Password Flow From Active Directory to eDirectory

Overview [1]#

Password Flow From Active Directory to eDirectory describes how the DirXML Password Synchronization works.

When a user performs a Password Modify Operation change within Microsoft Active Directory when Microsoft Active Directory Driver is utilized we describe the flow through the various components which make up the DirXML Password Synchronization process.

Generally, the process utilizes well known and published APIs provided from Microsoft as described in AD Password Filters.

You will probably never need all these details unless you need them for Troubleshooting DirXML.

These are the primary components:

The DirXML PWFILTER.DLL will NOT load is LSA Protection is enabled!

Flow Microsoft Active Directory to eDirectory#

The Password Modify Operation from a Domain Controller is intercepted by the AD Password Filter process provides a Notification to the DirXML PWFILTER.DLL

The complete Flow is similar to:

A second DirXML PWFILTER.DLL thread monitors the for password entries within "HKLM/SOFTWARE/Novell/PwdFilter/Data":

DirXML PassSync Agent work:

ADDriver does some work each time that it is started. The process is similar to: (Each of these are shown in the ADDriver trace)

The DirXML PassSync Agent will use the Microsoft Windows permissions granted through the Connected Application ADDriver Microsoft user and it MUST have rights to read the Windows registry value for HKLM/SOFTWARE/Novell/PassSync/Data/.

DirXML Remote Loader#

Although we describe Password Flow From Active Directory to eDirectory using a DirXML Remote Loader, the same process would be used when running EDirectory on the Windows server.

Files #

The location of the files may vary based on the install media.

Installation#

During the installation of a DirXML Remote Loader for Microsoft Active Directory Driver files listed below are all in the install files are located in architecture-specific directories such as system32_dlls and system64_dlls.

Patches #

For patches the DirXML Remote Loader files listed below are all in the install media's <extracted file>\x64

This was with the IDM402_AD_4003 patch.

Files Names#

Windows registry Keys #

There are several within the Windows registry for Password Synchronization process.
HKLM/SOFTWARE/Novell/PassSync/Data/ and HKLM/SOFTWARE/Novell/PwdFilter/Data contents cannot normally be viewed indicates the contents cannot normally be seen. Permissions in here are limited to SYSTEM (Local System) only and are denied even to Administrator. You must grant the user permissions to Data and below in order to see the keys.

Windows registry Keys Domain Controllers#

Every Domain Controller within the AD DOMAIN, including the DirXML Remote Loader (assuming it is a Domain Controller) MUST have these entries:

HKLM/SOFTWARE/Novell/PwdFilter/ Machine: REG_DWORD: Represents the DirXML Driver or DirXML Remote Loader Machine: REG_DWORD:

HKLM/SOFTWARE/Novell/PwFilter (32 Bit & 64 Bit) Host Names: REG_MULTI_SZ: This is the DNS name of the Domain Controller (DC) running the DirXML Remote Loader (or DirXML Driver). The pwfilter.dll uses this key to know which server is running the driver DirXML Shim to send the Password Changes to synchronize over the channel.

HKLM/SOFTWARE/Novell/PwFilter/Data/SamAccountName/ (referred to as: local password cache)

HKLM/SOFTWARE/Novell/PassSync/Data need only be present on the Host running the DirXML PassSync Agent which is also running the ADDriver

HKLM/SYSTEM/CurrentControlSet/Control/Lsa #

This is how the Local Security Authority (LSA) provides Notification to the various AD Password Filters Packages that a Password Modify Operation has occurred. Do not remove other values.

DirXML Remote Loader Host#

The DirXML Remote Loader Host needs, in addition to the above if it is a Domain Controller, the following Windows registry entries

HKLM/SOFTWARE/Novell/PassSync/Data #

Holds the DNS name of your AD DOMAIN (ldapwiki.net) Domains: REG_MULTI_SZ: Below this would be a separate Windows registry entry representing each Password Modify Operation in a form similar to HKLM/SOFTWARE/Novell/PassSync/Data/SamAccountName/ of each Password Modify Operation waiting for the Password Changes to flow from across the driver channel. Data's contents cannot normally be viewed

Each Domain Controller will pick up Password Changes and store them in a Windows registry key for each user. The DirXML PWFILTER.DLL will then forward them to the hostname defined in HKLM/SOFTWARE/Novell/PwFilter-Host Names.

Microsoft Active Directory Driver Parameters#

There are couple of DirXML Driver Parameters that effect the Password Flow From Active Directory to eDirectory

Password Sync Timeout (minute)#

Specify the number of minutes for the ADDriver to attempt to synchronize a given password. The driver does NOT try to synchronize the password after this Timeout interval has been exceeded.

The recommended value is at least three times the value of the polling interval. For example, if the Driver Polling Interval is set to 10 minutes, set the Password Sync Timeout to 30 minutes.

DC Passwords TimeToLive (minute) #

Specify the time limit in minutes for the passwords to be stored in the Domain Controller Windows registry.

This allows the passwords that are stored in the Domain Controller registry to time out if the password does not synchronize to the driver within the specified time.

We assume #

That you have verified that the Driver is set to synchronize Passwords and Global Config Values in the properties of the Driver.

Default Driver Behavior. #

The password is sent across as a password element from the Remote Loader to the Driver and through to eDirectory. Note that the password is within a password element and is NOT converted to the NspmDistributionPassword attribute prior to setting the password. Remember this as when working with the Microsoft Active Directory Driver on the Publisher Channel as you would need to check for a password change event rethan a modify of the NspmDistributionPassword Attribute.

The password will NOT synchronize from Microsoft Active Directory to eDirectory if the user object is does not have an DirXML Association. You will receive the error: Message: Code(-8019) Operation vetoed on unassociated object.

When getting password sync traces for IDM, a Level 3 trace will show you the processing of policies and troubleshooting most password sync issues. A Level 5 trace will give you more detail on password sync processing, which may be helpful at times.

Flow EDirectory to Microsoft Active Directory]#

Generally, the Subscriber Channel flow will be as it is done in most drivers. The NspmDistributionPassword attribute would shows as being Modified until the Command Transformation Policy Set. The DirXML PWFILTER.DLL is NOT involved in the Subscriber Channel flow.

For our discussion, we assume the user is already associated.

To get additional tracing detail of password synchronization, use a trace Level 5 on the the Remote Loader, if using a remote loader. Or Trace Level 5 on the Driver, if the IDM engine and eDirectory is running locally on the Windows server. You should see [PWD] tagged lines in the trace.

PWFILTER Windows Events#

PWFILTER Windows Events describes the various events you might encounter.

Create a MAD Service To Run regedit[2]#

Create a MAD Service To Run describes how to Create a MAD Service To Run. We think it may be helpful in understanding how Services work mostly for Troubleshooting Purposes.

More Information #

There might be more information for this subject on one of the following:

Please see our Copyright And Intellectual Property Page and Standard Disclaimer Pages!