelegatingView.invokeEventHandler(DelegatingView.java:87)
at com.sap.tc.webdynpro.progmodel.controller.Action.fire(Action.java:67)
at com.sap.tc.webdynpro.clientserver.window.WindowPhaseModel.doHandleActionEvent(WindowPhaseModel.java:420)
at com.sap.tc.webdynpro.clientserver.window.WindowPhaseModel.processRequest(WindowPhaseModel.java:132)
at com.sap.tc.webdynpro.clientserver.window.WebDynproWindow.processRequest(WebDynproWindow.java:335)
at com.sap.tc.webdynpro.clientserver.cal.AbstractClient.executeTasks(AbstractClient.java:143)
at com.sap.tc.webdynpro.clientserver.session.ApplicationSession.doProcessing(ApplicationSession.java:333)
at com.sap.tc.webdynpro.clientserver.session.ClientSession.doApplicationProcessingStandalone(ClientSession.java:741)
at com.sap.tc.webdynpro.clientserver.session.ClientSession.doApplicationProcessing(ClientSession.java:694)
at com.sap.tc.webdynpro.clientserver.session.ClientSession.doProcessing(ClientSession.java:253)
at com.sap.tc.webdynpro.clientserver.session.RequestManager.doProcessing(RequestManager.java:149)
at com.sap.tc.webdynpro.serverimpl.defaultimpl.DispatcherServlet.doContent(DispatcherServlet.java:62)
at com.sap.tc.webdynpro.serverimpl.defaultimpl.DispatcherServlet.doPost(DispatcherServlet.java:53)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:760)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.runServlet(HttpHandlerImpl.java:401)
at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.handleRequest(HttpHandlerImpl.java:266)
at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:386)
at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:364)
at com.sap.engine.services.httpserver.server.RequestAnalizer.invokeWebContainer(RequestAnalizer.java:1039)
at com.sap.engine.services.httpserver.server.RequestAnalizer.handle(RequestAnalizer.java:265)
at com.sap.engine.services.httpserver.server.Client.handle(Client.java:95)
at com.sap.engine.services.httpserver.server.Processor.request(Processor.java:175)
at com.sap.engine.core.service630.context.cluster.session.ApplicationSessionMessageListener.process(ApplicationSessionMessageListener.java:33)
at com.sap.engine.core.cluster.impl6.session.MessageRunner.run(MessageRunner.java:41)
at com.sap.engine.core.thread.impl3.ActionObject.run(ActionObject.java:37)
at java.security.AccessController.doPrivileged(Native Method)
at com.sap.engine.core.thread.impl3.SingleThread.execute(SingleThread.java:104)
at com.sap.engine.core.thread.impl3.SingleThread.run(SingleThread.java:176)
Thanks
Aditi

Hello Aditi,
In AS Java 7.1 and higher you go to short link /nwa and navigate
to Configuration -> Infrastructure -> Java System Properties – Switch to
application tab in second section (Details about <InstanceName>) ->
search for tc~idm~jmx~app.
For 7.0 you have to do that in Visual Admin but I would need to read docu to know where it is too.
But you can find that all in UI installation guide http://service.sap.com/~sapidb/011000358700001233082010E
Regards
Norman

Oracle 10g as a resource in IDM 6.0

Hi,
I am a newbie and I am trying to configure Oracle10g as a resource in IDM6.0. I have installed Oracle10g on WinXP and have copied the classes2.zip file from Oracle folder and pasted it in the web-inf/lib folder(renamed to oraclejdbc.jar) and have also included the resource adapter. I would like to know the resource parameters in the createOracle Resource Wizard..
Please help..it it very urgent
Thanks in advance
Nash

the steps are as follows
Go to CONFIGURE>MANAGED RESOURCES-->ADD CUSTOM RESOURCE
type in
com.waveset.adapter.OracleResourceAdapter
save
Go to Resources >NEW RESOURCE
choose ORACLE
in the resource wizard
JDBC DATA SOURCE NAME/PATH (put in the jdbc data source name if u know it else LEAVE IT AS IT IS)
JDBC DRIVER (LEAVE IT AS IT IS)
CONNECTION URL (LEAVE IT AS IT IS)
HOST (name of the host where ur ORACLE DB resides or the IP address of that machine)
TCP PORT(LEAVE IT AS IT IS, in case of custom port put in that port no)
DATABASE[i] (name of the database on ur oracle machine)
USER (user name of a account that has administrative capabilities)
PASSWORD (password of the above user)
ENABLE CONNECTION POOLING (LEAVE IT AS IT IS)

Oracle 10g as Resource in IDM 5.5

Hi,
We started adding Oracel 10g Databases to our IDM-Resources.
When provisioning users into Oracle 10g Resource we get the following Exception:
com.waveset.util.WavesetException:
Error trying to update Oracle user 'G2814' ORA-30041:
Cannot grant quota on the tablespace
java.sql.SQLException: ORA-30041:
Cannot grant quota on the tablespace Since we already removed the oracleTempTSQuota-Attribute I assume that the adapter overwrites null values internally.
Any hints how to solve this problem?
Thanks in advance...
Oracle-Docs:ORA-30041: Cannot grant quota on the tablespace
Cause: User tried to grant quota on an undo or temporary tablespaceIDM_Technical_Reference_2005Q3M1 refernces Oracle 10g as supported resource

There is no need to give quota on temporary tablespace, because you will never create objects on a temporary tablespace
It is a wrong assumption to think that your temporary space usage will be limited by a quota.
The fact that you can "grant" quota on a temporary tablespace is rather a bug, which is fixed in 10gR2
Re: Cannot grant quota on tablespace
This bug is not fixed in IDM 6.0 SP1.

Load from Resource in IDM 5.0 SP5

I have installed IDM 5.0, SP 5, with Sun Java System Application Server 8. I have 2 resources, one LDAP (Sun Directory Server 5.2, SP 3) and one Active Directory.
I have just completed a 'Load from Resource', and loaded user information from the LDAP resource, which created 43 thousand or so user objects in IDM. I have 2 questions:
1. The load took a loooong time - 1 day, 4 hours. Is this normal? I am currently loading information for approximately 19 thousand accounts from the AD resource, which looks like it will take a similar amount of time per account (still running at the moment).
2. Now, when I select the 'Accounts' tab in the admin console when logged in as configurator, the list of accounts never appears. The browser session (mozilla) will die after about 2 minutes. The only way I can view user account information is to select the stop button in the browser immediately after selecting the 'Accounts' tab, and then select the 'Find Users' button on the left hand pane.

The load of the AD accounts (21,000) has now finished. This took 23 hours!!
I have analyzed, to some extent, the load process, from the LDAP perspective, and what appears to be happening is:
1. IDM queries LDAP for the number of account entries defined by the block count (1000 in my case) in the IDM resource definition. I suspect this is being done with an ldapsearch, perhaps with the -x and -S options, as the LDAP log details a query, then a sort on uid EVERY time the 1000 entries are retrieved. This, however, is only a minor part of the issue, as the sort takes about 5 minutes on the LDAP server. This would only account for about 200 minutes of my 1day, 4 hours.
2. After the block of 1000 is retrieved, IDM seems to go off into limbo for about 1 hour each time, with the appserverDAS process consuming about 30-40% CPU. I have an oracle database for the indexes, and that seems to be pretty relaxed during this time - there is some activity, but not in any real anger like the application server.
I can't analyze what's going on with the AD load, as I am not the custodian of the AD servers, and prefer to know as little as possible about them ;-)
I suppose this is not too much of a problem, as I will only performing the 'load from resource' once when we go into production, but I am concerned about the impact of a reconcilliation. I will start one immediately, and respond with itming when it finishes.
As for the list of users, how can I stop the account list from being the first thing accessed when I select the 'Accounts' tab? I would prefer not to have to import all accounts into a separate org just to facilitate access to the interface.
BTW - to be consistent with the documentation, shouldn't the references to 'Accounts' within the interface really read 'Users'. As I read the documentation, a 'User' is an IDM object which may (or may not) have resource 'Accounts'. If they are to be referred to as 'Accounts', then the two Users 'Configurator' and 'Administrator' should not appear there, as they do not, by default, have a resource equivalent. Or maybe I'm just a pedant :-)
Anyway, thanks for any help you can provide.

How to syncronize data between resource and IdM?

I created a form (assign to proxy administrator) for reconciliation, and it gets executed when I imported new user into IdM through full reconciliation. In this way I can assign email of user to waveset.email.
But later when the email gets updated in resource directly, how can I propagate the new value to IdM (without activeSync). By running a full reconciliation again doesn't seem to re-run the proxy administrator's form. I always thought full reconciliation would do the trick, but only now I realize it does not work at all !!?
What should I do then to synchronize the data?

Recon was not really designed to automatically synchronize attributes. Typically, this is implemented via ActiveSync. With that said, there is an option in Recon to "Attribute-Level Reconciliation". This allows you to provide a list of resource attributes to watch and if there is a change, Recon calls a workflow, where you can execute any changes you would like.
I believe this workflow is called "Audit Native Change To Account Attributes". Look at wfrecon.xml located in /sample.
Edited by: R1100SLA on Dec 21, 2007 12:12 AM

Configuring Shell Script Resource on IDM

Hi all,
I am in the process of configuring a Shell Script Resource on my IDM system.
I used the Shell-Script-Resource-Object.xml (which is provided by IDM in the Samples folder).
So far, everything worked fine. I set up the parameters, tested the "Test Configuration" button, and it was successful.
The next phase is to proceed with the basic tasks (such as : create user, update user, delete user, etc)
This is where my problem lies.
The IDM manuals do not say anything about how this should be done. Neither do any of Sun's reference material (perhaps, I'm looking in the wrong place??)
I know that the "Resource Actions" should contain the scripts themselves. But, there's no mention of how those scripts should be configured.
The scripts themselves reside on the UNIX machine, which is where they should be. But, how should I invoke them?
Any help will be much appreciated.
Thanks

OK.
I created an entirely new script, which allows me to CAPTURE the data (parameters) from IDM, and use them to create a new user.
It worked (or, it seemed to work).
In IDM, i got the following error :
*Error detected: [Adding account to hosts and creating quotas]&amp;amp;amp;#xD;&amp;amp;amp;#xA;Default shell for netpasswd is /usr/alt/uadm2/bin/nologin. This can be changed later.&amp;amp;amp;#xD;&amp;amp;amp;#xA;Default shell for sui-dev is /usr/alt/uadm2/bin/nologin. This can be changed later.&amp;amp;amp;#xD;&amp;amp;amp;#xA;Default home path for sui-dev is /home. This can be changed later.Default shell for ssl3 is /usr/alt/uadm2/bin/nologin. This can be changed later.&amp;amp;amp;#xD;&amp;amp;amp;#xA;Default shell for sui-test is /usr/alt/uadm2/bin/nologin. This can be changed later.&amp;amp;amp;#xD;&amp;amp;amp;#xA;Default home path for sui-test is /home. This can be changed later.[Adding user to groups]&amp;amp;amp;#xD;&amp;amp;amp;#xA;[Creating home directory]&amp;amp;amp;#xD;&amp;amp;amp;#xA;DUMMY - ssh -2 -l root sui-dev "/usr/alt/uadm2/libexec/mkhome sui-dev /users1/u1/mjerome 44444 500 550 mjerome"&amp;amp;amp;#xD;&amp;amp;amp;#xA;DUMMY - ssh -2 -l root sui-test "/usr/alt/uadm2/libexec/mkhome sui-test /users1/u1/mjerome 44444 500 550 mjerome"&amp;amp;amp;#xD;&amp;amp;amp;#xA;[all done].*
Result Code = 120.
Error
*com.waveset.util.WavesetException: An error occurred adding user 'mjerome' to resource 'Unix Administration'. com.waveset.util.WavesetException: Error detected: . com.waveset.util.WavesetException: Error detected: [Adding account to hosts and creating quotas]
Default shell for netpasswd is /usr/alt/uadm2/bin/nologin. This can be changed later.
Default shell for sui-dev is /usr/alt/uadm2/bin/nologin. This can be changed later.
Default home path for sui-dev is /home. This can be changed later.Default shell for ssl3 is /usr/alt/uadm2/bin/nologin. This can be changed later.
Default shell for sui-test is /usr/alt/uadm2/bin/nologin. This can be changed later.
Default home path for sui-test is /home. This can be changed later.[Adding user to groups]
[Creating home directory]
DUMMY - ssh -2 -l root sui-dev "/usr/alt/uadm2/libexec/mkhome sui-dev /users1/u1/mjerome 44444 500 550 mjerome"
DUMMY - ssh -2 -l root sui-test "/usr/alt/uadm2/libexec/mkhome sui-test /users1/u1/mjerome 44444 500 550 mjerome"
[all done]. com.waveset.util.WavesetException: Result Code = 120.*
From what is written there, I could see that the user was INDEED created. (Just to be sure, I checked my Unix machine. And, yes, the user was created)
However, I keep getting the above error in IDM.
I can't figure out any explanation besides the fact that, perhaps, this is because I do not have a RESULT HANDLER script in place yet.
Could this be it?

Disable the user in the resource thru IDM

Hi I am doing active sync.while doing activesync I am creating the user in another resources also.while activesync I want to disable the user in IDM and also in the resources based on one user attribute. I am using "waveset.disabled=true" to disable the user.
with this the user is getting disabled in lighthouse but not in resources like LDAP.How can I disable the user in resource also , which attribute need to be set to disable the user in resources also?. Any help will be great.

I added the following code to the bottom of active sync form to disable a user from all resources without luck. </br>
The side effect of the following code is to remove all resource names from waveset.resources list. What did I miss?
Thanks in advance for any clue.
<FieldLoop for='name' in='waveset.accounts[*].name'>
<Field name='accounts[$(name)].disable'>
<Expansion>
<s>true</s>
</Expansion>
</Field>
<Field name='update.accounts[$(name)].disable'>
<Expansion>
<s>true</s>
</Expansion>
</Field>
</FieldLoop>

Please help about encode password idm !!!!

Hello All,
I'm a newbie in IDM and in my work I have to encode password with CBC Algorithm before insert password in database (SQL server 2005).
So I have already coding CBC Algorithm but I don't know where I put my CBC encoding Algorithm for when users change password on IDM.
Please help me.
Thank you for advance.
waltt

I'm assuming you're not talking about storing the password that way in the IDM repository but rather a separate database resource.
I had a similar requirement with a different encryption algorithm and an Oracle database. I made my life a lot easier by having the database resource do the encryption. IDM will insert the password into the resource as plain text and, in my case, a trigger will catch it, call a stored procedure to change it from plain text to encrypted and then insert it. Since IDM never reads passwords from resources anyway the password was fully encrypted as stored in the resource and IDM never knows any better.
Technically speaking you could have created a rule or custom form to do the password encryption before IDM sends it over the wire but if you've got an encrypted channel to the database then you might take my approach and skip having IDM do it altogether.

ActiveSync - link resource account and password push

Is it possible to push a password from an IDM account to a resource account at the same time as linking the two accounts, during ActiveSync?
Scenario: I have an account in IDM and an account on a resource. I use ActiveSync to "discover" the account on the resource and link the IDM account with the resource account. At the same time I would like to push the IDM password to the resource. Thereby, synchronizing the IDM password with the resource password.
I have unsuccessfully tried to accomplish this in many ways:
1) Within the Admin GUI, I've edited an account and when I assign the resource to the account the password in IDM does not push to the resource.
2) Within ActiveSync, I have used global.password, password.password, password.confirmPassword, password.targets, password.accounts[resource].selected
NOTES:
- when the account exists on the resource and IDM links to the resource account, the password does not push
- when the account does not exist on the resource and IDM is required to create the resource account, the password is pushed
At this point my guess is that I will have to kick off a workflow to trigger the password push as the ActiveSync cannot handle linking and subsequently updating an attribute on that resource at the same time. Any ideas would be helpful. Thank you in advance.

I have been able to successfully push the password to the resource both during activesync and within the Admin console. However, I have found some inconsistencies with IDM that might need attention or an explanation.
First off, the key to pushing the password from IDM to the resource in the above scenario is....within the Resource Schema don't map IDM user attribute "password" but map an attribute such as "resource_password" to the password field on the resource. When I did this, I was able to provision the resource to the user in IDM and push the password to the existing resource account.
Secondly, there is an inconsistency with IDM and how it treats password and the other fields. I mapped lastname to a field on the resource. From the admin console, I edited the user and the only change I made was to provision the resource to the user (Resources tab). After saving this user, the lastname field from IDM was updated on the resource.
Why doesn't this work with password?

Password Reset Form for Multiple ABAP and Java Systems IDM 8.0

Hi Friends,
i have created Password reset form in IDM 8.0 , now i am able to reset password in systems but when i am resetting password IDM will reset password in ALL Connected server where his id is present.
now i need that user can able to select system where he want to reset password through password reset form.
Thanks,
Mohinder

Hi Tero,
I tried both query and it worked for me,
select right(mcattrname, len(mcattrname) - 7)
from idmv_vallink_basic
where mskey = %usermskey% and left(mcAttrName, 7) = 'account'
select rep_name from MC_REPOSITORY where rep_name in (select right(mcattrname, len(mcattrname) - 7) from idmv_vallink_basic with (nolock) where mskey = %usermskey% and left(mcAttrName, 7) = 'account')
May be Mohinder did not copy paste properly.
Password reset task with option to select repository seems to be coming from many ppl. Will you be able to create a blog with details on how to achieve this, as it is your idea in 1st place?
Kind regards,
Jai

"No password" on resource in IDM 8

Similar Messages

Maybe you are looking for