UserPasswordExpirationNotification

Password expiration notification workflow

UserPasswordExpirationNotification notifies users when their Identity Store password is about to expire. The workflow scans the Identity Store for accounts whose passwords will expire within the number of days configured in expirebefore (default 3), and sends an e-mail notification to the affected users. To avoid sending the same notification repeatedly, it limits the total number of notifications per expiring password to maxnumnotifications (default 3).

The workflow parameter hasNoTSport (true) indicates that the workflow operates only within the Identity Store and has no target system port.

The workflows in this reference are delivered as factory data and are loaded into the Connectivity configuration database during the initial configuration. They are samples: use the Identity Manager to copy a workflow into your own scenario and adapt the copy. Do not change the delivered objects, because a product update can replace them.

At a Glance

Name

UserPasswordExpirationNotification

Category

Password Synchronization

Technology

Java-based real-time workflow

LDAP object class

dxmIDMWorkflowDefinition

Workflow type

ProvisionTS

Connected system / controller type

*

Configuration wizard

LDAP-LDAP

Active in the factory data

FALSE

Factory data version

8.2

Factory data path

Workflows/Default/Password Synchronization/UserPasswordExpirationNotification

Prerequisites

  • The Identity Store must be accessible through the Identity Store connected directory using the bind profile Domain_Admin, so the LDAP port can query account entries for impending password expiry.

  • A mail server must be reachable by the notify port (using the NotifyMailConnector) to deliver the expiration notifications.

Workflow and Activities

Activity Type Component description Description Ports

error

error

provisioningActivity

Error Activity

Message

join

ProvisionTS

provisioningActivity

Join activity for the userPasswordExpirationNotification workflow

IdentityDomain, notify

Ports

Activity Port Component description Connector Connected directory Bind profile SSL

error

Message

errorPort

ErrorNotifyMailConnector

-

-

not set

join

LDAP

pwdProvisioningPort

LdapConnector

Identity Store

Domain_Admin

not set

join

notify

notificationPort

NotifyMailConnector

-

-

not set

Configuration Parameters

Table 1. Workflow parameters of UserPasswordExpirationNotification
Parameter Default value

hasNoTSport

true

timeout

P0Y0M0DT0H20M0S

tscluster

*

tsresource

*
Table 2. Parameters of activity error
Parameter Default value

resourcefamily

Mail

retrylimit

3

timeout

P0Y0M1DT0H0M0S

waitbeforeretry

P0Y0M0DT2H0M0S
Table 3. Parameters of port Message (activity error)
Parameter Default value

decrypt.attribute

dxmPassword
Table 4. Parameters of activity join
Parameter Default value

expirebefore

3

maxnumnotifications

3

resourcefamily

LDAP

retrylimit

3

timeout

P0Y0M0DT0H30M0S

waitbeforeretry

P0Y0M0DT0H30M0S
Table 5. Parameters of port LDAP (activity join)
Parameter Default value

decrypt.attribute

userPassword
Table 6. Parameters of port notify (activity join)
Parameter Default value

decrypt.attribute

userPassword

A Java-based real-time workflow runs as a permanently loaded configuration in the Java-based Server (IdS-J). It is triggered by a request or an event rather than by a schedule. Each workflow consists of activities; an activity opens one port per system it talks to, and each port uses a connector to reach that system.

Most provisioning workflows contain a join activity that performs the actual work and an error activity that receives requests which still fail after all retries and sends a notification about them. The retrylimit, waitbeforeretry and timeout parameters of an activity control how often and how long a failed request is retried before it is handed to the error activity.

The event port publishes change events over JMS, and the notify port sends e-mail notifications. Neither port is bound to a connected directory.

The join activity carries out the notification work. Its LDAP port connects to the Identity Store using the LdapConnector with the Domain_Admin bind profile; through this port the activity reads the account entries to identify which passwords expire within expirebefore days and have not yet reached the maxnumnotifications limit. The notify port then sends the expiration e-mail through the NotifyMailConnector, decrypting userPassword as needed.

Failed requests are retried up to three times (retrylimit) with 30-minute waits (waitbeforeretry) before being handed to the error activity, which reports them via the Message port.

Operation

  1. The workflow is triggered on a schedule.

  2. The join activity queries the Identity Store through the LDAP port to find accounts whose passwords expire within expirebefore days and for which fewer than maxnumnotifications notifications have already been sent.

  3. For each account found, the notify port sends an expiration notification e-mail to the user through the NotifyMailConnector.

  4. The notification counter for each account is incremented in the Identity Store to enforce the maxnumnotifications limit on subsequent runs.

  5. Requests that fail permanently after retries are handed to the error activity, which reports them by e-mail through the Message port.

The workflow is delivered inactive (dxmActive is FALSE). Copy it into your own scenario, adjust expirebefore and maxnumnotifications as required, and activate the copy.