This page (revision-1) was last changed on 29-Nov-2024 16:16 by UnknownAuthor

Only authorized users are allowed to rename pages.

Only authorized users are allowed to delete pages.

Page revision history

Version Date Modified Size Author Changes ... Change note

Page References

Incoming links Outgoing links
Password Flow From Active Directory to eDirectory
Password Flow From Active Directory to eDirectory

Version management

Difference between version and

At line 1 added 193 lines
!!! Overview [1]
[{$pagename}] describes how the [DirXML] [Password Synchronization] works.
When a user performs a [Password Modify Operation] change within [Microsoft Active Directory] when [Microsoft Active Directory Driver] is utilized we describe the flow through the various components which make up the [DirXML] [Password Synchronization] process.
Generally, the process utilizes well known and published [APIs] provided from [Microsoft] as described in [AD Password Filters].
You will probably never need all these details unless you need them for [Troubleshooting DirXML].
These are the primary components:
* [DirXML PWFILTER.DLL] - This [MUST] be on all [Domain Controllers] in the [AD DOMAIN]
* [DirXML PassSync Agent] - Is installed as part of the [Microsoft Active Directory Driver] ([ADDriver])
* [ADDriver] - is the [DirXML Driver]
* [PassSyncConfig.cpl] - the password sync control Panel applet
%%error
__The [DirXML PWFILTER.DLL] will NOT load is [LSA Protection] is enabled!__
%%
!! Flow [Microsoft Active Directory] to [eDirectory]
The [Password Modify Operation] from a [Domain Controller] is intercepted by the [AD Password Filter] process provides a [Notification] to the [DirXML PWFILTER.DLL]
The complete Flow is similar to:
* The [Microsoft] [AD Password Filter] process ([LSA]) provides a [notification] to the [DirXML PWFILTER.DLL]
* [DirXML PWFILTER.DLL] obtains the [password] in [cleartext]
* Thread 1 of [DirXML PWFILTER.DLL] "releases" the the [AD Password Filter] process (So the next filter can process the password)
* Thread 1 of [DirXML PWFILTER.DLL] [encrypts] the [password] using [Symmetric Key Cryptography].
** We were told the process ([2020|Year 2020]) uses [CALG_RC4] (an [RC4] [Stream Cipher] [encryption] [algorithm] w/[Salt] to generate [Encryption key] (probably based the [ADDriver] machines [Private Key])
* Thread 1 of [DirXML PWFILTER.DLL] secures [Encrypted] [password] to [Windows registry] on [Domain Controller] ([HKLM]/SOFTWARE/Novell/PwFilter/Data/[SamAccountName])
* Thread 1 of [DirXML PWFILTER.DLL] notifies Thread 2 of pwfilter of work to do.
A second [DirXML PWFILTER.DLL] [thread] monitors the for [password] entries within "[HKLM]/SOFTWARE/Novell/PwdFilter/Data":
* Thread 2 of [DirXML PWFILTER.DLL] reads [encrypted] [password] from "[HKLM]/SOFTWARE/Novell/PwdFilter/Data" and decrypts the [password]
* Thread 2 of [DirXML PWFILTER.DLL] then [encrypts] [password]
* Thread 2 of [DirXML PWFILTER.DLL] makes [Remote Procedure Call] ([RPC]) Call to the [DirXML PassSync Agent] (which runs only on[DirXML Driver] or [DirXML Remote Loader]) and supplies the encrypted [password].
* The [DirXML PassSync Agent] puts the local [Windows registry] at [HKLM]/SOFTWARE/Novell/PassSync/Data/[SamAccountName]/
* The [DirXML PassSync Agent] notifies Thread 2 that it got the [password]
* Thread 2 (assuming it got the password) deletes the [password] in the [Windows registry] at (HKLM/SOFTWARE/Novell/PwFilter/Data/[SamAccountName]) and performs some type of [RPC] [Notification] to the [DirXML PassSync Agent]
[DirXML PassSync Agent] work:
* The [DirXML PassSync Agent] reads [password] from [Localhost] [Windows registry] at [HKLM]/SOFTWARE/Novell/PassSync/Data/[SamAccountName]/
* Assuming the [Password Modify Operation] [Timestamp] is less than the [Password Synchronization] [Time To Live], The [DirXML PassSync Agent] sends the [Password] to the [ADDriver]
* The [ADDriver] sends the [Password] across the [Publisher Channel] as [NspmDistributionPassword] within the [XDS Document]
* If the [DirXML Driver] reports [Success] or the [Password Modify Operation] [Timestamp] has expired, the [password] is deleted from [HKLM]/SOFTWARE/Novell/PassSync/Data/[SamAccountName]/
[ADDriver] does some work each time that it is started. The process is similar to: (Each of these are shown in the [ADDriver] trace)
* [DirXML PassSync Agent] Loads when [Microsoft Active Directory Driver] ([ADDriver]) loads
* [DirXML PassSync Agent] connects and [Authenticates] to [Microsoft Windows] [RPC] provider as the [ADDriver] [Microsoft] [user] ([Digital Identity])
* [DirXML PassSync Agent] reads [Localhost] info
* [DirXML PassSync Agent] get [Domain Controller] [list] using DsGetDCName()
* [DirXML PassSync Agent] creates an [Encryption key]
* For each [Domain Controller] found, the following flow will occur:
** Authenticate to DC via RPC
** Connect to the [DirXML PWFILTER.DLL]
** [DirXML PWFILTER.DLL] receive [Encryption key] from the agent
** [DirXML PWFILTER.DLL] connect back to agent (This step actually does not show in the [ADDriver] trace, but [RPC] communication issues on this step will prevent passwords from synchronizing)
%%warning
The [DirXML PassSync Agent] will use the [Microsoft Windows] [permissions] granted through the [Connected Application] [ADDriver] [Microsoft] [user] and it [MUST] have rights to read the [Windows registry] value for HKLM/SOFTWARE/Novell/PassSync/Data/.
%%
!! [DirXML Remote Loader]
Although we describe [{$pagename}] using a [DirXML Remote Loader], the same process would be used when running [EDirectory] on the Windows server.
!! Files
The location of the files may vary based on the install media.
! Installation
During the installation of a [DirXML Remote Loader] for [Microsoft Active Directory Driver] files listed below are all in the install files are located in [architecture]-specific directories such as system32_dlls and system64_dlls.
! Patches
For patches the [DirXML Remote Loader] files listed below are all in the install media's <extracted file>\x64
This was with the IDM402_AD_4003 patch.
! Files Names
* [PWFILTER.DLL|DirXML PWFILTER.DLL] - Main Password Sync application to capture Passwords. Placed in the directory defined by %SYSTEMDIRECTORY% (usually /windows/system32)
* PSEVENT.DLL - Placed in the directory defined by %SYSTEMDIRECTORY%
* [PassSyncConfig.cpl] - Password Sync Control Panel Applet. Placed in the directory defined by %SYSTEMDIRECTORY%
* PassSyncConfigR.dll - Location and file Varies with Language (Under the <extracted file>\x64\nls\ folder)
* PSEVENT.DLL - Placed in the folder defined by %SYSTEMDIRECTORY% (Sorry [{$applicationname}] not positive how this is used)
!! [Windows registry] Keys
There are several within the [Windows registry] for [Password Synchronization] process.
%%information
__HKLM/SOFTWARE/Novell/PassSync/Data/ and [HKLM]/SOFTWARE/Novell/PwdFilter/Data__ contents cannot normally be viewed indicates the contents cannot normally be seen. Permissions in here are limited to SYSTEM (Local System) only and are denied even to Administrator. You must grant the user permissions to Data and below in order to see the keys.
%%
! [Windows registry] Keys [Domain Controllers]
Every [Domain Controller] within the [AD DOMAIN], including the [DirXML Remote Loader] (assuming it is a Domain Controller) [MUST] have these entries:
[HKLM]/SOFTWARE/Novell/PwdFilter/ Machine: REG_DWORD:
Represents the [DirXML Driver] or [DirXML Remote Loader] Machine: REG_DWORD:
* 0x1 tells PassSync that this is where the driver ([DirXML Shim]) is running
* 0x0 tells PassSync that the driver ([DirXML Shim]) is not running on this machine.
[HKLM]/SOFTWARE/Novell/PwFilter (32 Bit & 64 Bit) Host Names: REG_MULTI_SZ:
This is the [DNS] name of the [Domain Controller] (DC) running the [DirXML Remote Loader] (or [DirXML Driver]). The pwfilter.dll uses this key to know which server is running the driver [DirXML Shim] to send the [Password Changes] to synchronize over the channel.
[HKLM]/SOFTWARE/Novell/PwFilter/Data/[SamAccountName]/ (referred to as: local password cache)
%%information
[HKLM]/SOFTWARE/Novell/PassSync/Data need only be present on the [Host] running the [DirXML PassSync Agent] which is also running the [ADDriver]
%%
! [HKLM]/SYSTEM/CurrentControlSet/Control/Lsa
This is how the [Local Security Authority] ([LSA]) provides [Notification] to the various [AD Password Filters] Packages that a [Password Modify Operation] has occurred. __Do not remove other values__.
* Reg_MULTI_Sz: PWFILTER This notifies the [DirXML PWFILTER.DLL] of a password change.
!! [DirXML Remote Loader] [Host]
The [DirXML Remote Loader] [Host] needs, in addition to the above if it is a [Domain Controller], the following [Windows registry] entries
! [HKLM]/SOFTWARE/Novell/PassSync/Data
Holds the [DNS] name of your [AD DOMAIN] (ldapwiki.net) Domains: REG_MULTI_SZ:
* Enum Data: REG_BINARY : ....
* Enum Index: REG_DWORD : ....
* State: REG_DWORD : ....
Below this would be a separate [Windows registry] entry representing each [Password Modify Operation] in a form similar to [HKLM]/SOFTWARE/Novell/PassSync/Data/[SamAccountName]/ of each [Password Modify Operation] waiting for the [Password Changes] to flow from across the driver channel. __Data's contents cannot normally be viewed__
Each [Domain Controller] will pick up [Password Changes] and store them in a [Windows registry] key for each user. The [DirXML PWFILTER.DLL] will then forward them to the [hostname] defined in [HKLM]/SOFTWARE/Novell/PwFilter-Host Names.
!! [Microsoft Active Directory Driver] Parameters
There are couple of [DirXML Driver] [Parameters] that effect the [{$pagename}]
! Password Sync [Timeout] (minute)
Specify the number of [minutes] for the [ADDriver] to attempt to synchronize a given [password]. The driver does __NOT__ try to synchronize the password after this [Timeout] interval has been exceeded.
The recommended value is at least three times the value of the polling interval. For example, if the Driver Polling Interval is set to 10 [minutes], set the Password Sync Timeout to 30 minutes.
* If this value is set to 0, [Password Synchronization] is disabled for this driver.
* If this value is set to -1, passwords never expire. It can reach a maximum value of [2,147,483,647] minutes.
* The default value is 5 minutes.
! DC Passwords [TimeToLive|Time To Live] (minute)
Specify the time limit in minutes for the passwords to be stored in the [Domain Controller] [Windows registry].
This allows the passwords that are stored in the [Domain Controller] registry to time out if the password does not synchronize to the driver within the specified time.
* If this value is set to -1, passwords will never be deleted from the registry.
* The default value is -1.
!! We assume
That you have verified that the Driver is set to synchronize Passwords and Global Config Values in the properties of the Driver.
!! Default Driver Behavior.
The password is sent across as a password element from the Remote Loader to the Driver and through to eDirectory. Note that the password is within a password element and is __NOT__ converted to the [NspmDistributionPassword] attribute prior to setting the password. Remember this as when working with the [Microsoft Active Directory Driver] on the [Publisher Channel] as you would need to check for a password change event rethan a modify of the [NspmDistributionPassword] Attribute.
The password will __NOT__ synchronize from [Microsoft Active Directory] to [eDirectory] if the user object is does not have an [DirXML Association]. You will receive the error: Message: Code(-8019) Operation vetoed on unassociated object.
%%information
When getting password sync traces for IDM, a Level 3 trace will show you the processing of policies and troubleshooting most password sync issues. A Level 5 trace will give you more detail on password sync processing, which may be helpful at times.
%%
!! Flow [EDirectory] to Microsoft Active Directory]
Generally, the [Subscriber Channel] flow will be as it is done in most drivers. The [NspmDistributionPassword] attribute would shows as being Modified until the [Command Transformation Policy Set]. The [DirXML PWFILTER.DLL] is __NOT__ involved in the [Subscriber Channel] flow.
For our discussion, we assume the user is already associated.
* Password change is received.
* If User object has a Password Policy assigned to them and that password policy has Universal Password enabled and it is set to Synchronize Distribution Password when setting Universal Password, the password will be copied to the [NspmDistributionPassword] attribute on the user object.
* The password change will be captured by IDM and sent across the [Subscriber Channel].
* Under the [Command Transformation Policy Set] a rule 'Convert modifies of a [NspmDistributionPassword] attribute to a modify password operation' will copy password in the [NspmDistributionPassword] attribute over to a password element and strips off the [NspmDistributionPassword] attribute.
* The password element is sent across the remote loader and updates the password through AD calls. (If you can update the password on the server running the remote loader with users and computers, the driver should be able to update the password.)
%%information
To get additional tracing detail of password synchronization, use a trace Level 5 on the the Remote Loader, if using a remote loader. Or Trace Level 5 on the Driver, if the IDM engine and eDirectory is running locally on the Windows server. You should see [[PWD] tagged lines in the trace.
%%
!! [PWFILTER Windows Events]
[PWFILTER Windows Events] describes the various events you might encounter.
! [Create a MAD Service To Run] regedit[2]
[Create a MAD Service To Run] describes how to [Create a MAD Service To Run]. We think it may be helpful in understanding how Services work mostly for Troubleshooting Purposes.
!! More Information
There might be more information for this subject on one of the following:
[{ReferringPagesPlugin before='*' after='\n' }]
----
* [#1] [TID 3614450 - Password Sync 2.0 - AD to eDirectory Components|https://www.novell.com/support/kb/doc.php?id=3614450 |target='_blank']
* [#2] [How To Create a Service under Windows|http://www.techeez.com/windows_tips/service_under_nt.htm|target='_blank']
* [#3] [TID 3650562 - Troubleshooting Password Synchronization in Identity Manager|https://www.novell.com/support/kb/doc.php?id=3650562|target='_blank'] - based on information observed on 2014-08-27
* [#4] [TID 3554990 - Troubleshooting Password Synchronization from the Active Directory Filter to the Active Directory Driver.|http://blog.securism.com/2009/01/summarizing-pki-certificate-validation/|target='_blank'] - based on information observed on 2014-08-27
* [#5] [TID 7003222 - [AD to EDIR Password sync failing & no (PWD) tracing in remote loader logs|https://www.novell.com/support/kb/doc.php?id=7003222|target='_blank'] - based on information observed on 2014-08-27
* [#6] [TID 7000896 - (-1208) Error in PassSync Control Panel Applet|https://www.novell.com/support/kb/doc.php?id=7000896|target='_blank'] - based on information observed on 2014-08-27
* [#7] [TID 7006575 - AD to eDir PassSync not working - pbValidDC = FALSE, PassSyncExchangeData() returned 0x00000774|https://www.novell.com/support/kb/doc.php?id=7006575 |target='_blank']
* [#8] [TID 3304529 - Passwords changes made in AD are not going into eDirectory|https://www.novell.com/support/kb/doc.php?id=3304529 |target='_blank']
* [#9] [TID 3976631 - What determines the Status of the Filter in the IDM PassSync|https://www.novell.com/support/kb/doc.php?id=3976631|target='_blank']
* [#10] [TID 7012989 - Detailed information on the new IDM 402 AD Driver feature "DC Passwords TimeToLive (minute)|https://www.suse.com/support/kb/doc.php?id=7012989|target='_blank']
* [#11] - [Password filter fails to load on Domain controller|https://support.microfocus.com/kb/doc.php?id=7024074|target='_blank'] - based on information obtained 2020-02-19
This page (revision-1) was last changed on 29-Nov-2024 16:16 by UnknownAuthorTop