Implementing Universal Password

Overview#

A How To on Implementing Universal Password

Universal Password is more of a framework for managing passwords called NSPM.

Below is a document Novell wrote to help you through the Universal Password implementation process.

You may also want to take a look at the Universal Password deployment web page

How to deploy Universal Password as a container admin:

Create Universal Password Policy#

The first step in deploying Universal Passwords is to create a Universal Password Policy. This policy will dictate the rules (e.g. Password Quality, expiration, history, etc.) for the Universal Password.

By default all Universal Password policies are stored in the Security Container off of the root of the tree. Since Container admins do not have the necessary rights to create password policies in the Security Container, the password policy will either need to be created in a test tree, or with the help of root Admins, in the tree.

Using iManager:

Test the Universal Password Policy#

After creating the policy, but before exporting it from the Security Container, test the policy on a test user account. First assign the policy to a test user via iManager or manually adding the necessary attribute to the test user.

Using iManager:

or

Manually add the Universal Password policy attribute using Console One:

With the policy assignment in place, test the effectiveness of the password policy. Test with the same methodologies in production use (e.g. Client32, AFP, NetStorage, etc).

Export the Policy from the Security Container#

After creating and testing the policy, the policy will need to be exported from the Security Container where it was created. The export is the first step in moving the policy from the Security Container to a place within the unit's own container (where it can be managed, and changed if needed at a later time).

How To export#

One easy way to export the policy is to use a LDAP browser/editor. One such tool can be found here: http://www.novell.com/coolsolutions/tools/13765.html

After exporting the policy to an LDIF file, it will need to be edited to reflect where it's new location is going to be within the tree. Using a plain text editor open up the LDIF file and edit the "dn" entry to reflect it's location to be. For example: 

	dn: cn=test-policy-name, ou=Password-Policies, ou=test, dc=willeke,dc=com

Import the edited LDIF to your container#

After creating and testing the policy and then exporting and editing the LDIF, the policy can be imported into the tree.

How To Import#

Assign rights to the Policy#

When Universal Password Policies live in the Security Container, the policies inherit rights from the Security Container. These rights enable the Password Policy to be reported to the user. When the Password Policy is exported and then imported to another location in the tree, these rights are lost and need to be manually added to the policy in it's new location.

The rights needed to the policy are: 

	All Attributes
		Compare
		Read

	Entry
		Browse
We suggest assigning these rights to the container where the user objects reside (and also directly to a test user if the test user does not reside in the same container as the other users).

Test the created, exported, edited and imported Policy#

After creating and testing, exporting, editing and importing the Policy, the policy needs to be tested with a test user in the production environment. Assign the policy to a test user via iManager or manually adding the necessary attribute to the test user.

Using iManager:#

or

Manually add the Universal Password policy attribute using Console One:

With the policy assignment in place, test the effectiveness of the password policy. Test with the same methodologies in production use (e.g. Client32, AFP, NetStorage, etc).

Universal Password Policy Assignment#

If the policy works as expected, it can then be assigned on a broader scale.Universal Password policies can be assigned to containers or user(s). Assign the policy via iManager or manually adding the necessary attribute to the container or desired user(s).

Editing a moved Policy#

If it becomes necessary to edit a Password Policy which has been moved out of the Security Container, you can not use the Passwords->Password Policies task because it is hard coded to look inside Security Container for policies, you can not browse to other locations. To edit a moved policy, using iManager:

Universal Password Diagnostic Utility#

After deploying a Universal Password policy, during testing it will likely be useful to check the status of the passwords and/or the password policy which is in force.

DIAGPWD allows an administrator to view what Universal Password Policy is associated to a user and whether the Simple, NDS and Universal Passwords are synched.

More Information#

In addition to the Universal Password deployment web page mentioned above, some other pages you may find helpful are:
Please see our Copyright And Intellectual Property Page and Standard Disclaimer Pages!