Chat now with support
Chat with Support

Password Manager 5.8.2 - Administrator Guide (AD LDS edition)

About Password Manager Getting Started Upgrading Password Manager to 5.8.1 Password Manager Architecture Management Policies
Checklist: Configuring Password Manager Understanding Management Policies Configuring Access to the Administration Site Configuring Access to the Self-Service Site Configuring Access to the Helpdesk Site Configuring Questions and Answers Policy Workflow Overview Custom Workflows Custom Activities Self-Service Workflows Helpdesk Workflows User Enforcement Rules
General Settings Password Policies One Identity Hybrid Subscription One Identity Starling Reporting Appendix A: Accounts Used in Password Manager for AD LDS Appendix B: Open Communication Ports for Password Manager for AD LDS Appendix C: Customization Options Overview Glossary

About Password Policies

About Password Policies

By default, an AD LDS instance applies existing local or domain password policies. If a server on which AD LDS is installed belongs to a workgroup, the server’s local password policy settings and account lockout settings are enforced. If the server on which AD LDS is running belongs to a domain, the password policy settings and account lockout settings from the domain are enforced.

You can use Password Manager to create additional password policies that define which passwords to reject or accept. For each policy, you can configure a number rules, for example, a password age rule, complexity and length rules, custom rule, and others. It is recommended to use the custom rule to display the settings of the local or domain password policy applied to the server on which AD LDS is running. For more information, see Custom Rule.

Password policy settings are stored in Group Policy objects (GPOs). A GPO is applied to a target organizational unit. Group Policy objects from parent containers are inherited by default. When multiple Group Policy objects are applied, the policy settings are aggregated. For information on how to apply a password policy and change the policy priority, see Managing Password Policy Scope.

Creating a Password Policy

Creating a Password Policy

To create a password policy, you need add a connection to the AD LDS instance to which this policy will be applied.

The account you use to access the AD LDS instance for which you want to create password policies should have the following permissions:

  • The Read permission for attributes of the groupPolicyContainer objects.
  • The Write permission to create and delete the groupPolicyContainer objects in the System Policies container.
  • The permission to create and delete container and the serviceConnectionPoint objects in Group Policy containers.
  • The Read permission for the attributes of the container and serviceConnectionPoint objects in Group Policy containers.
  • The Write permission for the serviceBindingInformation and displayName attributes of the serviceConnectionPoint objects in Group Policy containers.

To connect to AD LDS instance

  1. On the home page of the Administration site, click the Password Policies tab.
  2. Click Connect to AD LDS instance to add an instance for which you want to create password policies.
  3. If connections already exist, select a connection from the list. If you want to create a new connection, click Add new connection.
  4. If you selected to create the new connection, in the Connect to AD LDS Instance dialog, configure the following options:
    • In the Server name on which AD LDS instance is installed text box, type the name of the server to which you want to connect.
    • In the Port number (LDAP or SSL) text box, enter the port number that you specified when installing the AD LDS instance. If you select the Use SSL check box, enter the SSL port number; otherwise, LDAP port number. It is recommended to use SSL in your production environment.
    • In the Application directory partition text box, enter the name of the application directory partition from the AD LDS instance to which you want to connect.
    • In the Application directory partition alias text box, type the alias for the application directory partition which will be used to address the partition on the Self-Service site.
    • In the Access account section, select Password Manager Service account to have Password Manager access the AD LDS instance using the Password Manager Service account, otherwise, select The following Active Directory account or The following AD LDS account radio button and enter the required user name and password.
  5. Click Save.

For more information on modifying settings for the connection, see AD LDS Instance Connections.

To create a password policy

  1. On the home page of the Administration site, click the Password Policies tab.
  2. Click the <N> One Identity Password Policies or One Identity Password Policies are not configured link under the application directory partition that you want to manage.
  3. On the One Identity Password Policies for <application directory partition> page, click the Add a policy button or Add new password policy link.
  4. In the Add New Policy dialog box, type a name for the new policy and click Save.

To configure settings for a password policy

  1. On the home page of the Administration site, click the Password Policies tab.
  2. Click the <N> One Identity Password Policies link under the application directory partition that you want to manage.
  3. On the One Identity Password Policies for <application directory partition> page, click Edit under the policy whose properties you want to view or modify.
  4. On the Policy Settings tab of the Password Policy Properties dialog box, view or modify the following options, and then click Save:
Table 16: Password Policy Properties

Option

Description

Disable this policy

Select this check box to temporarily turn off the policy.

Policy name

View or modify the name of the password policy.

  1. Click the Policy Rules tab to configure the password policy rules by using the procedure outlined in Configuring Password Policy Rules, and then click Save.
  2. Click the Policy Scope tab to manage the password policy links by using the procedure outlined in Managing Password Policy Scope, and then click Save.

Managing Password Policy Scope

Managing Password Policy Scope

This section provides information on how to apply a password policy to organizational units and groups in a managed AD LDS instance.

Applying Password Policies

Applying Password Policies

A newly created password policy is linked to the managed AD LDS instance for which it was created and applies to all authenticated users group by default. You can define granular password policies by linking them to certain organizational units and groups in the managed AD LDS instance.

IMPORTANT: To apply a password policy to users from a managed AD LDS instance, include at least one organization unit and one group from the instance to the policy scope. Users must be members of the corresponding group and organizational unit.

To link a password policy to organizational units and groups

  1. On the home page of the Administration site, click the Password Policies tab.
  2. Click the <N> One Identity Password Policies link under the application directory partition that you want to manage.
  3. On the One Identity Password Policies for <application directory partition> page, click Edit under the policy whose properties you want to view or modify.
  4. Click the Policy Scope tab.
  5. Click the Add button under This policy is applied to the following organizational units, and then browse for an organizational unit.
  6. Click the Add button under This policy is applied to the following groups, and then browse for a group.
  7. Click Save.
Related Documents