UserPasswordEventManager

Processes password change events; - finds associated user resp account - updates password in user entry - searches all accounts of this user - sends setPassword- requests to internal IDS-J queue

UserPasswordEventManager is the central password synchronization hub for DirX Identity. When a password-change event arrives on the JMS queue, the workflow locates the affected user or account in the Identity Store, updates the password in the user entry, then finds all accounts of that user and enqueues a setPassword request for each one onto the internal Java-based Server queue. The target-system-specific set-password workflows pick up these requests and propagate the password to each connected system.

The workflow parameters hasNoTSport (true) and isPwdManager (true) declare that this workflow acts as a password manager rather than a provisioning workflow in the conventional sense: it has no target system port of its own.

The workflows in this reference are delivered as factory data and are loaded into the Connectivity configuration database during the initial configuration. They are samples: use the Identity Manager to copy a workflow into your own scenario and adapt the copy. Do not change the delivered objects, because a product update can replace them.

At a Glance

Name

UserPasswordEventManager

Category

Password Synchronization

Technology

Java-based real-time workflow

LDAP object class

dxmIDMWorkflowDefinition

Workflow type

ProvisionTS

Connected system / controller type

*

Configuration wizard

LDAP-LDAP

Active in the factory data

FALSE

Factory data version

8.0

Factory data path

Workflows/Default/Password Synchronization/UserPasswordEventManager

Prerequisites

  • A JMS provider of type ATS must be available; the event port (appid event) reads password-change events from it.

  • The Identity Store must be accessible through the Identity Store connected directory using the bind profile Domain_Admin, so the LDAP port can locate and update user and account entries.

  • At least one target-system-specific set-password workflow must be configured and active for each connected system whose account passwords are to be synchronised.

Workflow and Activities

Activity Type Component description Description Ports

error

error

provisioningActivity

Error Activity

Message

join

ProvisionTS

provisioningActivity

Join activity for the userPasswordEventManager workflow

event, IdentityDomain, notify

Ports

Activity Port Component description Connector Connected directory Bind profile SSL

error

Message

errorPort

ErrorNotifyMailConnector

-

-

not set

join

event

notificationPort

JmsConnector

-

-

not set

join

LDAP

pwdProvisioningPort

LdapConnector

Identity Store

Domain_Admin

not set

join

notify

notificationPort

NotifyMailPwdConnector

-

-

not set

Channels

Table 1. Channels of port LDAP (activity join)
Channel Description Reference type Delta type

accounts

Channel for accounts

OneToOne

SearchAttributes

groups

Channel for groups

OneToOne

SearchAttributes

members

Channel for members

OneToOne

SearchAttributes

Configuration Parameters

Table 2. Workflow parameters of UserPasswordEventManager
Parameter Default value

hasNoTSport

true

isPwdManager

true

timeout

P0Y0M0DT0H20M0S

tscluster

*

tsresource

*
Table 3. Parameters of activity error
Parameter Default value

resourcefamily

Mail

retrylimit

3

timeout

P0Y0M1DT0H0M0S

waitbeforeretry

P0Y0M0DT2H0M0S
Table 4. Parameters of port Message (activity error)
Parameter Default value

decrypt.attribute

dxmPassword
Table 5. Parameters of activity join
Parameter Default value

resourcefamily

LDAP

retrylimit

3

timeout

P0Y0M0DT0H30M0S

waitbeforeretry

P0Y0M0DT0H30M0S
Table 6. Parameters of port event (activity join)
Parameter Default value

appid

event

jmsprovidertype

ATS

tgtisjmsclient

false
Table 7. Parameters of port LDAP (activity join)
Parameter Default value

decrypt.attribute

userPassword
Table 8. Parameters of port notify (activity join)
Parameter Default value

decrypt.attribute

userPassword

A Java-based real-time workflow runs as a permanently loaded configuration in the Java-based Server (IdS-J). It is triggered by a request or an event rather than by a schedule. Each workflow consists of activities; an activity opens one port per system it talks to, and each port uses a connector to reach that system.

Most provisioning workflows contain a join activity that performs the actual work and an error activity that receives requests which still fail after all retries and sends a notification about them. The retrylimit, waitbeforeretry and timeout parameters of an activity control how often and how long a failed request is retried before it is handed to the error activity.

The event port publishes change events over JMS, and the notify port sends e-mail notifications. Neither port is bound to a connected directory.

The join activity does the password distribution work. Its event port listens on the JMS queue (appid event, provider type ATS) for incoming password-change events. The LDAP port connects to the Identity Store using the LdapConnector with the Domain_Admin bind profile over the accounts, groups and members channels; through this port the activity reads the affected user and account entries and writes the updated password back. The notify port sends e-mail notifications via the NotifyMailPwdConnector.

Failed requests are retried up to three times (retrylimit) with 30-minute waits (waitbeforeretry) before being handed to the error activity, which reports them via the Message port.

Operation

  1. A password-change event arrives on the JMS queue and is received by the event port of the join activity.

  2. The join activity uses the LDAP port to locate the associated user or account entry in the Identity Store.

  3. The activity updates the password in the user entry in the Identity Store.

  4. The activity searches all accounts of that user in the Identity Store and places a setPassword request for each account on the internal Java-based Server queue.

  5. Each target-system-specific set-password workflow picks up its request from the queue and propagates the password to the respective connected system.

  6. The notify port sends the configured e-mail notification through the NotifyMailPwdConnector.

  7. Requests that fail permanently are handed to the error activity, which reports them by e-mail.

The workflow is delivered inactive (dxmActive is FALSE). Copy it into your own scenario, connect the event port to your JMS provider, and activate the copy.