Chat now with support
Chat with Support

Password Manager 5.14 - Administration Guide

About Password Manager Getting started Password Manager architecture
Password Manager components and third-party applications Typical deployment scenarios Password Manager in a perimeter network Management Policy overview Password policy overview Secure Password Extension overview reCAPTCHA overview User enrollment process overview Questions and Answers policy overview Password change and reset process overview Data replication Phone-based authentication service overview
Management policies
Checklist: Configuring Password Manager Understanding Management Policies Adding or cloning a new Management Policy Configuring access to the Administration Site Configuring access to the Password Manager Self-Service Site Configuring access to the Helpdesk Site Configuring Questions and Answers policy Workflow overview Custom workflows Custom activities Password Manager Self-Service Site workflows Helpdesk workflows Notification activities User enforcement rules
General Settings
General Settings overview Search and logon options Importing and exporting configuration settings Outgoing mail servers Diagnostic logging Scheduled tasks Web Interface customization Instance reinitialization Realm Instances Domain Connections Extensibility features RADIUS Two-Factor Authentication Internal Feedback Customizing help link URL Password Manager components and third-party applications Unregistering users from Password Manager Bulk Force Password Reset Fido2 key management Working with Redistributable Secret Management account Email templates
Upgrading Password Manager Administrative Templates Secure Password Extension Password Policies Enable 2FA for administrators and helpdesk users Reporting Password Manager integration Accounts used in Password Manager Open communication ports for Password Manager Customization options overview Third-party contributions Glossary

Data replication

This section provides information on how Password Manager stores and replicates data.

Storing data

There are two types of data stored by Password Manager: Password Manager configuration data, and users’ Questions and Answers profiles. Password Manager configuration data contains all settings you configure in Password Manager. Users’ Questions and Answers profiles are stored apart from the configuration data.

Q&A profiles are stored in the attribute of a user account in Active Directory that you specify during instance initialization. By default, it is the comment attribute. You can also change it after initializing a Password Manager instance. For more information, see Instance reinitialization.

Password Manager configuration data is stored in the C:\ProgramData\One Identity\Password Manager folder. This folder contains two files (Shared.storage and Local.storage) and the LocalizationStorage folder.

  • Shared.storage: This file contains configuration data that is shared among all instances of a realm: management policies, general settings, domain connections, custom activities and workflows, instance settings, and so on.

  • Local.storage: This file contains the instance-specific settings, such as the instance name and statistics about scheduled tasks.

  • LocalizationStorage: This folder contains the user interface texts localized in several languages.

Replicating data

If you install a realm (several Password Manager instances sharing the same configuration), changes in the configuration of one instance are automatically propagated to other instances. To propagate the data, Password Manager replicates the data from the shared.storage file and the LocalizationStorage folder to Active Directory.

Before being written to Active Directory, the data is split into several segments and archived.

To distribute the configuration data from one instance to another, Password Manager uses a scheduled task and the PMReplication container in a managed domain to which the data is copied. The PMReplication container is a container that is automatically created in the Users container of the managed domain. To this container, containers for each Password Manager realm are added.

Names of these containers correspond to the realm affinity id. Each realm container has the containers for every instance belonging to this realm. Names of instance containers correspond to the instance id.

In the instance container, several user accounts are created. The number of user accounts is one more than the number of data segments. For example, if there are 20 data segments, then the instance container has 21 user accounts. Note that the created user accounts are disabled.

The same attribute that you specify for storing users’ Q&A profiles is used to store the configuration data segments. The first user account stores the data replica id, all other accounts store the data segments.

Replication mechanism analyses all data segments from all instances, selects data with the latest changes, and propagates it.

 Caution: It is not recommended to edit Password Manager settings simultaneously on multiple instances belonging to one realm. Simultaneous modification of settings on multiple Password Manager instances may cause data loss.

Note that the domain management account must have the permission to create user accounts and containers in the Users container for configuration data to be replicated. For more information on configuring the domain management account, see Configuring permissions for domain management account.

Changing replication settings

By default, the data to be replicated is divided into segments by segment size (100 KB). Data can also be divided into segments according to a specified segment number.

You can also change the name of the storage container (by default, PMReplication) and the location for storing this container (by default, the Users container of a managed domain), and the names of user accounts used to store data segments.

You can change replication settings by modifying the QPM.Service.Host.exe.config file located in the <password-manager-installation-folder>\Service folder.

 Caution: Editing the configuration file may cause serious problems. It is recommended to back up the file before modifying it. Edit the QPM.Service.Host.exe.config file at your own risk.

Changing replication settings

  1. On the computer where Password Manager is installed, open the QPM.Service.Host.exe.config file located in the <password-manager-installation-folder>\Service folder with a text editor.

  2. In the replication node, specify the following:

    • To divide the configuration data into segments by a segment size, set the packetLimitMode to LimitSize (packetLimitMode="LimitSize").

    • To divide the configuration data into segments by a number of segments, set the packetLimitMode to LimitCount (packetLimitMode="LimitCount").

    • If you set the packetLimitMode to LimitSize, specify the maximum segment size in bytes in the maxPacketSize parameter. For example, maxPacketSize="100000". Set the maxPacketsCount parameter to zero (maxPacketsCount="0").

    • If you set the packetLimitMode to LimitCount, specify the maximum number of segments to be created in the maxPacketsCount parameter. For example, maxPacketCount="10". This value must be greater than 1. Set the maxPacketsSize parameter to zero (maxPacketsSize="0").

  3. In the storageManager node, specify the following:

    • To change the name of the storage container, in the storageContainerReplicationPath element, specify the required name. The default value is CN=PMReplication.

    • To change the container for storing replication data, in the storageContainerPath element specify the required container. The default value is CN=Users.

    • To change the names of user accounts used to store data segments, in the storageContainerPartName element specify the required name. The default value is strg.

  4. Save the QPM.Service.Host.exe.config file.

  5. Restart the Password Manager Service in the Services console. Type services.msc at a command prompt, select Password Manager Service in the console, and click Restart.

  6. Repeat steps 1-4 on each instance belonging to a Password Manager realm.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating