AccountPasswordManager

Sample workflow to set (expired) passwords of DirX Identity accounts. If run scheduled it searches for expired accounts in dependence of the configured search settings, generates and changes affected account passwords and triggers the target system specific setPassword workflow. If run event based it reacts on password change and password expired requests for a certain account and then proceeds as in the scheduled case.

A set-password workflow propagates a password from DirX Identity to the accounts of one connected system. It is triggered when a user or an administrator changes a password in the Identity Store, or when the password synchronization workflows distribute a password change. The workflow reads the password over the setPassword channel of the Identity Store port and writes it through the target system port; it does not synchronize any other account attribute.

Because a set-password workflow carries credentials, its ports decrypt the password attribute explicitly through the decrypt.attribute parameter, and failures are reported by a dedicated password notification connector instead of the regular notification connector.

AccountPasswordManager manages the lifecycle of account passwords in the Identity Store. When triggered by a scheduled scan, it searches for privileged accounts whose passwords are about to expire (within the number of days given by expirebefore) under the subtree configured in searchbase, generates new passwords for them and sets the passwords by triggering the target-system-specific set-password workflow. When triggered by a password-change or password-expired event for a specific account, it performs the same steps for that account only.

The tscluster and tsresource wildcard values (*) mean the workflow applies to all connected system types and resources.

The workflows in this reference are delivered as factory data and are loaded into the Connectivity configuration database during the initial configuration. They are samples: use the Identity Manager to copy a workflow into your own scenario and adapt the copy. Do not change the delivered objects, because a product update can replace them.

At a Glance

Name

AccountPasswordManager

Prerequisites

The Identity Store must be accessible through the Identity Store connected directory using the bind profile Domain_Admin.
The Java-based Server must have access to the target system subtree under the searchbase DN configured for the join activity.
A target-system-specific set-password workflow must be configured for each connected system whose account passwords this workflow is expected to propagate.

Workflow and Activities

Activity Type Component description Description Ports

Activity	Type	Component description	Description	Ports
`error`	`error`	`provisioningActivity`	Error Activity	`Message`
`join`	`ProvisionTS`	`pwdHandlingActivity`	Join activity for the account password management workflow	`IdentityDomain`

error

provisioningActivity

Error Activity

Message

join

ProvisionTS

pwdHandlingActivity

Join activity for the account password management workflow

IdentityDomain

Ports

Activity Port Component description Connector Connected directory Bind profile SSL

Activity	Port	Component description	Connector	Connected directory	Bind profile	SSL
`error`	`Message`	`errorPort`	`ErrorNotifyMailConnector`	-	-	not set
`join`	`IdentityDomain`	`provisioningPort`	`LdapConnector`	`Identity Store`	`Domain_Admin`	not set

error

Message

errorPort

ErrorNotifyMailConnector

not set

join

IdentityDomain

provisioningPort

LdapConnector

Identity Store

Domain_Admin

not set

Channels

Table 1. Channels of port `IdentityDomain` (activity `join`)
Channel	Description	Reference type	Delta type
`accounts`	Channel for accounts	OneToOne	SearchAttributes
`groups`	Channel for groups	OneToOne	SearchAttributes
`members`	Channel for members	OneToOne	SearchAttributes

Configuration Parameters

Table 2. Workflow parameters of `AccountPasswordManager`
Parameter	Default value
`dxminitialload`	FALSE
`timeout`	P0Y0M0DT1H0M0S
`tscluster`	*
`tsresource`	*

Table 3. Parameters of activity `error`
Parameter	Default value
`resourcefamily`	Mail
`retrylimit`	3
`timeout`	P0Y0M1DT0H0M0S
`waitbeforeretry`	P0Y0M0DT2H0M0S

Table 4. Parameters of port `Message` (activity `error`)
Parameter	Default value
`decrypt.attribute`	dxmPassword

Table 5. Parameters of activity `join`
Parameter	Default value
`expirebefore`	1
`filter`	(&(objectClass=dxrTargetSystemAccount)(dxrType=privileged)(!(cn=bindAccount)))
`keeppwdhistoryataccount`	false
`resourcefamily`	LDAP
`retrylimit`	3
`scope`	subtree
`searchbase`	cn=TargetSystems,cn=My-Company
`timeout`	P0Y0M0DT0H15M0S
`waitbeforeretry`	P0Y0M0DT0H30M0S

Table 6. Parameters of port `IdentityDomain` (activity `join`)
Parameter	Default value
`decrypt.attribute`	dxmPassword

A Java-based real-time workflow runs as a permanently loaded configuration in the Java-based Server (IdS-J). It is triggered by a request or an event rather than by a schedule. Each workflow consists of activities; an activity opens one port per system it talks to, and each port uses a connector to reach that system.

Most provisioning workflows contain a join activity that performs the actual work and an error activity that receives requests which still fail after all retries and sends a notification about them. The retrylimit, waitbeforeretry and timeout parameters of an activity control how often and how long a failed request is retried before it is handed to the error activity.

The event port publishes change events over JMS, and the notify port sends e-mail notifications. Neither port is bound to a connected directory.

The join activity carries out the password management work using the pwdHandlingActivity component. Its IdentityDomain port connects to the Identity Store over the accounts, groups and members channels using the LdapConnector with the Domain_Admin bind profile. The activity searches for accounts matching the filter expression under the searchbase subtree, selects those expiring within expirebefore days, and generates and applies new passwords. Retry behaviour is controlled by retrylimit (3) and waitbeforeretry (30 minutes); requests that still fail are handed to the error activity, which sends a notification through the Message port.

Operation

The workflow is triggered either on a schedule or by an incoming password-change or password-expired event for a specific account.
The join activity searches the target system subtree under searchbase for accounts that match the filter expression and whose passwords expire within expirebefore days.
For each account found, the activity generates a new password and sets it in the Identity Store through the IdentityDomain port; it then triggers the corresponding target-system-specific set-password workflow to propagate the new password to the connected system.
The result is written back into the Identity Store.
Requests that fail permanently after retrylimit retries are handed to the error activity, which reports them by e-mail through the Message port.

The workflow is delivered inactive (dxmActive is FALSE). Copy it into your own scenario, adjust searchbase, filter and expirebefore to match your environment, and activate the copy.