Using the advanced settings you can specify the following:
-
Encryption algorithm: use this setting to select the encryption algorithm that is used to encrypt users’ answers to secret questions and other security sensitive information. You can select from two options: Triple DES and AES. By default, Password Manager uses Triple DES algorithm to encrypt data.
NOTE: Users’ answers will be encrypted if the Store answers using reversible encryption option is selected in the Q&A Profile settings. Otherwise, the answers will be hashed.
-
Encryption key length: use this setting to select whether a 192-bit or 256-bit encryption key will be used.
-
Attribute for storing Q&A profiles: use this setting to enter the attribute name that will be used for storing Q&A profile data. By default, Password Manager stores Q&A profile data in the comment attribute of each user's account and the configuration data in the comment attribute of a configuration storage account, which is automatically created when installing Password Manager.
IMPORTANT: If you change encryption settings and the attribute for storing Q&A profiles, the current instance will be excluded from a realm it belongs to and users may lose their Q&A profiles.
When you change these settings, do the following to keep users’ Q&A profiles:
-
Export the current configuration when saving updated instance settings.
-
Update Q&A profiles using the Migration wizard (upload the exported configuration to the wizard) on the current instance.
-
To replicate new settings and updated Q&A profiles export the updated configuration from the current instance and import the configuration to other instances.
If you do not use the Migration wizard to update users’ Q&A profile after changing the settings, users will have to re-register with Password Manager.
-
- Hashing algorithm: Use this setting to select the hashing algorithm that will be used to hash users’ answers to secret questions. The following algorithms are available: MD5 and SHA-256. By default, Password Manager uses SHA-256 hashing algorithm. Password Manager will hash users’ answers if Store answers using reversible encryption option is not selected in the Q&A Profile settings.
IMPORTANT: If you change the hashing algorithm, the selected algorithm will be applied to newly created Q&A profiles only. Existing Q&A profiles will be hashed with the previously selected algorithm.
To modify the advanced settings
-
On the home page of the Administration Site, click General Settings > Reinitialization, and expand the Advanced settings section.
-
From the Encryption algorithm drop-down list, select the encryption algorithm for encrypting users’ answers to secret questions and other security sensitive data.
-
From the Encryption key length drop-down list, select whether a 192-bit or 256-bit encryption key will be used to encrypt data.
-
From the Hashing algorithm drop-down list, select the algorithm that will be used to hash users’ authentication answers.
-
In the Select the attribute of user’s account in Active Directory in which user’s Questions and Answers profile and Corporate phone will be stored section, provide the following data.
-
Security questions: Enter the required security question.
-
Corporate Phone: Enter the mobile number of the user.
-
Corporate email: Enter the corporate's email id of the user.
-
-
Click Save.
Once you click Save, Reinitialize Instance dialog appears.
-
In the Reinitialize Instance dialog, a password is generated for the configuration file that you should export to update users’ Q&A profiles and click Export.
-
Click Save.
To update users’ Q&A profiles with new instance settings
Before running the Migration Wizard, update the following attributes in the Migration Wizard\Resources\productinfo.xml file:
-
<productNameFull>: One Identity LLC for AD LDS
-
<productNameShort>: Password Manager
-
<realmType>: AD LDS
The values specified above can be also copied from One Identity\Password Manager for AD LDS\Service\Resources\productinfo.xml.
-
Run the Migration wizard from the Password Manager media autorun window.
-
On the Welcome page, select the Update users’ Q&A profiles with new instance settings task.
-
On the next page, upload the configuration file you exported when reinitializing the instance. Click Browse to select the file, enter the password you specified for the file, and click Next.
-
Select users whose Q&A profiles you want to update and click Next. To select groups, click Add and do the following:
-
In the Add Groups dialog, enter the group name, select the application directory partition from the list and click Search.
-
Select the required groups in the list and click Save.
-
-
On the next page, do one of the following and click Next:
-
Security Questions: Provide the required security questions.
-
Corporate Phone: Provide the required corporate phone.
-
Corporate email, Personal email, and Personal phone fields are not editable.
-
-
On the status page, click View the report for detailed information to view a detailed account of updating profiles. If you updated Q&A profiles in test mode, click Update Q&A profiles in production mode.
After you have updated the Q&A profiles with new instance settings, join other instances to this realm by exporting the configuration from the current instance and importing it to other instances. For more information on how to import and export configuration settings, see Import/Export Configuration Settings.