Password Provisioning

[Former Member]

Hi,

i activated "Enable password provisioning" in the identity store.

How to find out which password was created for a new identity?

Users can´t get it by e-mail. This is not defined yet.

My second problem contains to the "Password reset task"

When i try to reset an userpassword with the task create like described in "Implementation Guide - Self-service password reset" i get an error message "Could not set value for attribute MX_ENCRYPTED_PASSWORD".

I found this thread but it didn´t help me a lot.

Bg,

Philip

[Former Member · Accepted solution]

Did you set the path to your keys.ini in the Visual Admin?

[Former Member · Accepted solution]

Hi,

And we found this "path" to the keys.ini should include the file name keys.ini

Hope this is helpful?

Ian

[Former Member · Accepted solution]

I think it isn´t solved yet.

We use NW 7.2.

In NWA i just can type in a user defined value for com.sap.idm.jmx.crypt.keyfile --> "D:Keys.ini" (coppied the file to this location of course)

What iam doing wrong? Should we restart the AS Java?

[Former Member · Accepted solution]

Restarting the IDM App should be enough.

[Former Member · Accepted solution]

Problem solved i think.

Copied the "Keys.ini" from my local machine where the ic and the dispatcher is running to the server and corrected the path in NWA.

Thank you for replies!

[Former Member]

Hi,

Where you able to fix this problem? If so what was the problem on your end.

Thanks,

Joe.P

[Former Member]

Problem not solved yet

[Former Member]

Hi again,

now IC runs on my server directly, created a new keys.ini file and linked it in nwa to the path.

So no more errors coming up with MX_ENCRYPTED_PASSWORD.

My next problem now is, when i create a new user and get the mail with username and password, the password which is shown in the e-mail does not work --> "User authentication failed".

The same problem when i reset the password of an existing user.

Any idea whats wrong?

Br,

Philip

[former_member2987]

Philip,

When you write the password to MX_ENCRYPTED_PASSWORD are you encrypting the password via the uDESEncrypt function?

Matt

[Former Member]

Hi Matt,

on "Create Identity" task in the "Add Password" pass, MX_ENCRYPTED_PASSWORD got the value "$FUNCTION.sap_encryptPassword()$$" and MX_PASSWORD "$FUNCTION.sap_encryptPasswordMD5()$$"

In jscript sap_encryptPassword "pwd = UserFunc.uDESEncrypt("", password);

In jscript sap_encryptPasswordMD5 "pwd = UserFunc.uMD5(password)

So i think it is used

In the "Reset task" i can´t really find the definition. I implemented the task like described in "Implementation Guide

- Self-service password reset"

Br,

Philip

[former_member2987]

Philip,

I'm wondering if you are comparing like values in your workflow.

If you are comparing the password using:

UserFunc.uMD5(password)

You need to similarly hash the value you are comparing, otherwise you're comparing something like P@$$W0rD to $#!3r1r31WS which of, course, would not work.

The same thing needs to happen in you use:

UserFunc.uDESEncrypt("", password)

Either compare both in the encrypted state or unencrypted.

Matt

[Former Member]

Matt,

this was of course not the full coding:

// Main function: sap_encryptPassword
// use global variable which is set in initialization script
//	in sap_initializePassword()
var password;
var passwordDisabled;
function sap_encryptPassword(Par){
	var pwd;
	if (passwordDisabled == 1)
	{
		pwd = "";
	}
	else
	{
	  	pwd = UserFunc.uDESEncrypt("", password);
	  	//UserFunc.uErrMsg(1, "EncryptPassword: " + password + " 2: " + pwd );
	}
	return pwd;
}

// Main function: sap_encryptPasswordMD5
// use global variable which is set in initialization script
//	in sap_initializePassword()
var password;
var passwordDisabled;
function sap_encryptPasswordMD5(Par){
	var pwd;
	if (passwordDisabled == 1)
	{
		pwd = "";
	}
	else
	{
	  	pwd = UserFunc.uMD5(password)
	  	//UserFunc.uErrMsg(1, "MD5EncryptPassword: " + password + " 2: " + pwd );
	}
	return pwd;
}

[Former Member]

Hi Philip,

The standard solution is on Identity creation the user is emailed the password. If this is no good for you, you have a couple of options.

1) Set all the passwords the same by hardcoding a value in the custom_Initializepassword script - ok for testing

2) Get IdM to create a file of new users and their passwords so you can then distribute it - better for production

Hope this is helpful?

Cheers,

Ian