Chatta subito con l'assistenza
Chat con il supporto

Password Manager 5.14 - Administration Guide

About Password Manager Getting started Password Manager architecture
Password Manager components and third-party applications Typical deployment scenarios Password Manager in a perimeter network Management Policy overview Password policy overview Secure Password Extension overview reCAPTCHA overview User enrollment process overview Questions and Answers policy overview Password change and reset process overview Data replication Phone-based authentication service overview
Management policies
Checklist: Configuring Password Manager Understanding Management Policies Adding or cloning a new Management Policy Configuring access to the Administration Site Configuring access to the Password Manager Self-Service Site Configuring access to the Helpdesk Site Configuring Questions and Answers policy Workflow overview Custom workflows Custom activities Password Manager Self-Service Site workflows Helpdesk workflows Notification activities User enforcement rules
General Settings
General Settings overview Search and logon options Importing and exporting configuration settings Outgoing mail servers Diagnostic logging Scheduled tasks Web Interface customization Instance reinitialization Realm Instances Domain Connections Extensibility features RADIUS Two-Factor Authentication Internal Feedback Customizing help link URL Password Manager components and third-party applications Unregistering users from Password Manager Bulk Force Password Reset Fido2 key management Working with Redistributable Secret Management account Email templates
Upgrading Password Manager Administrative Templates Secure Password Extension Password Policies Enable 2FA for administrators and helpdesk users Reporting Password Manager integration Accounts used in Password Manager Open communication ports for Password Manager Customization options overview Third-party contributions Glossary

Modifying advanced settings

Using the advanced settings you can specify the following:

  • Encryption algorithm: Use this setting to select the encryption algorithm that is used to encrypt users’ answers to secret questions and other security sensitive information. You can select from two options: Triple DES and AES. By default, Password Manager uses Triple DES algorithm to encrypt data. Note, that users’ answers will be encrypted if the “Store answers using reversible encryption” option is selected in the Q&A Profile settings. Otherwise, the answers will be hashed.

  • Encryption key length: Use this setting to select whether a 192-bit or 256-bit encryption key will be used.

  • Attribute for storing Q&A profiles: Use this setting to enter the attribute name that will be used for storing Q&A profile data. By default, Password Manager stores Q&A profile data in the comment attribute of each user's account and the configuration data in the comment attribute of a configuration storage account, which is automatically created when installing Password Manager.

    Caution: If you change encryption settings and the attribute for storing Q&A profiles, the current instance will be excluded from a realm it belongs to and users may lose their Q&A profiles.

    When you change these settings, do the following to keep users’ Q&A profiles:

    • Export the current configuration when saving updated instance settings.

    • Update Q&A profiles using the Migration wizard (upload the exported configuration to the wizard) on the current instance.

    • To replicate new settings and updated Q&A profiles export the updated configuration from the current instance and import the configuration to other instances.

    If you do not use the Migration wizard to update users’ Q&A profile after changing the settings, users will have to re-register with Password Manager.

  • Hashing algorithm: Use this setting to select the hashing algorithm that will be used to hash users’ answers to secret questions. The following algorithms are available: MD5 and SHA-256. By default, Password Manager uses SHA-256 hashing algorithm. Password Manager will hash users’ answers if the Store answers using reversible encryption option is not selected in the Q&A Profile settings.

    IMPORTANT: If you change the hashing algorithm, the selected algorithm will be applied to newly created Q&A profiles only. Existing Q&A profiles will be hashed with the previously selected algorithm.

To modify the advanced settings

  1. On the home page of the Administration Site, click General Settings > Reinitialization, and expand the Advanced settings section.

  2. From the Encryption algorithm drop-down list, select the encryption algorithm for encrypting users’ answers to secret questions and other security sensitive data.

  3. From the Encryption key length drop-down list, select whether a 192-bit or 256-bit encryption key will be used to encrypt data.

  4. From the Hashing algorithm drop-down list, select the algorithm that will be used to hash users’ authentication answers.

  5. In the Select the attribute of user’s account in Active Directory in which user’s Questions and Answers profile and Corporate phone will be stored section, provide the following data.

    • Security questions: Enter the required security question.

    • Corporate Phone: Enter the mobile number of the user.

    • Corporate email: Enter the corporate's email id of the user.

  6. Click Save.

    After clicking Save, the Reinitialize Instance dialog appears.

  7. In the Reinitialize Instance dialog, a password is generated for the configuration file that you should export to update users’ Q&A profiles and click Export.

  8. Click Save.

Use one of the following methods to clear old hives from AD user objects.

To update users’ Q&A profiles with new instance settings and clear old Q&A data for user objects in Active Directory

  1. Run the Migration wizard from the Password Manager CD autorun window.

  2. On the Welcome page, select the Update users’ Q&A profiles with new instance settings and clear old Q&A data for user objects in Active Directory task.

  3. On the next page, upload the configuration file you exported. Click Browse to select the file, enter the password generated while exporting the configuration file, and click Next.

  4. On the Select users page, do one of the following and click Next:

    1. If you want to convert the Q&A profiles of users from the user scope of a Management Policy, select the required policy in the Select Management Policy drop-down box and click Next.

    2. If you want to convert the Q&A profiles of a user in a user group, select The following groups. To select groups, click Add and do the following:

      1. In the Add Groups dialog, enter the group name, select the domain from the list and click Search.

      2. Select the required groups in the list and click Save.

    3. If you want to convert the Q&A profiles of a user in an OU, select The following OUs. To select OUs, click Add and do the following:

      1. In the Add OUs dialog, enter the OU name, select the domain from the list and click Search.

      2. Select the required OUs in the list and click Save.

  5. On the next page, do one of the following and click Next:

    1. Click Update Q&A profiles in test mode to update profiles in test mode. Use this mode to preview the result of updating profiles.

    2. Click Update Q&A profiles in test mode to update profiles in production mode.

    NOTE: For production mode, select Clear old Q&A data for user objects in Active Directory checkbox to clear old user Q&A data.

  6. On the status page, click View the report for detailed information to view a detailed account of updating profiles. If you updated Q&A profiles in test mode, click Update Q&A profiles in production mode.

Once you have updated the Q&A profiles with new instance settings, join other instances to this realm by exporting the configuration from the current instance and importing it to other instances. For more information on how to import and export configuration settings, see Importing and exporting configuration settings.

Clear old Q&A data for user objects in Active Directory

  1. Run the Migration wizard from the Password Manager CD autorun window.

  2. On the Welcome page, select the Clear old Q&A data for user objects in Active Directory task.

  3. On the Select users page, do one of the following and click Next:

    1. If you want to clear the old Q&A profiles of users from the user scope of a Management Policy, select the required policy in the Select Management Policy drop-down box and click Next.

    2. If you want to clear the old Q&A profiles of a user in a user group, select The following groups. To select groups, click Add and do the following:

      1. In the Add Groups dialog, enter the group name, select the domain from the list and click Search.

      2. Select the required groups in the list and click Save.

    3. If you want to clear the old Q&A profiles of a user in an OU, select The following OUs. To select OUs, click Add and do the following:

      1. In the Add OUs dialog, enter the OU name, select the domain from the list and click Search.

      2. Select the required OUs in the list and click Save.

  4. On the status page, click View the report for detailed information to view a detailed account of updating profiles. Click Finish.

NOTE: The latest version of Q&A, which is currently in use will not be deleted.

Realm Instances

On the Administration Site you can view a list of installed Password Manager instances belonging to one realm. This information is available on the Realm Instances page.

To open the Password Manager Service Instances page, on the Administration Site click General Settings. On the General Settings page, click the Realm Instances tab.

For each Service instance the Self-Service Site URL is specified. If necessary, you can edit the URL by clicking Edit under the corresponding Service instance. In Realm instances, the Primary instance is in red for easy identification.

All Password Manager Service instances belonging to one realm share the following settings: certificate name, port number, encryption algorithm, encryption key length, hashing algorithm, attribute for storing Q&A profile data, and realm affinity ID. These options are configured when initializing a Password Manager Service instance. To change any of these settings, see Instance reinitialization.

A Redistributable Secret Management Service (rSMS) user must be created in all the Password Manager realm instances. An rSMS user is automatically created if the imported configuration file has the rSMS account details.

Domain Connections

This section provides information on creating, modifying, and using domain connections.

Using domain connections

On the General Settings > Domain Connectionstab of the Administration Site, you can view a list of available domain connections.

To register a domain with Password Manager you need to create a connection to the required domain. When adding a domain connection you can select an existing connection or create a new one. It is possible to use the same domain connection in different sections: user and helpdesk scopes, and password policies.

The same domain connection can also be used in different Management Policies.

You can add a domain connection either on the Domain Connections tab or from the User scope, Helpdesk scope, and Password Policies pages.

Note, that when you modify the domain connection on the User scope, Helpdesk scope or Password Policies pages, you can select how you want to apply the updated connection settings: either for the specified section only or everywhere where this domain connection is used. If you choose to update settings for the specified section only, a copy of the domain connection will be created with these settings and will be added to the list of available domain connections.

But when you modify the domain connection on the Domain Connections tab, the updated settings will be automatically applied everywhere where this connection is used.

If you want to remove the domain connection from the list on the Domain Connections tab, you should first remove it from all sections where it is used, and only then remove the domain connection from the list.

Related Documents

The document was helpful.

Seleziona valutazione

I easily found the information I needed.

Seleziona valutazione