Microsoft Identity Integration Server 2003 graphic

Password management

Managing passwords for multiple user accounts is one of the complexities of managing an enterprise environment with multiple data sources. Microsoft Identity Integration Server 2003 provides two password management solutions:

By using password synchronization and user-based password change management, you can:

Password extensions

Management agents for directory servers support password change and set operations by default. For file-based, database, and extensible connectivity management agents, which do not support password change and set operations by default, you can create a .NET password extension dynamic-link library (DLL). The .NET password extension DLL is called whenever a password change or set call is invoked for any of these management agents. Password extension settings are configured for these management agents in Identity Manager. For more information about configuring password extensions, see Microsoft Identity Integration Server 2003 Developer Reference.

Password management is supported by default in the management agents for: By using a password extension, password management is also supported in the management agents for:
Active Directory
Active Directory Application Mode (ADAM)
IBM Directory Server
Lotus Notes
Novell eDirectory
Windows NT 4.0
Sun and Netscape directory servers
Attribute-value pair text files
Delimited text files
Directory Services Markup Language (DSML)
Extensible Connectivity
Fixed-width text files
IBM DB2 Universal Database
LDAP Data Interchange Format (LDIF)
Microsoft SQL Server
Oracle Database

Password synchronization

New for Microsoft Identity Integration Server 2003 Service Pack 1, password synchronization works with the password change notification service (PCNS) on an Active Directory domain, and allows password changes that originate from Active Directory to be automatically propagated to other connected data sources. Microsoft Identity Integration Server 2003 accomplishes this by running as a Remote Procedure Call (RPC) server that listens for a password change notification from an Active Directory domain controller. When the password change request is received and authenticated, it is processed by Microsoft Identity Integration Server 2003 and propagated to the appropriate management agents.

The PCNS runs on each Active Directory domain controller. The systems that receive the password notifications are known as targets. Your Microsoft Identity Integration Server 2003 must be configured as a PCNS target in Active Directory before password notifications are sent. The PCNS configuration must define an inclusion group and, optionally, an exclusion group. These groups are used to restrict the flow of sensitive passwords from the domain. For example, to send passwords for all users, but not send administrative passwords, you might choose to use Domain Users as the inclusion group, and Domain Admins as the exclusion group. For more information about configuring the password change notification service, see Using Password Synchronization.

The components involved in the password synchronization process are:

Preparing for password synchronization

Before you set up password synchronization for your Microsoft Identity Integration Server 2003 and Active Directory environment, verify the following: To set up password synchronization: For more information about setting up password synchronization, see Using Password Synchronization.

Password synchronization process

The process of synchronizing a password change request from an Active Directory domain controller to other connected data sources is shown in the following diagram: Password Synchronization
  1. The user initiates the password change request by pressing Ctrl+Alt+Del. The password change request, including the new password, is sent to the nearest domain controller.
  2. The domain controller records the password change request and notifies the password change notification filter (Pcnsflt.dll).
  3. The password change notification filter passes the request to the password change notification service (PCNS).
  4. The PCNS verifies the password change request, then authenticates the service principal name (SPN) by using Kerberos, and forwards the password change request in encrypted RPC to the Microsoft Identity Integration Server 2003 target server.
  5. Microsoft Identity Integration Server 2003 validates the source domain controller, then uses the domain name to locate the management agent that services that domain, and uses the user account information in the password change request to locate the corresponding object in the connector space.
  6. By using the join table information, Microsoft Identity Integration Server 2003 determines the management agents that receive the password change, and pushes the password change out to them.

Password synchronization security

The following password synchronization security concerns have been addressed:

Password synchronization error recovery scenarios

Ideally, whenever a user changes a password, the change is synchronized with no errors. The following scenarios describe how Microsoft Identity Integration Server 2003 recovers from common synchronization errors: Some failures are serious enough that no amount of retries is likely to result in a successful operation. In these cases, an error event is logged and the process is stopped. The following events are not retried:
Event Severity Description
6919 Information A password synchronization set operation was not performed because the timestamp was out of date.
6921 Error The password synchronization set operation was not processed because password management is not enabled on the target management agent.
6922 Error The password synchronization set operation was not processed because password management is not configured on the target management agent.
6923 Warning The password synchronization set operation was not processed because the target connector space object could not be found in the connected directory.
6927 Error The password synchronization set operation failed because the password does not satisfy the password policy of the target system.
6928 Error The password synchronization set operation failed because the password extension for the target management agent is not configured to support password set operations.

User-based password change management

Microsoft Identity Integration Server 2003 provides two web applications that use Windows Management Instrumentation (WMI) for resetting passwords. As with password synchronization, you activate password management when you configure the management agent in Management Agent Designer. For information about password management and WMI, see the Microsoft Identity Integration Server 2003 Developer Reference.

Microsoft Identity Integration Server 2003 creates two security groups during installation that specifically support password management operations:

For more information about Microsoft Identity Integration Server 2003 security groups, see Using security groups.