Skip to main content

Transparent Password Synchronization - Hitachi ID Password Manager

(1)When users change their password natively on a system where a password synchronization trigger has been installed, the new password is tested for strength against the Hitachi ID Password Manager password policy and, if accepted, is changed both locally and on other systems where the user has accounts.

Password Manager includes password synchronization triggers for Windows server or Active Directory (32-bit, 64-bit), Sun LDAP, IBM LDAP, Oracle Internet Directory, Unix (various), z/OS and iSeries (AS/400).

Using a familiar and mandatory password change process guarantees 100% user adoption.

Process

Transparent password synchronization, triggered by a native password change on a monitored system works as follows:

  1. User: decides to change his password(s) or has been asked to during the login process.

  2. User: enters his login ID, current password and desired value.

  3. Login server: validates password quality internally, then calls a Password Manager library to further validate password quality.

  4. Password Manager library: contacts the Password Manager server; establishes an encrypted connection; forwards a request for password policy validation.

  5. Password Manager server: validates password quality; returns result. In the event of an attempted policy violation, Password Manager may send a message directly to the user by e-mail or a Windows pop-up message; may create an incident management system ticket and so on.

  6. Login server: updates the user's password field internally, calls the Password Manager library to notify it of the successful change. Note that a failure to meet the Password Manager policy will normally block the initial password change from happening.

  7. Password Manager library: contacts the Password Manager server; establishes an encrypted connection; forwards a request for password synchronization.

  8. Password Manager server: queues up the new password for synchronization.

  9. Password Manager server: resolves the single queued event to a list of passwords that must be set for this user (one per account).

  10. Password Manager server: administratively sets the user's passwords on each system to the new value.

  11. Password Manager server: in the event of failure, re-queues and retries; may send the user one or more e-mails to notify of the problem; may create a ticket on an incident management system to alert someone of a problem.

Password synchronization triggers are provided with Password Manager for Windows server or Active Directory (32-bit, 64-bit), Sun LDAP, IBM LDAP, Oracle Internet Directory, Unix (various), z/OS and iSeries (AS/400).

Technical Details

(2)

Transparent password synchronization can be triggered from native password changes on any of the following systems:

  • Windows 2000/2003/2008/2012 servers and Active Directory domains (password filter DLL on servers and/or DCs).
  • z/OS mainframes with RACF, ACF2 or TopSecret security products (security exit in the LPAR with the security products).
  • OS/400, iSeries servers.
  • Unix servers (passwd program wrapper binary or PAM).
  • Sun/Oracle and IBM LDAP servers (attribute change filter on the directory server).

Each of these triggers contacts the Password Manager server twice per password change, over an encrypted TCP/IP socket (shared key handshake, 128-bit AES encryption):

  • First connection: validate password quality, possibly reject the user's choice of a new password and block the triggering password change due to policy violation
  • Second connection: initiate transparent password synchronization

Watch a Movie

Transparent password synchronization


Play movie

Content:

  • Illustrate the flow of a new password from a change initiated on Windows via Ctrl-Alt-Del, through an AD DC, to HiPM and finally to another application.

Key concepts:

  • Reducing the number of passwords users must remember.
  • Password synchronization without exposing a user to a new UI.
  • Intercepting password changes on AD DCs.
  • Propagating new passwords to multiple systems and applications.

Transparent password synchronization: realistic scenario with load balancing and feedback loops


Play movie

Content:

  • Illustrate the flow of a new password during password synchronization.
  • Highlight interactions with load balancers, multiple HiPM systems and multiple trigger systems.
  • Show how HiPM prevents feedback loops.

Key concepts:

  • Reducing the number of passwords users must remember.
  • Ensuring that password synchronization does not introduce feedback loops on the network.
  • Illustrate the advanced architecture to properly scale up a password synchronization system.

page top page top