IBM Tivoli Directory Integrator Password Synchronizer Plug-in for Windows


Contents

IBM Tivoli Directory Integrator 6.0 Password Synchronizer Plug-in
Overview
Synchronizing from a single machine
Synchronizing from a Windows NT domain
Synchronizing from a Windows 2000 or Windows XP domain
Sample scenario
Plug-in operation
The IBM Tivoli Directory Integrator 6.0 Password Synchronizer package
Prerequisites
Included files
Setting the Password Synchronization Account Types
Verifying registry settings
Enabling Local Security Policy (Windows 2000 only)
Password Stores setup information

IBM Tivoli Directory Integrator 6.0 Password Synchronizer Plug-in

Overview

The IBM(R) Tivoli(R) Directory Integrator 6.0 Password Synchronizer plug-in intercepts Windows(R) NT/Windows 2000/Windows XP/Windows 2003 Server password change requests and propagates the changes to a repository (Password Store) after the Windows system changes the password.

The IBM Tivoli Directory Integrator 6.0 Password Synchronizer stores the password of the Windows user in a Password Store (LDAP server, WebSphere(R) MQ Everyplace(R)). The change is later propagated to other servers by an IBM Tivoli Directory Integrator 6.0 AssemblyLine.

This Password Synchronizer can be used on Windows NT(R), Windows 2000, Windows XP and Windows 2003 Server operating systems. It must be noted that this function creates a resident Java(TM) process with a footprint approximately 15 MB.

Synchronizing from a single machine

To synchronize passwords from a single machine, install the Password Synchronizer on the Windows stand-alone machine.

To install the IBM Tivoli Directory Integrator 6.0 Synchronizer Plug-in for Windows, run the idiplug-insWin32.exe binary from the plug-ins CD, and select IBM Tivoli Directory Integrator 6.0 Password Synchronizer Plug-in for Windows NT/2000 when asked to select plug-ins.

Synchronizing from a Windows NT domain

To synchronize password changes from a Windows NT domain, install the Password Synchronizer on the Primary Domain Controller (PDC) for the domain with which you want to synchronize. Install the Password Synchronizer on all backup domain controllers, in case the roles of the domain controllers change.

Synchronizing from a Windows 2000 or Windows XP domain

To synchronize password changes from a Windows 2000 or Windows XP domain, install the Password Synchronizer on all domain controllers for the domain with which you want to synchronize.

Sample scenario

Bob logs onto the windows machine, presses Ctrl+Alt+Delete, and requests a password change. That password change is intercepted by the Password Synchronizer, then delegated to the associated Password Store (LDAP Password Store, MQe Password Store).

Password change requests to Active Directory through LDAP/JNDI are also intercepted and handled by the Password Synchronizer.

Plug-in operation

Windows allows password filter plug-ins to register for notifications of user password changes. These plug-ins are invoked before the password change is committed by Windows. The purpose of these password filters is to validate the password. If any one of the registered password filters rejects the password change, Windows also rejects the password change.

The Windows Password Synchronizer plug-in registers as such a Windows password filter. The plug-in verifies that the Password Store is available. If the Password Store is not available the plug-in rejects the password change. If the Password Store is up and running the plug-in allows Windows to complete committing the password change. If, however, another password filter rejects the password change Windows rejects the password change and the plug-in will not synchronize the password change.

Windows has a notification mechanism which allows applications to get notified when a user password change has been committed by Windows. The Windows Password Synchronizer plug-in registers for this notification. This notification is not generated if Windows rejects a password change. Thus the plug-in notification for a committed password change is not invoked unless all password filters have approved the password and Windows has successfully committed the password change.

The IBM Tivoli Directory Integrator 6.0 Password Synchronizer package

Prerequisites

The IBM Tivoli Directory Integrator 6.0 Password Synchronizer requires JRE 1.4.2 (included).

Included files

idipwsync.jar
Contains the Password Synchronizer function that interfaces with the LDAP Password Store.
timpwflt.jar
Contains the implementation for password interception.
timpwflt.dll
Contains the implementation which interfaces with Windows password change function.

Setting the Password Synchronization Account Types

The installation program creates most of the required Windows registry entries. There is, however, one parameter which you need to set manually - it is called "AccountTypes". The Password Synchronizer plug-in is capable of reporting password changes to the following Windows account types:

The "AccountTypes" parameter value is stored in the Windows registry at HKEY_LOCAL_MACHINE\SOFTWARE\IBM\Tivoli Identity Manager\Windows Password Synchronizer\AccountTypes - the value of this parameter is a character string, indicating which account types the Password Synchronizer will report password changes for. Its format is a space-delimited list of account types.

An example value for this parameter would be: "NORMAL_ACCOUNT WORKSTATION_TRUST_ACCOUNT"

Note:
The Password Synchronizer always reports password changes to accounts of type NORMAL_ACCOUNT regardless of whether NORMAL_ACCOUNT is specified in the AccountTypes parameter.

To make setting the "AccountTypes" parameter in the Windows registry more convenient, the installation program copies to the plugin installation folder a default Windows registry .reg file - setWinPwSyncAccTypes.reg. This default .reg file contains the default value for the "AccountTypes" parameter, which is "NORMAL_ACCOUNT"; this means that if you don't edit the setWinPwSyncAccTypes.reg file and use it to update the Windows registry, the Password Synchronizer will only report password updates to normal user accounts. By double-clicking this .reg file in Windows Explorer you can set the "AccountTypes" parameter at the correct location in the Windows registry. You can edit setWinPwSyncAccTypes.reg file in a text editor to change the default setting of the "AccountTypes" parameter. After editing this file you need to double-click it in order to apply the changes to the Windows registry. If the Password Synchronizer has already been configured and is up and running you need to reboot the Windows machine after applying your changes to the Windows registry so that the changes can take effect.

Verifying registry settings

The control settings are located in the following directory:

HKEY_LOCAL_MACHINE\SOFTWARE\IBM\Tivoli Identity Manager\Windows Password Synchronizer

To verify the settings using regedt32, select view-->find key. Enter Windows Password Synchronizer. Click find next. You see something like the following for the Windows Password Synchronizer key:

AccountTypes: NORMAL_ACCOUNT

Class: REG_SZ: com.ibm.di.plug-in.idipwsync.IDIPasswordSynchronizer

Classpath: "c:\<install_directory>"

Java:REG_SZ: "c:\<install_directory>\_jvm\bin\java.exe"


Note:
The phrase install_directory would match the location where you installed the Plug-in.

Do the following to verify the enablement setting using regedt32:

  1. Locate and select the pane labeled HKEY_LOCAL_MACHINE.
  2. Select SYSTEM node.
  3. Select CurrentControlSet.
  4. Select Control.
  5. Select LSA.
  6. The Notification Packages key on the right pane contains the value timpwflt.

Enabling Local Security Policy (Windows 2000 only)

If you are using Windows 2000 do the following:

  1. Select Control Panel-->Administrative Tools-->Local Security Policy
  2. Select Account Policies-->Password Policy
  3. Change Passwords must meet complexity requirements to enabled.
Note:
For this change to take place, reboot the machine. Make sure that you set up the Password Store properties file before rebooting the machine.

Password Stores setup information

During installation you will be prompted to choose a Password Store. The installer will configure the Password Synchronizer to use the chosen Password Store, but will not configure the Password Store itself.

See the following for setting up the Password Stores: