ResetAccountPasswords

Sample workflow to reset passwords of DirX Identity accounts. If the workflow is configured for personal accounts it reads the password from the user and sets it at the account. If it is configured for privileged accounts it generates a new password and sets it at the account.

A set-password workflow propagates a password from DirX Identity to the accounts of one connected system. It is triggered when a user or an administrator changes a password in the Identity Store, or when the password synchronization workflows distribute a password change. The workflow reads the password over the setPassword channel of the Identity Store port and writes it through the target system port; it does not synchronize any other account attribute.

Because a set-password workflow carries credentials, its ports decrypt the password attribute explicitly through the decrypt.attribute parameter, and failures are reported by a dedicated password notification connector instead of the regular notification connector.

ResetAccountPasswords resets the passwords of DirX Identity accounts. For personal accounts, it reads the password from the user entry and sets it at the account. For privileged accounts, it generates a new password and sets it at the account. The searchbase parameter scopes the search to the Extranet Portal target system subtree, and the filter expression selects privileged accounts that are not bind accounts.

The workflows in this reference are delivered as factory data and are loaded into the Connectivity configuration database during the initial configuration. They are samples: use the Identity Manager to copy a workflow into your own scenario and adapt the copy. Do not change the delivered objects, because a product update can replace them.

At a Glance

Name

ResetAccountPasswords

Prerequisites

The Identity Store must be accessible through the Identity Store connected directory using the bind profile Domain_Admin.
The Java-based Server must be able to reach the Identity Store to read and write account entries under the subtree configured in searchbase.

Workflow and Activities

Activity Type Component description Description Ports

Activity	Type	Component description	Description	Ports
`error`	`error`	`provisioningActivity`	Error Activity	`Message`
`join`	`ProvisionTS`	`pwdHandlingActivity`	Join activity for the password reset workflow	`IdentityDomain`

error

provisioningActivity

Error Activity

Message

join

ProvisionTS

pwdHandlingActivity

Join activity for the password reset workflow

IdentityDomain

Ports

Activity Port Component description Connector Connected directory Bind profile SSL

Activity	Port	Component description	Connector	Connected directory	Bind profile	SSL
`error`	`Message`	`errorPort`	`ErrorNotifyMailConnector`	-	-	not set
`join`	`IdentityDomain`	`provisioningPort`	`LdapConnector`	`Identity Store`	`Domain_Admin`	not set

error

Message

errorPort

ErrorNotifyMailConnector

not set

join

IdentityDomain

provisioningPort

LdapConnector

Identity Store

Domain_Admin

not set

Channels

Table 1. Channels of port `IdentityDomain` (activity `join`)
Channel	Description	Reference type	Delta type
`accounts`	Channel for accounts	OneToOne	SearchAttributes
`groups`	Channel for groups	OneToOne	SearchAttributes
`members`	Channel for members	OneToOne	SearchAttributes

Configuration Parameters

Table 2. Workflow parameters of `ResetAccountPasswords`
Parameter	Default value
`dxminitialload`	FALSE
`timeout`	P0Y0M0DT1H0M0S
`tscluster`	*
`tsresource`	*

Table 3. Parameters of activity `error`
Parameter	Default value
`resourcefamily`	Mail
`retrylimit`	3
`timeout`	P0Y0M1DT0H0M0S
`waitbeforeretry`	P0Y0M0DT2H0M0S

Table 4. Parameters of port `Message` (activity `error`)
Parameter	Default value
`decrypt.attribute`	dxmPassword

Table 5. Parameters of activity `join`
Parameter	Default value
`filter`	(&(objectClass=dxrTargetSystemAccount)(dxrType=privileged)(!(cn=bindAccount)))
`resourcefamily`	LDAP
`retrylimit`	3
`scope`	subtree
`searchbase`	cn=Extranet Portal,cn=TargetSystems,cn=My-Company
`timeout`	P0Y0M0DT0H0M0S
`waitbeforeretry`	P0Y0M0DT0H30M0S

Table 6. Parameters of port `IdentityDomain` (activity `join`)
Parameter	Default value
`decrypt.attribute`	dxmPassword,userPassword

A Java-based real-time workflow runs as a permanently loaded configuration in the Java-based Server (IdS-J). It is triggered by a request or an event rather than by a schedule. Each workflow consists of activities; an activity opens one port per system it talks to, and each port uses a connector to reach that system.

Most provisioning workflows contain a join activity that performs the actual work and an error activity that receives requests which still fail after all retries and sends a notification about them. The retrylimit, waitbeforeretry and timeout parameters of an activity control how often and how long a failed request is retried before it is handed to the error activity.

The event port publishes change events over JMS, and the notify port sends e-mail notifications. Neither port is bound to a connected directory.

The join activity carries out the password reset using the pwdHandlingActivity component. Its IdentityDomain port connects to the Identity Store over the accounts, groups and members channels using the LdapConnector with the Domain_Admin bind profile. The activity searches for accounts under searchbase that match the filter, then either reads the password from the user entry (personal accounts) or generates a new one (privileged accounts), and sets it. The decrypt.attribute parameter dxmPassword,userPassword controls which password attributes are decrypted. Failed requests are retried up to three times (retrylimit) with 30-minute waits (waitbeforeretry) before being passed to the error activity for e-mail notification.

Operation

The workflow is triggered by a request to reset passwords, either for a single account or for the accounts that match the configured search criteria.
The join activity searches the target system subtree under searchbase in the Identity Store for accounts that match the filter expression.
For each account, the activity determines whether it is a personal or privileged account: personal accounts have their password read from the user entry; privileged accounts get a generated password.
The new password is written to the account entry in the Identity Store through the IdentityDomain port, which decrypts the password attributes dxmPassword and userPassword as needed.
Requests that fail permanently after retries are handed to the error activity, which reports them by e-mail through the Message port.

The workflow is delivered inactive (dxmActive is FALSE). Copy it into your own scenario and adjust searchbase and filter before activating the copy.