Struggling with existing passwords for new IDM installation

[Former Member]

I am having an issue understanding how to introduce an IDM 7.2 system into an existing ABAP only environment,  I have been through the base steps for configuring multiple ABAP repositories for all the different systems/clients in my landscape, but when I do the initial load from the systems to get all of this data into the IDM system, my users get resent back out to the target systems.  In most cases, this is a good thing, however, the password that is being distributed is the new password in the IDM system, so current users will not know their password when they try to login. I am trying to roll this out with minimal disruption to the current user community. 

What I'd like is that if they already have a password in that system, for that password to stay the same until their 90 day expiration comes due.  Once that expiration happens (in the production ECC system), I want to be able for them to change their password at login and have that password redistributed to all the child systems (BW production, test, etc.).  I am using the standard 7.2 provisioning environment and am only concerned with ABAP systems at this point (no active directory or java integration).  Is this achievable with the standard framework?  If so, are their any guidelines or documentation that someone can help me out with?

[former_member2987 · Accepted solution]

Eric,

This is certainly possible within the framework.  Just check to see what kind of password you are setting.  just remember that you will need to pass this to all connected systems via their repositories. 

Only issue I see is that you should not consider ECC to be the source of your Password Expiration. Let that come from IDM. Record the last password change date and then have a nightly task that checks  for 90 day expiration and run from there.  Preferably use the IDM Web UI for password management and then reset from there.

Matt

[Former Member · Accepted solution]

Thanks for the input.  A further question regarding the password expiration?  What type of job would I run nightly?  It would generate an email to the end users who are past their 90 days and require them to reset their password via the IDM Web UI which would distribute that password (as a productive password) to all target systems?

[former_member2987 · Accepted solution]

Eric,

When the user sets the password through IDM you would record the date in a custom attribute.

You would then have a task that executes nightly selecting all users whose passwords are at 90 days (you'll probably also want to run at 85, 80 and 75 days as well for warnings) The job would then send an email to notify users.

There's a guided task template for password reset.

Matt