Transparent Password Synchronization Architecture
Transparent password synchronization, triggered by a native password change on a monitored system works as follows:
- User: decides to change his password(s) or has been prompted
to during the login process.
- User: enters his login ID, current password and desired value.
- Login server:
validates password
quality internally, then calls a Password Manager library to further validate
password quality.
- Password Manager library: contacts the
Password Manager server; establishes
an encrypted connection; forwards a request for password policy
validation.
- Password Manager server: validates password quality; returns result.
In the event of an attempted policy violation, Password Manager may send
a message directly to the user by e-mail or a
Windows pop-up message; may create an incident management system ticket and so on.
- Login server: updates the user's
password field internally, calls the Password Manager library to notify it
of the successful change. Note that a failure to meet the Password Manager
policy will normally block the initial password change from happening.
- Password Manager library: contacts the
Password Manager server; establishes
an encrypted connection; forwards a request for password synchronization.
- Password Manager server: queues up the new password for synchronization.
- Password Manager server: resolves the single queued event to a list of
passwords that must be set for this user (one per account).
- Password Manager server: administratively sets the user's passwords
on each system to the new value.
- Password Manager server: in the event of failure, re-queues and retries; may send the user one or more e-mails to notify of the problem; may create a ticket on an incident management system to alert someone of a problem.
Password synchronization triggers are provided with Password Manager for Windows server or Active Directory (32-bit, 64-bit), Sun LDAP, IBM LDAP, Oracle Internet Directory, Unix (various), z/OS and iSeries (AS/400).
This is implemented on the network with the following components:
Transparent synchronization architecture diagram (1)