ResetPasswordIfDisplayed

Sample workflow to reset passwords of DirX Identity (functional) accounts after an account’s password has been read. The password will be reset after the configured minimum number of hours have passed.

A set-password workflow propagates a password from DirX Identity to the accounts of one connected system. It is triggered when a user or an administrator changes a password in the Identity Store, or when the password synchronization workflows distribute a password change. The workflow reads the password over the setPassword channel of the Identity Store port and writes it through the target system port; it does not synchronize any other account attribute.

Because a set-password workflow carries credentials, its ports decrypt the password attribute explicitly through the decrypt.attribute parameter, and failures are reported by a dedicated password notification connector instead of the regular notification connector.

ResetPasswordIfDisplayed resets the passwords of functional accounts after their password has been read or displayed to an operator. The reset is deferred by the minimum age configured in minimumage (default 0 hours), which gives the operator time to use the password before it is changed. The workflow searches for matching accounts under searchbase using the filter expression and generates a new password for each one it finds.

The workflows in this reference are delivered as factory data and are loaded into the Connectivity configuration database during the initial configuration. They are samples: use the Identity Manager to copy a workflow into your own scenario and adapt the copy. Do not change the delivered objects, because a product update can replace them.

At a Glance

Name

ResetPasswordIfDisplayed

Prerequisites

The Identity Store must be accessible through the Identity Store connected directory using the bind profile Domain_Admin.
The Java-based Server must be able to reach the Identity Store to read and write account entries under the subtree configured in searchbase.

Workflow and Activities

Activity Type Component description Description Ports

Activity	Type	Component description	Description	Ports
`error`	`error`	`provisioningActivity`	Error Activity	`Message`
`join`	`ProvisionTS`	`pwdHandlingActivity`	Join activity for the password reset workflow	`IdentityDomain`

error

provisioningActivity

Error Activity

Message

join

ProvisionTS

pwdHandlingActivity

Join activity for the password reset workflow

IdentityDomain

Ports

Activity Port Component description Connector Connected directory Bind profile SSL

Activity	Port	Component description	Connector	Connected directory	Bind profile	SSL
`error`	`Message`	`errorPort`	`ErrorNotifyMailConnector`	-	-	not set
`join`	`IdentityDomain`	`provisioningPort`	`LdapConnector`	`Identity Store`	`Domain_Admin`	not set

error

Message

errorPort

ErrorNotifyMailConnector

not set

join

IdentityDomain

provisioningPort

LdapConnector

Identity Store

Domain_Admin

not set

Channels

Table 1. Channels of port `IdentityDomain` (activity `join`)
Channel	Description	Reference type	Delta type
`accounts`	Channel for accounts	OneToOne	SearchAttributes
`groups`	Channel for groups	OneToOne	SearchAttributes
`members`	Channel for members	OneToOne	SearchAttributes

Configuration Parameters

Table 2. Workflow parameters of `ResetPasswordIfDisplayed`
Parameter	Default value
`dxminitialload`	FALSE
`timeout`	P0Y0M0DT1H0M0S
`tscluster`	*
`tsresource`	*

Table 3. Parameters of activity `error`
Parameter	Default value
`resourcefamily`	Mail
`retrylimit`	3
`timeout`	P0Y0M1DT0H0M0S
`waitbeforeretry`	P0Y0M0DT2H0M0S

Table 4. Parameters of port `Message` (activity `error`)
Parameter	Default value
`decrypt.attribute`	dxmPassword

Table 5. Parameters of activity `join`
Parameter	Default value
`filter`	(&(objectClass=dxrTargetSystemAccount)(dxrType=privileged)(!(cn=bindAccount)))
`minimumage`	0
`resourcefamily`	LDAP
`retrylimit`	3
`scope`	subtree
`searchbase`	cn=TargetSystems,cn=My-Company
`timeout`	P0Y0M0DT0H0M0S
`waitbeforeretry`	P0Y0M0DT0H30M0S

Table 6. Parameters of port `IdentityDomain` (activity `join`)
Parameter	Default value
`decrypt.attribute`	dxmPassword,userPassword

A Java-based real-time workflow runs as a permanently loaded configuration in the Java-based Server (IdS-J). It is triggered by a request or an event rather than by a schedule. Each workflow consists of activities; an activity opens one port per system it talks to, and each port uses a connector to reach that system.

Most provisioning workflows contain a join activity that performs the actual work and an error activity that receives requests which still fail after all retries and sends a notification about them. The retrylimit, waitbeforeretry and timeout parameters of an activity control how often and how long a failed request is retried before it is handed to the error activity.

The event port publishes change events over JMS, and the notify port sends e-mail notifications. Neither port is bound to a connected directory.

The join activity performs the reset using the pwdHandlingActivity component. Its IdentityDomain port connects to the Identity Store over the accounts, groups and members channels using the LdapConnector with the Domain_Admin bind profile. The activity searches for accounts under searchbase that match the filter expression and whose passwords have been read or displayed; it waits for at least minimumage hours to have passed since the display, then generates a new password and sets it. The decrypt.attribute parameter dxmPassword,userPassword controls which password attributes are decrypted. Failed requests are retried up to three times before being handed to the error activity for e-mail notification.

Operation

The workflow is triggered after a functional account password is read or displayed, either immediately or after a configured delay.
The join activity searches the target system subtree under searchbase in the Identity Store for accounts that match the filter expression and for which the minimum display age (minimumage) has elapsed.
For each account found, the activity generates a new password and writes it to the account entry in the Identity Store through the IdentityDomain port.
Requests that fail permanently after retries are handed to the error activity, which reports them by e-mail through the Message port.

The workflow is delivered inactive (dxmActive is FALSE). Copy it into your own scenario and adjust searchbase, filter and minimumage before activating the copy.