Password Sync

The PasswordSync feature

• intercepts Windows 2000, Windows 2003, and Windows NT password changes

and resets

• relays them to the Identity Manager server for password synchronization.

When a native password change is initiated, and the change passes the native

password policy, the change request is forwarded to the Identity Manager server for

synchronization. If the proposed password change does not meet the native password

policy, the ADSI displays a dialog, and no synchronization data is sent to Identity

Manager.

PasswordSync is implemented as a PasswordChangeNotify DLL. The DLLs are

notified by the domain controller of native password change requests.

A general overview of how the PasswordSync mechanism works includes:

• After the user has successfully changed the password on the native Windows

box, the Intercept DLL communicates native password changes to the

PasswordSync RPC mechanism. The intercept DLL spawns a thread to write to

the RPC and does not block while the communication to the IDM server is

pending.

• The PasswordSync service reads password changes from the intercept RPC

mechanism and forwards them to the Identity Manager server.

• The PasswordSync service then communicates the request to the Identity

Manager server using a .NET SOAP client.

• Once the Identity Manager server receives a syncPassword request, it then

configures and runs the Change User Password workflow.

• When configuring the workflow, the syncPassword method configures

workflow settings so that all resources except for the “source” resource are

selected. Once configured, the Change User Password workflow is then

executed.

Note You can add a notification to the user by customizing the workflow to send

and email when PasswordSync is the executor of the workflow.

Identity & Access Management Solutions