When a user performs a Password Modify Operation change within Microsoft Active Directory when Microsoft Active Directory Driver is utilized we describe the flow through the various components which make up the DirXML Password Synchronization process.
You will probably never need all these details unless you need them for Troubleshooting DirXML.
These are the primary components:
- DirXML PWFILTER.DLL - This MUST be on all Domain Controllers in the AD DOMAIN
- DirXML PassSync Agent - Is installed as part of the Microsoft Active Directory Driver (ADDriver)
- ADDriver - is the DirXML Driver
- PassSyncConfig.cpl - the password sync control Panel applet
The complete Flow is similar to:
- The Microsoft AD Password Filter process (LSA) provides a notification to the DirXML PWFILTER.DLL
- DirXML PWFILTER.DLL obtains the password in cleartext
- Thread 1 of DirXML PWFILTER.DLL "releases" the the AD Password Filter process (So the next filter can process the password)
- Thread 1 of DirXML PWFILTER.DLL encrypts the password using Symmetric Key Cryptography.
- Thread 1 of DirXML PWFILTER.DLL secures Encrypted password to Windows registry on Domain Controller (HKLM/SOFTWARE/Novell/PwFilter/Data/SamAccountName)
- Thread 1 of DirXML PWFILTER.DLL notifies Thread 2 of pwfilter of work to do.
- Thread 2 of DirXML PWFILTER.DLL reads encrypted password from "HKLM/SOFTWARE/Novell/PwdFilter/Data" and decrypts the password
- Thread 2 of DirXML PWFILTER.DLL then encrypts password
- Thread 2 of DirXML PWFILTER.DLL makes Remote Procedure Call (RPC) Call to the DirXML PassSync Agent (which runs only onDirXML Driver or DirXML Remote Loader) and supplies the encrypted password.
- The DirXML PassSync Agent puts the local Windows registry at HKLM/SOFTWARE/Novell/PassSync/Data/SamAccountName/
- The DirXML PassSync Agent notifies Thread 2 that it got the password
- Thread 2 (assuming it got the password) deletes the password in the Windows registry at (HKLM/SOFTWARE/Novell/PwFilter/Data/SamAccountName) and performs some type of RPC Notification to the DirXML PassSync Agent
DirXML PassSync Agent work:
- The DirXML PassSync Agent reads password from Localhost Windows registry at HKLM/SOFTWARE/Novell/PassSync/Data/SamAccountName/
- Assuming the Password Modify Operation Timestamp is less than the Password Synchronization Time To Live, The DirXML PassSync Agent sends the Password to the ADDriver
- The ADDriver sends the Password across the Publisher Channel as NspmDistributionPassword within the XDS Document
- If the DirXML Driver reports Success or the Password Modify Operation Timestamp has expired, the password is deleted from HKLM/SOFTWARE/Novell/PassSync/Data/SamAccountName/
- DirXML PassSync Agent Loads when Microsoft Active Directory Driver (ADDriver) loads
- DirXML PassSync Agent connects and Authenticates to Microsoft Windows RPC provider as the ADDriver Microsoft user (Digital Identity)
- DirXML PassSync Agent reads Localhost info
- DirXML PassSync Agent get Domain Controller list using DsGetDCName()
- DirXML PassSync Agent creates an Encryption key
- For each Domain Controller found, the following flow will occur:
- Authenticate to DC via RPC
- Connect to the DirXML PWFILTER.DLL
- DirXML PWFILTER.DLL receive Encryption key from the agent
- DirXML PWFILTER.DLL connect back to agent (This step actually does not show in the ADDriver trace, but RPC communication issues on this step will prevent passwords from synchronizing)
Files #The location of the files may vary based on the install media.
Installation#During the installation of a DirXML Remote Loader for Microsoft Active Directory Driver files listed below are all in the install files are located in architecture-specific directories such as system32_dlls and system64_dlls.
Patches #For patches the DirXML Remote Loader files listed below are all in the install media's <extracted file>\x64
This was with the IDM402_AD_4003 patch.
- PWFILTER.DLL - Main Password Sync application to capture Passwords. Placed in the directory defined by %SYSTEMDIRECTORY% (usually /windows/system32)
- PSEVENT.DLL - Placed in the directory defined by %SYSTEMDIRECTORY%
- PassSyncConfig.cpl - Password Sync Control Panel Applet. Placed in the directory defined by %SYSTEMDIRECTORY%
- PassSyncConfigR.dll - Location and file Varies with Language (Under the <extracted file>\x64\nls\ folder)
- PSEVENT.DLL - Placed in the folder defined by %SYSTEMDIRECTORY% (Sorry Ldapwiki not positive how this is used)
Windows registry Keys #There are several within the Windows registry for Password Synchronization process.
- 0x1 tells PassSync that this is where the driver (DirXML Shim) is running
- 0x0 tells PassSync that the driver (DirXML Shim) is not running on this machine.
HKLM/SOFTWARE/Novell/PwFilter (32 Bit & 64 Bit) Host Names: REG_MULTI_SZ: This is the DNS name of the Domain Controller (DC) running the DirXML Remote Loader (or DirXML Driver). The pwfilter.dll uses this key to know which server is running the driver DirXML Shim to send the Password Changes to synchronize over the channel.
- Reg_MULTI_Sz: PWFILTER This notifies the DirXML PWFILTER.DLL of a password change.
- Enum Data: REG_BINARY : ....
- Enum Index: REG_DWORD : ....
- State: REG_DWORD : ....
Each Domain Controller will pick up Password Changes and store them in a Windows registry key for each user. The DirXML PWFILTER.DLL will then forward them to the hostname defined in HKLM/SOFTWARE/Novell/PwFilter-Host Names.
Microsoft Active Directory Driver Parameters#There are couple of DirXML Driver Parameters that effect the Password Flow From Active Directory to eDirectory minutes for the ADDriver to attempt to synchronize a given password. The driver does NOT try to synchronize the password after this Timeout interval has been exceeded.
The recommended value is at least three times the value of the polling interval. For example, if the Driver Polling Interval is set to 10 minutes, set the Password Sync Timeout to 30 minutes.
- If this value is set to 0, Password Synchronization is disabled for this driver.
- If this value is set to -1, passwords never expire. It can reach a maximum value of 2,147,483,647 minutes.
- The default value is 5 minutes.
DC Passwords TimeToLive (minute) #Specify the time limit in minutes for the passwords to be stored in the Domain Controller Windows registry.
This allows the passwords that are stored in the Domain Controller registry to time out if the password does not synchronize to the driver within the specified time.
- If this value is set to -1, passwords will never be deleted from the registry.
- The default value is -1.
We assume #That you have verified that the Driver is set to synchronize Passwords and Global Config Values in the properties of the Driver.
Default Driver Behavior. #The password is sent across as a password element from the Remote Loader to the Driver and through to eDirectory. Note that the password is within a password element and is NOT converted to the NspmDistributionPassword attribute prior to setting the password. Remember this as when working with the Microsoft Active Directory Driver on the Publisher Channel as you would need to check for a password change event rethan a modify of the NspmDistributionPassword Attribute.
The password will NOT synchronize from Microsoft Active Directory to eDirectory if the user object is does not have an DirXML Association. You will receive the error: Message: Code(-8019) Operation vetoed on unassociated object.
Flow EDirectory to Microsoft Active Directory]#Generally, the Subscriber Channel flow will be as it is done in most drivers. The NspmDistributionPassword attribute would shows as being Modified until the Command Transformation Policy Set. The DirXML PWFILTER.DLL is NOT involved in the Subscriber Channel flow.
For our discussion, we assume the user is already associated.
- Password change is received.
- If User object has a Password Policy assigned to them and that password policy has Universal Password enabled and it is set to Synchronize Distribution Password when setting Universal Password, the password will be copied to the NspmDistributionPassword attribute on the user object.
- The password change will be captured by IDM and sent across the Subscriber Channel.
- Under the Command Transformation Policy Set a rule 'Convert modifies of a NspmDistributionPassword attribute to a modify password operation' will copy password in the NspmDistributionPassword attribute over to a password element and strips off the NspmDistributionPassword attribute.
- The password element is sent across the remote loader and updates the password through AD calls. (If you can update the password on the server running the remote loader with users and computers, the driver should be able to update the password.)
Create a MAD Service To Run regedit#Create a MAD Service To Run describes how to Create a MAD Service To Run. We think it may be helpful in understanding how Services work mostly for Troubleshooting Purposes.
More Information #There might be more information for this subject on one of the following:
- Active Directory and Passwords
- DirXML PWFILTER.DLL
- DirXML PassSync Agent
- Microsoft Active Directory Driver
- PWFILTER Windows Events
- Password Management Applications
- Web Blog_blogentry_260814_1
- [#1] TID 3614450 - Password Sync 2.0 - AD to eDirectory Components
- [#2] How To Create a Service under Windows
- [#3] TID 3650562 - Troubleshooting Password Synchronization in Identity Manager - based on information observed on 2014-08-27
- [#4] TID 3554990 - Troubleshooting Password Synchronization from the Active Directory Filter to the Active Directory Driver. - based on information observed on 2014-08-27
- [#5] TID 7003222 - [AD to EDIR Password sync failing & no (PWD) tracing in remote loader logs - based on information observed on 2014-08-27
- [#6] TID 7000896 - (-1208) Error in PassSync Control Panel Applet - based on information observed on 2014-08-27
- [#7] TID 7006575 - AD to eDir PassSync not working - pbValidDC = FALSE, PassSyncExchangeData() returned 0x00000774
- [#8] TID 3304529 - Passwords changes made in AD are not going into eDirectory
- [#9] TID 3976631 - What determines the Status of the Filter in the IDM PassSync
- [#10] TID 7012989 - Detailed information on the new IDM 402 AD Driver feature "DC Passwords TimeToLive (minute)
- [#11] - Password filter fails to load on Domain controller - based on information obtained 2020-02-19