The IBM(R) Tivoli(R) Directory Integrator 6.0 Password Synchronizer plug-in intercepts Windows(R) NT/Windows 2000/Windows XP/Windows 2003 Server password change requests and propagates the changes to a repository (Password Store) after the Windows system changes the password.
The IBM Tivoli Directory Integrator 6.0 Password Synchronizer stores the password of the Windows user in a Password Store (LDAP server, WebSphere(R) MQ Everyplace(R)). The change is later propagated to other servers by an IBM Tivoli Directory Integrator 6.0 AssemblyLine.
This Password Synchronizer can be used on Windows NT(R), Windows 2000, Windows XP and Windows 2003 Server operating systems. It must be noted that this function creates a resident Java(TM) process with a footprint approximately 15 MB.
To synchronize passwords from a single machine, install the Password Synchronizer on the Windows stand-alone machine.
To install the IBM Tivoli Directory Integrator 6.0 Synchronizer Plug-in for Windows, run the idiplug-insWin32.exe binary from the plug-ins CD, and select IBM Tivoli Directory Integrator 6.0 Password Synchronizer Plug-in for Windows NT/2000 when asked to select plug-ins.
To synchronize password changes from a Windows NT domain, install the Password Synchronizer on the Primary Domain Controller (PDC) for the domain with which you want to synchronize. Install the Password Synchronizer on all backup domain controllers, in case the roles of the domain controllers change.
To synchronize password changes from a Windows 2000 or Windows XP domain, install the Password Synchronizer on all domain controllers for the domain with which you want to synchronize.
Bob logs onto the windows machine, presses Ctrl+Alt+Delete, and requests a password change. That password change is intercepted by the Password Synchronizer, then delegated to the associated Password Store (LDAP Password Store, MQe Password Store).
Password change requests to Active Directory through LDAP/JNDI are also intercepted and handled by the Password Synchronizer.
Windows allows password filter plug-ins to register for notifications of user password changes. These plug-ins are invoked before the password change is committed by Windows. The purpose of these password filters is to validate the password. If any one of the registered password filters rejects the password change, Windows also rejects the password change.
The Windows Password Synchronizer plug-in registers as such a Windows password filter. The plug-in verifies that the Password Store is available. If the Password Store is not available the plug-in rejects the password change. If the Password Store is up and running the plug-in allows Windows to complete committing the password change. If, however, another password filter rejects the password change Windows rejects the password change and the plug-in will not synchronize the password change.
Windows has a notification mechanism which allows applications to get notified when a user password change has been committed by Windows. The Windows Password Synchronizer plug-in registers for this notification. This notification is not generated if Windows rejects a password change. Thus the plug-in notification for a committed password change is not invoked unless all password filters have approved the password and Windows has successfully committed the password change.
The IBM Tivoli Directory Integrator 6.0 Password Synchronizer requires JRE 1.4.2 (included).
The installation program creates most of the required Windows registry entries. There is, however, one parameter which you need to set manually - it is called "AccountTypes". The Password Synchronizer plug-in is capable of reporting password changes to the following Windows account types:
The "AccountTypes" parameter value is stored in the Windows registry at HKEY_LOCAL_MACHINE\SOFTWARE\IBM\Tivoli Identity Manager\Windows Password Synchronizer\AccountTypes - the value of this parameter is a character string, indicating which account types the Password Synchronizer will report password changes for. Its format is a space-delimited list of account types.
An example value for this parameter would be: "NORMAL_ACCOUNT WORKSTATION_TRUST_ACCOUNT"
To make setting the "AccountTypes" parameter in the Windows registry more convenient, the installation program copies to the plugin installation folder a default Windows registry .reg file - setWinPwSyncAccTypes.reg. This default .reg file contains the default value for the "AccountTypes" parameter, which is "NORMAL_ACCOUNT"; this means that if you don't edit the setWinPwSyncAccTypes.reg file and use it to update the Windows registry, the Password Synchronizer will only report password updates to normal user accounts. By double-clicking this .reg file in Windows Explorer you can set the "AccountTypes" parameter at the correct location in the Windows registry. You can edit setWinPwSyncAccTypes.reg file in a text editor to change the default setting of the "AccountTypes" parameter. After editing this file you need to double-click it in order to apply the changes to the Windows registry. If the Password Synchronizer has already been configured and is up and running you need to reboot the Windows machine after applying your changes to the Windows registry so that the changes can take effect.
The control settings are located in the following directory:
HKEY_LOCAL_MACHINE\SOFTWARE\IBM\Tivoli Identity Manager\Windows Password Synchronizer
To verify the settings using regedt32, select view-->find key. Enter Windows Password Synchronizer. Click find next. You see something like the following for the Windows Password Synchronizer key:
AccountTypes: NORMAL_ACCOUNT Class: REG_SZ: com.ibm.di.plug-in.idipwsync.IDIPasswordSynchronizer Classpath: "c:\<install_directory>" Java:REG_SZ: "c:\<install_directory>\_jvm\bin\java.exe"
Do the following to verify the enablement setting using regedt32:
If you are using Windows 2000 do the following:
During installation you will be prompted to choose a Password Store. The installer will configure the Password Synchronizer to use the chosen Password Store, but will not configure the Password Store itself.
See the following for setting up the Password Stores: