IBM Verify

IBM Verify

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Expand all | Collapse all

Disabled password sync in ISIM, getDecryptSyncPassword() method not working

  • 1.  Disabled password sync in ISIM, getDecryptSyncPassword() method not working

    Posted Sun March 07, 2021 12:49 PM

    I have disabled password synchronization setting in ISIM so that to get the option of changing password for selected accounts and all for an identity.

    After changing the settings, wherever getDecryptSynchPassword() method is used, for instance in SSO credential entitlement parameter of ISAM provisioning policy. gso credential password was not updating.

    Is there any other method needs to be used in this case?



    #Support
    #SupportMigration
    #Verify


  • 2.  RE: Disabled password sync in ISIM, getDecryptSyncPassword() method not working

    Posted Sun March 07, 2021 01:27 PM

    When you turn of password synchronization ISIM only maintains passwords on the account level. This mean that it is up to you to ensure password management if you need synchronization. This CAN (but I will not recommend it) be build using workflow operations if necessary.

    Let me give you some advice and input here that may be able to help you :

    1. It is never a good idea to have password logic in provisioning policies - I assume you use this for form based (GSO lockbox) passwords or is this something different ? Anyhow - password management belongs into the operational workflows.
    2. Password synchronization is a bad idea these days - it is basically ensuring your password security is at the lowest common denominator level - you should use a reverse proxy solution like IBM Security Verify (cloud) or Verify Access (on-prem) instead - it is much much secure and flexible - and for those things that are not web based (e.g. SAPGUI) there are mostly other solutions like Windows AD SSO integration.
    3. Historically (ITIM 4.6 and earlier) password synchronization was done differently in ISIM (still fully supported) - it basically was linked to an internal ISIM account and the password change operations was performed on those account the internal account had access to (limited by ACIs). This works fine except when you create new accounts as the passwords are not stored any where - only hashed. There are ways of working around this using workflows and storing the password in the person password attribute (I think this is not supported - IIRC the JavaScript methods to manage the password was removed from documentation) , but there are ways around that. Also it may be possible to store the account password on a service using reversible encryption - i.e. basically implementing what ISIM does for the person synch password.
    4. Are you aware that you can exclude accounts from password synchronization ? If not check here : https://www.ibm.com/support/pages/how-configure-isim-selective-password-synchronization

    I know this is not a direct answer to your question - but I hope this is something you can use. If you need help implementing something advanced my advice is to get help from IBM Security Expert Labs or one of our Business Partners - we have knowledge and experience doing this kind of things over many many years :-)

    Regards

    Franz Wolfhagen

    IBM Security Expert Labs



    #Support
    #SupportMigration
    #Verify