Hello,

We are looking into some issues with the secPwdLastUsed attribute in our external Security Directory Suite that is the external registry we use for ISAM principals. We have enabled enable-last-logon in both the ivmgrd and web reverse proxy configuration files. 

Our business case is that the business would like to find dormant users and since we dont have this attribute working with the AAC its difficult to give them accurate information. 

The issue is that it is not updated when we are using a infomap authentication mechanism but works with the web reverse proxy pkmslogin authentication. Have any other of you in the forum had similar issues with this? 

Thanks in advance.

------------------------------
Best regards
Magnus
------------------------------

Hi Magnus,

A creative workaround could be to have the Infomap do a "pdadmin login". Here's how:
- Configure ivmgrd.conf with enable-last-login = yes
- Have your Infomap do a REST call to <your isam mgmt server>/isam/pdadmin with following example data for updating secPwdLastUsed for user jane:

------------------------------
Peter Volckaert
Sales Engineer
IBM Security
------------------------------

Original Message:
Sent: 03-04-2019 10:29 AM
From: Magnus Bengtsson
Subject: AAC - Infomap and secpwdlastused

Hello,

We are looking into some issues with the secPwdLastUsed attribute in our external Security Directory Suite that is the external registry we use for ISAM principals. We have enabled enable-last-logon in both the ivmgrd and web reverse proxy configuration files. 

Our business case is that the business would like to find dormant users and since we dont have this attribute working with the AAC its difficult to give them accurate information. 

The issue is that it is not updated when we are using a infomap authentication mechanism but works with the web reverse proxy pkmslogin authentication. Have any other of you in the forum had similar issues with this? 

Thanks in advance.

------------------------------
Best regards
Magnus
------------------------------

I'm a bit worried about the idea of invoking pdadmin for this.  It seems like that makes the Policy Server part of runtime flow which is not usually a good idea.  It may have performance and availability implications.

A quick search shows that there is a plugin for IBM Directory Server 6.4 which allows it to maintain its own "last login" attributes.  However, not sure if this is available with the IBM Directory Server bundled with ISAM (it mentions premium).  Anyway, here is the link:
https://www.ibm.com/support/knowledgecenter/en/SSVJJU_6.4.0/com.ibm.IBMDS.doc_6.4/ds_ag_last_successful_authentication_timestamp_plugin.html

It might be possible to achieve the same thing by POSTing username/password to WebSEAL /pkmslogin.form - I think this would also cause the timestamps to be updated.  There's a performance implication here too though - the WebSEAL would create a session in response to this which would use additional memory.  Maybe you could have a dummy WebSEAL instance just for this.

It seems like there should be an RFE here - it seems like an oversight that the built-in AAC username/password mechanism doesn't update this built-in field.

Jon.

------------------------------
Jon Harry
Consulting IT Security Specialist
IBM
------------------------------

Original Message:
Sent: 03-04-2019 10:29 AM
From: Magnus Bengtsson
Subject: AAC - Infomap and secpwdlastused

Hello,

We are looking into some issues with the secPwdLastUsed attribute in our external Security Directory Suite that is the external registry we use for ISAM principals. We have enabled enable-last-logon in both the ivmgrd and web reverse proxy configuration files. 

Our business case is that the business would like to find dormant users and since we dont have this attribute working with the AAC its difficult to give them accurate information. 

The issue is that it is not updated when we are using a infomap authentication mechanism but works with the web reverse proxy pkmslogin authentication. Have any other of you in the forum had similar issues with this? 

Thanks in advance.

------------------------------
Best regards
Magnus
------------------------------

Hello Jon,

We are currently running IBM Security Directory Suite 8.0.1.8 and the last successful authentication time stamp works great in my development machine. However, it took some trail and errors to get it working as I bumped into that the server just wanted to start up in configuration mode, apparently, this feature is not enabled either on the SDS suite limited edition license.

GLPSRV237E You do not have the entitlement to use '1.3.18.0.2.32.106' feature.

So I added a standard edition license to my local dev environment and it worked perfectly. Just wondering, this is a basic feature and its kind of odd why its not implemented in the limited edition as well.

I would like to argue since the ISAM AAC dont add timestamps to accounts by default and the SDS limited edition dont have this feature by default we are lacking some important integrity information for our accounts. I do find this logic a bit strange since we would like to use the AAC but if this attribute cannot be updated without some "workarounds" we will have to roll back to only using the pkmslogin. 

What are your thoughts on this? Do you think its likely that a RFE will fix this or will the SDS team want us to upgrade our license in order to use  this feature with the AAC? 

Best regards
Magnus
 

------------------------------
Magnus
------------------------------

Original Message:
Sent: 03-05-2019 05:16 AM
From: Jon Harry
Subject: AAC - Infomap and secpwdlastused

I'm a bit worried about the idea of invoking pdadmin for this.  It seems like that makes the Policy Server part of runtime flow which is not usually a good idea.  It may have performance and availability implications.

A quick search shows that there is a plugin for IBM Directory Server 6.4 which allows it to maintain its own "last login" attributes.  However, not sure if this is available with the IBM Directory Server bundled with ISAM (it mentions premium).  Anyway, here is the link:
https://www.ibm.com/support/knowledgecenter/en/SSVJJU_6.4.0/com.ibm.IBMDS.doc_6.4/ds_ag_last_successful_authentication_timestamp_plugin.html

It might be possible to achieve the same thing by POSTing username/password to WebSEAL /pkmslogin.form - I think this would also cause the timestamps to be updated.  There's a performance implication here too though - the WebSEAL would create a session in response to this which would use additional memory.  Maybe you could have a dummy WebSEAL instance just for this.

It seems like there should be an RFE here - it seems like an oversight that the built-in AAC username/password mechanism doesn't update this built-in field.

Jon.

------------------------------
Jon Harry
Consulting IT Security Specialist
IBM

Original Message:
Sent: 03-04-2019 10:29 AM
From: Magnus Bengtsson
Subject: AAC - Infomap and secpwdlastused

Hello,

We are looking into some issues with the secPwdLastUsed attribute in our external Security Directory Suite that is the external registry we use for ISAM principals. We have enabled enable-last-logon in both the ivmgrd and web reverse proxy configuration files. 

Our business case is that the business would like to find dormant users and since we dont have this attribute working with the AAC its difficult to give them accurate information. 

The issue is that it is not updated when we are using a infomap authentication mechanism but works with the web reverse proxy pkmslogin authentication. Have any other of you in the forum had similar issues with this? 

Thanks in advance.

------------------------------
Best regards
Magnus
------------------------------

Hello,

I have opened a Request for Enhancement (RFE) on this subject.
The RFE number is 130665.
I have suggested it should be made public - if that is accepted we can vote on it.

I made a side comment that perhaps last password use should be a basic function in Directory Server but that is a secondary discussion to getting the function in native Access Manager working.

Jon.

------------------------------
Jon Harry
Consulting IT Security Specialist
IBM
------------------------------

Original Message:
Sent: 03-05-2019 11:03 AM
From: Magnus Bengtsson
Subject: AAC - Infomap and secpwdlastused

Hello Jon,

We are currently running IBM Security Directory Suite 8.0.1.8 and the last successful authentication time stamp works great in my development machine. However, it took some trail and errors to get it working as I bumped into that the server just wanted to start up in configuration mode, apparently, this feature is not enabled either on the SDS suite limited edition license.

GLPSRV237E You do not have the entitlement to use '1.3.18.0.2.32.106' feature.

So I added a standard edition license to my local dev environment and it worked perfectly. Just wondering, this is a basic feature and its kind of odd why its not implemented in the limited edition as well.

I would like to argue since the ISAM AAC dont add timestamps to accounts by default and the SDS limited edition dont have this feature by default we are lacking some important integrity information for our accounts. I do find this logic a bit strange since we would like to use the AAC but if this attribute cannot be updated without some "workarounds" we will have to roll back to only using the pkmslogin. 

What are your thoughts on this? Do you think its likely that a RFE will fix this or will the SDS team want us to upgrade our license in order to use  this feature with the AAC? 

Best regards
Magnus
 

------------------------------
Magnus

Original Message:
Sent: 03-05-2019 05:16 AM
From: Jon Harry
Subject: AAC - Infomap and secpwdlastused

I'm a bit worried about the idea of invoking pdadmin for this.  It seems like that makes the Policy Server part of runtime flow which is not usually a good idea.  It may have performance and availability implications.

A quick search shows that there is a plugin for IBM Directory Server 6.4 which allows it to maintain its own "last login" attributes.  However, not sure if this is available with the IBM Directory Server bundled with ISAM (it mentions premium).  Anyway, here is the link:
https://www.ibm.com/support/knowledgecenter/en/SSVJJU_6.4.0/com.ibm.IBMDS.doc_6.4/ds_ag_last_successful_authentication_timestamp_plugin.html

It might be possible to achieve the same thing by POSTing username/password to WebSEAL /pkmslogin.form - I think this would also cause the timestamps to be updated.  There's a performance implication here too though - the WebSEAL would create a session in response to this which would use additional memory.  Maybe you could have a dummy WebSEAL instance just for this.

It seems like there should be an RFE here - it seems like an oversight that the built-in AAC username/password mechanism doesn't update this built-in field.

Jon.

------------------------------
Jon Harry
Consulting IT Security Specialist
IBM

Original Message:
Sent: 03-04-2019 10:29 AM
From: Magnus Bengtsson
Subject: AAC - Infomap and secpwdlastused

Hello,

We are looking into some issues with the secPwdLastUsed attribute in our external Security Directory Suite that is the external registry we use for ISAM principals. We have enabled enable-last-logon in both the ivmgrd and web reverse proxy configuration files. 

Our business case is that the business would like to find dormant users and since we dont have this attribute working with the AAC its difficult to give them accurate information. 

The issue is that it is not updated when we are using a infomap authentication mechanism but works with the web reverse proxy pkmslogin authentication. Have any other of you in the forum had similar issues with this? 

Thanks in advance.

------------------------------
Best regards
Magnus
------------------------------

Hello Jon,

Thanks, looking forward to see what happens with the RFE.

Best regards
Magnus

------------------------------
Magnus
------------------------------

Original Message:
Sent: 03-06-2019 06:23 AM
From: Jon Harry
Subject: AAC - Infomap and secpwdlastused

Hello,

I have opened a Request for Enhancement (RFE) on this subject.
The RFE number is 130665.
I have suggested it should be made public - if that is accepted we can vote on it.

I made a side comment that perhaps last password use should be a basic function in Directory Server but that is a secondary discussion to getting the function in native Access Manager working.

Jon.

------------------------------
Jon Harry
Consulting IT Security Specialist
IBM

Original Message:
Sent: 03-05-2019 11:03 AM
From: Magnus Bengtsson
Subject: AAC - Infomap and secpwdlastused

Hello Jon,

We are currently running IBM Security Directory Suite 8.0.1.8 and the last successful authentication time stamp works great in my development machine. However, it took some trail and errors to get it working as I bumped into that the server just wanted to start up in configuration mode, apparently, this feature is not enabled either on the SDS suite limited edition license.

GLPSRV237E You do not have the entitlement to use '1.3.18.0.2.32.106' feature.

So I added a standard edition license to my local dev environment and it worked perfectly. Just wondering, this is a basic feature and its kind of odd why its not implemented in the limited edition as well.

I would like to argue since the ISAM AAC dont add timestamps to accounts by default and the SDS limited edition dont have this feature by default we are lacking some important integrity information for our accounts. I do find this logic a bit strange since we would like to use the AAC but if this attribute cannot be updated without some "workarounds" we will have to roll back to only using the pkmslogin. 

What are your thoughts on this? Do you think its likely that a RFE will fix this or will the SDS team want us to upgrade our license in order to use  this feature with the AAC? 

Best regards
Magnus
 

------------------------------
Magnus

Original Message:
Sent: 03-05-2019 05:16 AM
From: Jon Harry
Subject: AAC - Infomap and secpwdlastused

I'm a bit worried about the idea of invoking pdadmin for this.  It seems like that makes the Policy Server part of runtime flow which is not usually a good idea.  It may have performance and availability implications.

A quick search shows that there is a plugin for IBM Directory Server 6.4 which allows it to maintain its own "last login" attributes.  However, not sure if this is available with the IBM Directory Server bundled with ISAM (it mentions premium).  Anyway, here is the link:
https://www.ibm.com/support/knowledgecenter/en/SSVJJU_6.4.0/com.ibm.IBMDS.doc_6.4/ds_ag_last_successful_authentication_timestamp_plugin.html

It might be possible to achieve the same thing by POSTing username/password to WebSEAL /pkmslogin.form - I think this would also cause the timestamps to be updated.  There's a performance implication here too though - the WebSEAL would create a session in response to this which would use additional memory.  Maybe you could have a dummy WebSEAL instance just for this.

It seems like there should be an RFE here - it seems like an oversight that the built-in AAC username/password mechanism doesn't update this built-in field.

Jon.

------------------------------
Jon Harry
Consulting IT Security Specialist
IBM

Original Message:
Sent: 03-04-2019 10:29 AM
From: Magnus Bengtsson
Subject: AAC - Infomap and secpwdlastused

Hello,

We are looking into some issues with the secPwdLastUsed attribute in our external Security Directory Suite that is the external registry we use for ISAM principals. We have enabled enable-last-logon in both the ivmgrd and web reverse proxy configuration files. 

Our business case is that the business would like to find dormant users and since we dont have this attribute working with the AAC its difficult to give them accurate information. 

The issue is that it is not updated when we are using a infomap authentication mechanism but works with the web reverse proxy pkmslogin authentication. Have any other of you in the forum had similar issues with this? 

Thanks in advance.

------------------------------
Best regards
Magnus
------------------------------

Hello Magnus
I have solved the "GLPSRV237E You do not have the entitlement to use" error removing the 
premium activation package
http://www-01.ibm.com/support/docview.wss?uid=swg1IO24425
If you check "CN=DIRECTORY,CN=RDBM BACKENDS,CN=IBM DIRECTORY,CN=SCHEMAS,CN=CONFIGURATION"
on the ibm-slapdPlugin multivalued field, removing the "postoperation liblsbt.a etc"" remove the premium entitlement
Roberto

------------------------------
Roberto Lio
------------------------------

Original Message:
Sent: 03-05-2019 11:03 AM
From: Magnus Bengtsson
Subject: AAC - Infomap and secpwdlastused

Hello Jon,

We are currently running IBM Security Directory Suite 8.0.1.8 and the last successful authentication time stamp works great in my development machine. However, it took some trail and errors to get it working as I bumped into that the server just wanted to start up in configuration mode, apparently, this feature is not enabled either on the SDS suite limited edition license.

GLPSRV237E You do not have the entitlement to use '1.3.18.0.2.32.106' feature.

So I added a standard edition license to my local dev environment and it worked perfectly. Just wondering, this is a basic feature and its kind of odd why its not implemented in the limited edition as well.

I would like to argue since the ISAM AAC dont add timestamps to accounts by default and the SDS limited edition dont have this feature by default we are lacking some important integrity information for our accounts. I do find this logic a bit strange since we would like to use the AAC but if this attribute cannot be updated without some "workarounds" we will have to roll back to only using the pkmslogin. 

What are your thoughts on this? Do you think its likely that a RFE will fix this or will the SDS team want us to upgrade our license in order to use  this feature with the AAC? 

Best regards
Magnus
 

------------------------------
Magnus

Original Message:
Sent: 03-05-2019 05:16 AM
From: Jon Harry
Subject: AAC - Infomap and secpwdlastused

I'm a bit worried about the idea of invoking pdadmin for this.  It seems like that makes the Policy Server part of runtime flow which is not usually a good idea.  It may have performance and availability implications.

A quick search shows that there is a plugin for IBM Directory Server 6.4 which allows it to maintain its own "last login" attributes.  However, not sure if this is available with the IBM Directory Server bundled with ISAM (it mentions premium).  Anyway, here is the link:
https://www.ibm.com/support/knowledgecenter/en/SSVJJU_6.4.0/com.ibm.IBMDS.doc_6.4/ds_ag_last_successful_authentication_timestamp_plugin.html

It might be possible to achieve the same thing by POSTing username/password to WebSEAL /pkmslogin.form - I think this would also cause the timestamps to be updated.  There's a performance implication here too though - the WebSEAL would create a session in response to this which would use additional memory.  Maybe you could have a dummy WebSEAL instance just for this.

It seems like there should be an RFE here - it seems like an oversight that the built-in AAC username/password mechanism doesn't update this built-in field.

Jon.

------------------------------
Jon Harry
Consulting IT Security Specialist
IBM

Original Message:
Sent: 03-04-2019 10:29 AM
From: Magnus Bengtsson
Subject: AAC - Infomap and secpwdlastused

Hello,

We are looking into some issues with the secPwdLastUsed attribute in our external Security Directory Suite that is the external registry we use for ISAM principals. We have enabled enable-last-logon in both the ivmgrd and web reverse proxy configuration files. 

Our business case is that the business would like to find dormant users and since we dont have this attribute working with the AAC its difficult to give them accurate information. 

The issue is that it is not updated when we are using a infomap authentication mechanism but works with the web reverse proxy pkmslogin authentication. Have any other of you in the forum had similar issues with this? 

Thanks in advance.

------------------------------
Best regards
Magnus
------------------------------

Hello Magnus


I had infomap  updating the secpwdlastused attribute , you need to init the UserLookupHelper adding a property ldap.enable-last-login = true in this way :



var prps = new java.util.Properties();
prps.put("ldap.enable-last-login","true");
var hlpr = new UserLookupHelper();
hlpr.init(false,prps);


this is possible since 9060 if remembering well..

------------------------------
Gianluca Gargaro
IBM
Roma
------------------------------

Original Message:
Sent: 03-04-2019 10:29 AM
From: Magnus Bengtsson
Subject: AAC - Infomap and secpwdlastused

Hello,

We are looking into some issues with the secPwdLastUsed attribute in our external Security Directory Suite that is the external registry we use for ISAM principals. We have enabled enable-last-logon in both the ivmgrd and web reverse proxy configuration files. 

Our business case is that the business would like to find dormant users and since we dont have this attribute working with the AAC its difficult to give them accurate information. 

The issue is that it is not updated when we are using a infomap authentication mechanism but works with the web reverse proxy pkmslogin authentication. Have any other of you in the forum had similar issues with this? 

Thanks in advance.

------------------------------
Best regards
Magnus
------------------------------

I was having the same issue and i have tried Gianluca Gargaro solution and it worked with me on ISAM 9.0.6.0

------------------------------
Hossam Shebl
------------------------------

Original Message:
Sent: Mon March 18, 2019 07:17 AM
From: Gianluca Gargaro
Subject: AAC - Infomap and secpwdlastused

Hello Magnus


I had infomap  updating the secpwdlastused attribute , you need to init the UserLookupHelper adding a property ldap.enable-last-login = true in this way :



var prps = new java.util.Properties();
prps.put("ldap.enable-last-login","true");
var hlpr = new UserLookupHelper();
hlpr.init(false,prps);


this is possible since 9060 if remembering well..

------------------------------
Gianluca Gargaro
IBM
Roma

Original Message:
Sent: 03-04-2019 10:29 AM
From: Magnus Bengtsson
Subject: AAC - Infomap and secpwdlastused

Hello,

We are looking into some issues with the secPwdLastUsed attribute in our external Security Directory Suite that is the external registry we use for ISAM principals. We have enabled enable-last-logon in both the ivmgrd and web reverse proxy configuration files. 

Our business case is that the business would like to find dormant users and since we dont have this attribute working with the AAC its difficult to give them accurate information. 

The issue is that it is not updated when we are using a infomap authentication mechanism but works with the web reverse proxy pkmslogin authentication. Have any other of you in the forum had similar issues with this? 

Thanks in advance.

------------------------------
Best regards
Magnus
------------------------------