OIM Password Policies

Hello All
I have a number of users setup in OIM and am using it for provisioning. I have the users in different organizations based on class of user and permissions to the portal. I have a need to have different password policies based on the organizations of the users. I looked through and it doesn't look like you can assign a password policy to an organization. Do you know of a way to assign users in org1 password policy A and others different policies? I looking at the xellerate users resource object and thought maybe I could do a rule to look for org1 but not sure if this is possible. Any help you can give would be appreciated.
Thanks
Nick

in terms of using an entity adapter, how would you go about doing that? Would it be based on user insertion or update? also, when trying to add a password policy, it asks for a rule then the policy, is there a way to develop a rule to use when assigning the password policy?
Nick

Similar Messages

Invoking password policies within a RequestValidator

Hello gurus. I am looking for an API, or whatever, to match a user-supplied password against a password policy created via Design Console.
My goal is to implement a password-consistency check at request level, so that a user is immediately notified if the supplied password does not meet the minimum security criteria for the target resource.
This is my reference scenario:
- a user creates a self-provision request for a target resource
- the users fills the Request Dataset form in and submits the request. One of the Dataset fields contains the password for the account which will be created.
- the supplied password is checked against resource's password policies
- if the check is successful, the request is created an filed in for approval
- otherwise, the user gets a "INVALID PASSWORD" pop-up error message and can make his/her correction immediately
OIM implements password policies at process form level, i.e. after the request is submitted and approved, which is too late. What I'd love to do is to leverage that existing code by invoking OIM's password policies at request level, within a RequestValidator plugin. Is that possibile? What class/method would I have to call to verify a password against an existing policy?
Thanks in advance,
Patri

Well, good news and bad news.
Good News
I was able to implement a RequestDataValidator that performed password validation at the object/account level using the tcPasswordUtilities.checkProcessPasswordUserID method.
Bad News
Our password policies all have history rules (i.e can't be one of last x passwords). In addition to validating the object/account password, the tcPasswordUtilities.checkProcessPasswordUserID also updates the password history table (PWH) with the validated password. Since we're doing this validation as part of the request process (RequestDataValidator), the new password will already be in the history table when the actual process form update is performed. Since the process form update will also validate the password, it will always fail because the password is already in the history table because of our request validator's check!
Back to the drawing board...

Cannot update Global Password Policies, no SSL bind, etc

Hello Community--
This is day 3 of the Apple Server Hostage Crisis, and it looks like I'll started clean slate build #5.
By way of background, I had a functioning ML/2.2.2 server that had RAID problems (and still does). Attempting to rebuild array failed and I lost the boot hard drives. I have access to dumpall.psql and all the user data (on an external drive). I attempted a couple of times to build a clean Mavericks/3.0 server but I couldn't figure out how to get the service data back. So I build a clean ML/2.2.2 system, got the wiki/calendar/contacts, etc data back in place to include establishment of an OD master using an archive. Turns out the archive was from one of my Mavericks/3.0 attempts, and while it seemed to create the OD okay, every time I tried to edit the global password policy, Server.app crashed. I decided to try to move up to Mavericks/3.0. Server.app no longer crashed but still cannot change global password policies. I get the following error:
servermgrd[]: servermgr_dirserv: +[PWPolicy setGlobalPolicyFromDict] error: policy data modification failed: Object class violation: attribute 'apple-user-passwordpolicy' not allowed ()
I deleted the OD master a couple of times and recreated it from a new archive. On the second iteration, my PositiveSSL cert was deleted....
Q1: Has anyone seen this password policy error and know how to solve it?
Additionally, although I have (had) the cert from PositiveSSL for my domain, the OD with Server 3 will not use it, instead reverting to a self-signed cert. All other services seem to work with the PositiveSSL cert. I've seen discussions in the community on this but have not found a solution.
Q2: Is this related to why I cannot create a secure binding?
I have not even gotten to the point of trying to set up Profile Manager to manage users and devices. I have not read anywhere that I *need* to have Profile Manger started to get a basic system running. From a Mavericks-based client where I've logged in with a local user, I can su <OD User> and log in, but the automount of the user's home directory fails due to an authentication issue.
Q3: In Mavericks, does a device have to be enrolled/configured in Profile Manager in order to bind and be usable?
Well, I'm off to start my next rebuild, but would still appreciate comments and suggestions as I suspect this hostage crisis is not over yet.
Thanks.
Tim

Rebuilt from scratch and reloaded databases for services and the OD archive. But something was still jacked and passwords wouldn't take. I was starting to suspect it was OD again, but then I decided to completely wipe the device_management database, which I did following these steps: http://support.apple.com/kb/ht5349.
That may have gotten me on track, which is good because I was getting ready to recreate each user account. I'll continue the effort tomorrow (day 4).
I have not decided if I will try again for Mavericks/Server 3. Sigh....
Tim

Implementing password policie using Role and CoS

Hy all,
I have created a directory with the following partial structure (Sun directory 5.2 patch 2):
ou=people,o=accounts,c=an
|----- cn=user1
|----- cn=user2
|----- cn=user3
ou=services,o=accounts,c=an
|---------cn=user4
|---------cn=user5
|---------cn=user6
I want to assign different password policies based on the ou.
I read within the admin guide that there is a way to do that through CoS and Role: http://docs.sun.com/source/817-7613/useracct.html#wp19625
So I create following records:
- Customized Password Policy Container:
dn: cn=Customized Password Policy, c=an
objectClass: top
objectClass: nsContainer
cn: Customized Password Policy
- External User Customized Password Policy: (same as the global one)
dn: cn=externalUserPwdPolicy, cn=Customized Password Policy, c=an
objectClass: top
objectClass: passwordPolicy
cn: externalUserPwdPolicy
passwordInHistory: 5
passwordWarning: 432000
passwordExpireWithoutWarning: on
passwordRootdnMayBypassModsChecks: on
passwordLockout: on
passwordMaxFailure: 3
passwordMaxAge: 5184000
passwordCheckSyntax: off
passwordResetFailureCount: 1200
passwordMinLength: 8
passwordStorageScheme: SHA
passwordChange: on
passwordMinAge: 86400
passwordMustChange: off
passwordUnlock: off
passwordLockoutDuration: 3600
passwordExp: on
- Service Account Customized Password Policy: (same as the global one except that there is no expiration for password and the password minimum age is set to 2 days instead of one)
dn: cn=serviceAccountPwdPolicy, cn=Customized Password Policy, c=an
objectClass: top
objectClass: passwordPolicy
cn: serviceAccountPwdPolicy
passwordInHistory: 5
passwordWarning: 432000
passwordExpireWithoutWarning: on
passwordRootdnMayBypassModsChecks: on
passwordLockout: on
passwordMaxFailure: 3
passwordMaxAge: 5184000
passwordCheckSyntax: off
passwordResetFailureCount: 1200
passwordMinLength: 8
passwordStorageScheme: SHA
passwordChange: on
passwordMinAge: 172800
passwordMustChange: off
passwordUnlock: off
passwordLockoutDuration: 3600
passwordExp: off
- External User Role:
dn: cn=externalUserRole,c=an
objectclass: top
objectclass: LDAPsubentry
objectclass: nsRoleDefinition
objectclass: nsComplexRoleDefinition
objectclass: nsFilteredRoleDefinition
cn: externalUserRole
nsRoleFilter: (&(entrydn=*o=accounts*)(entrydn=*ou=people*))
Description: Filtered role for external users
- Service Account Role
dn: cn=serviceAccountRole,c=an
objectclass: top
objectclass: LDAPsubentry
objectclass: nsRoleDefinition
objectclass: nsComplexRoleDefinition
objectclass: nsFilteredRoleDefinition
cn: externalUserRole
nsRoleFilter: (&(entrydn=*o=accounts*)(entrydn=*ou=services*))
Description: Filtered role for external services account
- Template Container for Customized Password Policy:
dn: cn=pwdPolTemplateContainer, c=an
objectClass: top
objectClass: nscontainer
- Class of Service (CoS) Definition for password policy:
dn: cn=PwdPol_CoSDefinition, c=an
objectClass: top
objectClass: LDAPsubentry
objectClass: cosSuperDefinition
objectClass: cosClassicDefinition
cn: PwdPol_CoSDefinition
cosAttribute: passwordPolicySubentry operational
cosTemplateDn: cn=pwdPolTemplateContainer, c=an
cosSpecifier: nsRole
- Class of Service (CoS) Template for ExternalUserRole:
dn: cn="cn=externalUserRole, c=an", cn=PwdPolTemplateContainer, c=an
objectClass: top
objectClass: extensibleObject
objectClass: costemplate
objectClass: LDAPsubentry
cosPriority: 2
passwordPolicySubentry: cn=externalUserPwdPolicy, cn=Customized Password Policy, c=an
- Class of Service (CoS) Template for ServiceAccountRole:
dn: cn="cn=serviceAccountRole, c=an", cn=PwdPolTemplateContainer, c=an
objectClass: top
objectClass: extensibleObject
objectClass: costemplate
objectClass: LDAPsubentry
cosPriority: 2
passwordPolicySubentry: cn=serviceAccountPwdPolicy, cn=Customized Password Policy, c=an
- The thing is that it does not to work: if I disable the global password policy, I can set a 3 caracters password even if I specified in the sub password policy that passwordminlengnt is equal to 8 caracters.
Many thanks in advance for your help.
Gregoire

Hmm,
Pretty cool.
I just finished doing it the hard-way when I saw your post :(.
I tried it anyways, and it did all the work that I had done by hand in the previous try. Which was ...
1) Creating the filtered role (same in both approaches).
2) Creating a Container for COS Templates.
3) Creating a COS Template with a dn having a cn string of the full dn to the role in 1) above. Had to use generic entry editor to add all the additional attributes as below ...
dn: cn="cn=TempFilter,ou=people,dc=example,dc=com",
�cn=PolTempl,dc=example,dc=com
objectclass: top
objectclass: extensibleObject
objectclass: LDAPsubentry
objectclass: costemplate
cosPriority: 1
passwordPolicySubentry: cn=TempPolicy,dc=example,dc=com
(started with a new costemplate and the added all the above attributes, also involved things like changing the naming attribute - the dn - from cosPriority to the one cn as shown above)
4) Creatiing a COS with ...
4.1) passwordpolicysubenty as a generated attribute that is overriding and operation (this is picked from the matched CoS template)
4.2) Use the template container's dn from 2) above for the TemplateDN value.
4.3) Use nsrole of the target enty to narrow down to the COS template as in 3) above. I.E. "template"->"attribute name" value is set to "nsRole"
(So when a user's nsrole maps to a cn value of an entry under the TemplateDN subtree. That template applies.)

Oim11g: Accessing oim password stored in CSF from pre-populate class

Can I access the oim password stored in CSF from the request template pre-populate class?
I am using hte following code from my class but its not working:
====================================
String oimUserName = "";
String oimPassword = "";
//get system administrator's credentials
oracle.security.jps.JpsContext ctx = oracle.security.jps.JpsContextFactory.getContextFactory().getContext();
final oracle.security.jps.service.credstore.CredentialStore cs = (oracle.security.jps.service.credstore.CredentialStore)ctx.getServiceInstance(oracle.security.jps.service.credstore.CredentialStore.class);
oracle.security.jps.service.credstore.CredentialMap cmap = cs.getCredentialMap("oracle.oim.sysadminMap");
oracle.security.jps.service.credstore.Credential cred = cmap.getCredential("sysadmin");
if (cred instanceof oracle.security.jps.service.credstore.PasswordCredential) {
oracle.security.jps.service.credstore.PasswordCredential pcred = (oracle.security.jps.service.credstore.PasswordCredential)cred;
char[] p = pcred.getPassword();
oimUserName = pcred.getName();
oimPassword = new String(p);
====================================

Try using the following code:
String oimUserName = "xelsysadm";
oracle.iam.passwordmgmt.internal.api.PasswordManager passwordManager = new oracle.iam.passwordmgmt.domain.PasswordManager();
String oimPassword = passwordManager.getUserPasswordFromDB(oimUserName, true);

Cloud User Password Policies

I am aware of the password policies listed in the documentation area.
This is fine for the management of changing passwords or recovering ones you've lost (challenge questions), but have a question on the ability to set Password Aging Policies. Is it possible to set a Password aging policy as a user of the cloud service? I want to force the Passwords to expire every 45 days.
Thanks

Hi Rick -
Thanks for your response.
In researching this further I concur with your assessment that within the cloud service - there is not currently a password aging policy that can be changed by the end user.
There is however an alternate way to arrive at the same result as password aging within the Cloud Service.
That is - deploy the Single Sign On Solution for Fusion Applications within the cloud - and that provides identity federation capabilities.
The OnPremise Identity Management solution can be configured to age the passwords and then when it's expiration date arrives - and the user updates the password within the on premise LDAP, the change will also be affected in the cloud service.
Viola! we have the ability to ensure that passwords are changed within 'x' period of time.
It is not a direct solution - but is one that ensures the intent of password aging is enforced.
Thanks again for your response.
Guy
Edited by: ServiceGuy on Nov 19, 2012 3:59 PM

Portal password Policies and MS Active directory Group Policies

Has anybody worked with EP6 and Active directory (as the writeable directory). More specifically I am trying to find experience or good documentation about working with the password policies for each. For example if you have the Portal password expiry at 90 days in portals, does the password expiry need be matched in AD.What if it is not, does this casue problems. If anyone as some expereice with this please reply.
Thanks
Stephen

Has anybody worked with EP6 and Active directory (as the writeable directory). More specifically I am trying to find experience or good documentation about working with the password policies for each. For example if you have the Portal password expiry at 90 days in portals, does the password expiry need be matched in AD.What if it is not, does this casue problems. If anyone as some expereice with this please reply.
Thanks
Stephen

BAPI to get password policies in ABAP environement

Hi all,
I am new to the SAP ABAP environement. (worked to some extent on JAVA stack).
I am working on the RFCSDK using C language.
I wanted to know how to see the password policies in ABAP environment.
I went through the link
http://help.sap.com/saphelp_nw04s/helpdata/en/22/41c43ac23cef2fe10000000a114084/content.htm
Now my question are as follows:
a)Which transaction should i use to see this values
b)Is there a BAPI provided to access this values. (using C language)
Best Regards
Manoj

this is not an abap question, but a basis question.
password settings are maintained with system profile parameters.
go to transaction RZ11 and search for passw parameters.
I found a FM by searching for profilepar*
in the code it uses
CALL 'C_SAPGPARAM'
     ID 'NAME' FIELD 'auth/object_disabling_active'
     ID 'VALUE' FIELD RET.
I think this one checks the parameters
regards, Rob,

Active directory Schema - Multiple password policies

Hi All,
I am new to AD and would need some suggestion to configure AD. I want to set up AD(2008 R2) for three categories of users: individual, dealers and organisations. Each dealer and each organisation will have further sub-categories based
on their location. I want to set up separate password policies for the above three categories using AD. I wanted to create them as separate OUs. So I would have multiple OUs for each dealer per location (e.g. individual, dealer1loc1, dealer1loc2,
dealer2loc3 and so on)
I know the concept of PSO(Password Settings Object) and that it can only be applied to OU using shadow groups and batch file (to copy users from OU to Shadow Groups). The issue is that the OUs would keep getting added as per requirement (would
be creating new OUs using C#) and then the management of PSO or shadow groups or batch file would be very complicated, not sure if it can be automated.
Also, I have budet constraints to add new servers for each domain and separate password policies.
What could be the possible solution to separate password policies and set up this user structure in Active Directory. I am using W2k8 R2.
Thanks.

Thanks Mahdi. In this case, the OUs would get created at run time, so the script needs to get updated at run time as well. I guess this will be not easy to automate.
Also, can you confirm if I can set up separate password policies by creating sub domain(e.g. example.com will be divided into sales.example.com and admin.example.com and this would further be divided as melourne.sales.example.com and sydney.sales.example.com)
and I can set separate password policies for sales.example.com and admin.example.com.
By adding child domains,it is like you are killing a mosquito with a rocket launcher, if you know what I mean. adding child domains increase the cost and administration and also adds complexity to your environment.
From technical perspective it is OK to have child domains, but if I were you I would not add that much complexity to my environment because of a script. I would spend enough time or get help form a skilled script writer to edit the script. Also I am saying
that editing your script to a fully automated script is not impossible, it just needs enough time and skills.
Mahdi Tehrani |
|
www.mahditehrani.ir
Please click on Propose As Answer or to mark this post as
and helpful for other people.
This posting is provided AS-IS with no warranties, and confers no rights.
How to query members of 'Local Administrators' group in all computers?

OIM password in target

Hi,
when admin changes it it is going in process form and database.When user login at change at next logon(first time) it is changing in process form and not in database? CAn u tell me what I need to do for that?
Thanks

Thanks,
yes, you need to create a custom password policy in OIM same policy as in enterprise directory.
You can have trigger on OIM Password (USR_PASSWORD) in trigger lookup. This will change the password of ED when the OIM password is getting changed.
Also, just check Resource Object of ED. It has password policy tab which can be used for password restrictions if someone is directly try to change password of ED(Its available in OIM R2 onwards)
Regards,
J

Help with Password Policies.

Hi,
I created two diffrent Password Policies, and applied it to xellerate user Resource Object.
Now when i creating a new user of xellerate User type, the password policy doesnt applies, whatever password i gave it takes.
But when i am changing the password, he policies are applied.
Y so??
Thanks
SjiT

Administration->Password Poicies
Policy name_ PolicyTrial_sjit
minimum Length=5
Custom Policy Selected.
Max Length=20
Min Numeric=2
Min UpperCase=2
Resource managemnt-> Rule designer
name = LastName_sjit
Operator= AND(By Default it was selected, please explain what is the diffrence between AND/OR in this)
Type =general
Description-last Name =jain pass rule
Rule Element:
Last name==jain
Resource Object:
xellerate User
(Here Order for organisation is pre-selected. What is the diff bw Order For User and Order fro oragnisation)
Added a Password policy Rule
Rule-LastName_sjit
Policy-PolicyTrial_sjit
ADmin and user COnsole GUide:
logged as xelsysadm
Create User::
PAssword =2
Oraganisation= xellerate User
last Name =jain
User Created :( :(
user Details page..
Clicked Change password.
Password- abc
Confirm- abc
Password Policy Error
Password must contain at least 1 numeric characters.
Password must contain at least 2 alphabetic characters.
Password must not be longer than 10 characters.
Password must be at least 5 characters long.
what wil be the possible cause of such and error.??
Edited by: sjit on Apr 1, 2010 12:17 AM

Enterprise User Security and Password Policies

Hi!
I'm testing Enterprise User Security. Till now everything has gone ok, I can connect to my db using oid users.
Now I'm configuring OID password policies for my realm but it seems that these are not applied when I connect through db. For example, I can try to logon with a wrong password as many time as I want, although in policies a limit of three is set.
Is this correct?!

If you're not using DB 10.2 this is the "expected" behavior for the DB. See also metalink note 351170.1 "Enterprise Users Can Connect to a Database when the OID Account is Disabled"
regards,
--Olaf

Password policies in ODSEE 11.1.1.7.2

Hi,
we're running ODSEE 11.1.1.7.1 on our masters and most of our replicas, all in DS5-compatible-mode.
I've a job running on the masters to export LDIF data to be able to setup easily new environments for test purposes.
Inside our DIT we've setup special password policies for all users, ignoring the default policies completely.
I now setup a new instance on another host and try to import complete DIT via dsconf import and got for every entry with passwordPolicySubentry-Attribute an error
[11/Mar/2015:11:40:56 +0100] - INFORMATION - Config - conn=-1 op=-1 msgId=-1 - (Password Policy: get policy object from entry) Entry "<dn of policy>" not found (51). Reverting to default policy entry "cn=password policy,cn=config".
I figured out, that our internal policies are not imported due to attributes from both objectclasses (sunPwdPolicy & pwdPolicy). I deleted manually the password*-Attributers and got them imported in the correct place in the DIT.
Afterwards I tried to do dsconf import -K with all user entries with the relevant passwordPolicySubentry-Attribute and I got the same errors as written above again.
I managed to import the data with ldapadd successful with the correct passwordPolicySubentry, but why not with the dsconf import???
Thanks for your hints to find the problem!
Regards,
Roland

Hello,
You mean the password policy entries are not returned by a search ?
Password policies stored in the data are stored as ldap sub entry. To get ldap sub entries, you must explicitely ask for it in the search filter, eg. (objectclass=LDAPsubentry)
-Sylvain
Please mark this response as correct or helpful when appropriate to make it easier for others to find it

How to implement extra password policies

What is the best way to configure additional password policies? We are using the
DefaultAuthenticator, and its only password policy is Minimum length. We'd like
to add policies that force a change every 6 months, require a mix of numbers and
alphas, prevent re-use of old passwords, etc.

"Ken" <[email protected]> wrote in message
news:3f900716$[email protected]..
>
What is the best way to configure additional password policies? We areusing the
DefaultAuthenticator, and its only password policy is Minimum length. We'dlike
to add policies that force a change every 6 months, require a mix ofnumbers and
alphas, prevent re-use of old passwords, etc.There are currently no additional password policies that can be configured
for the Default
authenticator. If you need more, then you may have to move to either another
LDAP
server and use the external ldap provider or move to a custom solution and
write your
own atn provider.

Self Service Requests for OIM Access Policies

In the absence of a Role Management product, is there a good way to enable OIM End User Self Service to process requests and approvals for OIM Access Policies or OIM Groups?
Any suggestions are appreciated!
KC

Ultimately the group membership will trigger an access policy. The access policy assignment is the goal, the group assignment is the typical method to assign the access policy to the user.
When creating a dummy resource, I assume that resource would have a lookup on the form to select the group name. Is this what you are suggesting?
KC

OIM Password Policies

Similar Messages

Maybe you are looking for