Password Management in Novell Identity Manager

Novell Identity Manager integrates tightly with Novell eDirectory. Part of the benefits of eDirectory is the inherent security built around passwords. But there are times that Novell’s native tools for managing the passwords do not meet the specific needs of the deployment. In this article I will briefly explore the options you have for managing passwords within the framework of Novell’s Identity Manager.

Novell Identity Manager integrates tightly with Novell eDirectory. Part of the benefit of eDirectory is the inherent security built around passwords.  But there are times that Novell’s native tools for managing passwords do not meet the specific needs of the deployment. So let’s briefly explore the options you have for managing passwords within the framework of Novell’s Identity Manager.  For the purposes of this article password management is defined as the ability for a user to set a password, set challenge/response questions and use those challenge response questions to reset a forgotten password.

The first option, and probably the easiest to implement, is to use Novell’s Role Based Provisioning Module (RBPM) formerly known as the User Application.  This tool is easily deployed and fully supports all of the password management functionality.  It is can be branded and is fully supported by Novell.  The drawback to the RBPM is that it may be more than some organizations need when they are looking for just password management.  Additionally an organization may have an existing portal deployment that they want to integrate password management into. RBPM may not be the best fit for these organizations.

Another option is to utilize Novell’s Password Management Framework from their custom development group.  This is a fully functional password utility that is specifically tailored to an organization.  It is supported via Novell’s custom development group and fully supports all of the password management functionality.  The disadvantage of this solution is the additional costs associated with the purchase, development and support of the solution.  It can be integrated into an organizations existing portal solution and is fully supports branding specific to an organization.

If the functionality of Novell’s Password Management Framework (PMF) is what an organization is looking for but they do not wish to make the additional investment in product, support, etc… then a viable option is an open source project called PWM (available at https://code.google.com/p/pwm/).  This solution is very comparable to Novell’s PMF.  An organization may deploy it as is or customize it for their needs.  The advantage of this solution is the reduced product costs.  The disadvantage of this solution is that the organization is essentially self supporting themselves with this solution.  Just as the solutions above PWM fully supports all of the password management functionality.

In RBPM 3.7 there is also a forgotten password web service that is available (http://server:port/warcontext/pwdmgt/service?wsdl).  This is a good way to access basic password reset functionality.  This service does not support all of the password management functionality.  However it is a good option for organizations familiar with writing to web services and only need the basic forgotten password operations.

For organizations that desire the web service approach but need fuller functionality than what the basic web service interface provides there is in RBPM 3.7 REST services available.  The functionality for the REST services is contained in a war file (RIS.war) that sits separate from the User Application and provides access to much more than just the password management features.  The REST services are fully documented in Novell’s RBPM 3.7 online documentation.  This solution can be integrated into an organizations existing portal framework or can be used to build a fully functional site that exposes specific functionality that an organization needs.

There are other options for integrating with Novell’s Identity Management solution for password management that utilize Novell’s APIs.  But in the opinion of this consultant the above listed methods are the most cost effective options and provide the functionality that most organizations need.

As usual if you have questions, comments or concerns feel free to reach out to us at IDMWorks.