Maintain more than one password (on each system) administered by IdM

[Former Member]

Hi folks,

On our project we would like to know if is it possible to maintain more than one password on each system to be administered by IdM.

We know that the objective of SAP IdM application is to have single user id and password for respective users in all connected systems, but, would be possible to keep different passwords to each system AND reset password thru IdM on each system?

Regards!

Heverton

[Former Member · Accepted solution]

Hello,

I would do it like this:

• Create custom attributes similar to the MX_ENCRYPTED_PASSWORD, named like <Company Prefix>_PASSWORD_<Repositoryname>, e.g. ISV_PASSWORD_ABCCLNT123. The important thing is the RepName though
• Copy the plugin tasks for user creation and password provisioning (those should be enough though) to your custom provisioning folder and redirect the Hook task constants of all repositories to these tasks
• Adapt these tasks to match the custom attributes. Hint: The attribute value of "password" has to be changed to $FUNCTION.sap_core_getPassword(%ISV_PASSWORD_%$rep.$NAME%%)$$
• However, everything depends on your processes though and I can just give some examples: Create a UI Self Service Task where users can reset the password. Or create the passwords in the background and send mails (during the initial creation useful). Or...

I would not recommend using a multivalue attribute (even though I used a multivalue in my case). This sometimes causes unnecessary trouble...

Best regards

Dominik Trui

[Former Member · Accepted solution]

That should work fine - although I think you might need to modify the 'Modify User' task as well.

Definitely separate attributes - do not use MV attributes for this.

Peter