« The JSON Schema... | Main | Make REST Calls from... »
Monday Nov 16, 2009

Configuring Identity Manager Password Reset with OpenSSO NOW

The following information concerns extending the end user password reset or forgot password feature to include Identity Manager 8.1.0.5 to be released sometime in October. (I wrote this weeks ago but forgot to publish it.) In a deployment that has both products integrated, a user needs the option to change or reset a configured password. To allow for identification, challenge questions should be configured for each user account. Unless these questions are answered correctly, this behavior will not be allowed. The flow diagram below details the process. (Right click it to open it full size in a new tab or window.)

To enable this feature, you will need to configure OpenSSO and then test the configurations. The configurations will work if the user has already configured challenge questions and answers or whether the user needs to configure challenge questions and answers now. The following sections have more information.

Configuring OpenSSO

To configure OpenSSO, you will define Identity Manager URIs as not enforced for the policy agent. You will also need to modify the OpenSSO login page so that it will display a Forgot Password button.

To Define Identity Manager URLs as Not Enforced

  1. Login to the OpenSSO console as administrator.
  2. Click the Access Control tab.
  3. Click the appropriate realm name and navigate to the Agents profile for the policy agent that protects Identity Manager.
  4. Under the agent profile, click the Application tab.
  5. Add the following URIs to the Not Enforced URIs property.
    • /idm/authutil/
    • /idm/authutil/*
    • /idm/authutil/*?*
  6. Click Save.
  7. Logout of OpenSSO.

Modifying the OpenSSO Login Page

There are two options to consider when deciding how to display a Forgot Password button on the OpenSSO login page. You can manually change the deployed Login.jsp file, or you can use the sample Login.jsp included with the opensso.zip download. They are mutually-exclusive so choose only one of these procedures.
To Manually Modify a Deployed Login.jsp
  1. Change to the /web-container-deploy-base/opensso/config/auth/default/ directory to access the deployed Login.jsp page.
  2. Open Login.jsp in an editor and add the five (5) sections of code displayed in yellow in forgot_pwd.html on the OpenSSO web site.
    The URL in one section of this page that ends .../idm/authutil/questionLogin.jsp?accountId= links to the Identity Manager JSP that will be displayed if the user does not have challenge questions configured. Replace the beginning of this URL (http://am-v490-01.red.iplanet.com:6480/idm/authutil/questionLogin.jsp?accountId= in the file) with the specifics of your deployment.
  3. Remove the web containers temporary, compiled JSP to ensure that the changes made are picked up.
    For example, if using Glassfish, the temporary, compiled classes can be found under the glassfish-home/domains/your-domain/generated/ directory.
  4. Restart the OpenSSO web container after making the changes.
To Use the Sample Login.jsp

  1. Change to the opensso/integrations/idm/jsps/ directory in the decompressed opensso.zip directory to access the sample Login.jsp.
  2. Change the Identity Manager URL embedded in the sample Login.jsp to reflect the Identity Manager system URL of your architecture.
    You can search for the string /idm to locate the URLs.
  3. Replace your deployed /web-container-deploy-base/opensso/config/auth/default/Login.jsp with the sample Login.jsp.
    If you replace your existing Login.jsp with the sample Login.jsp the following will occur.
    • You will lose any custom changes made to the existing Login.jsp.
    • You will inherit changes that might have been previously made to the sample Login.jsp to incorporate requirements for other use cases related to the OpenSSO integration with Identity Manager.
  4. Remove the web containers temporary, compiled JSP to ensure that the changes made are picked up.
    For example, if using Glassfish, the temporary, compiled classes can be found under glassfish-home/domains/your-domain/generated.
  5. Restart the OpenSSO web container after making the changes.
Optionally, you can run diff between both files and make the necessary changes manually.

Test The Configurations

  1. Access an Identity Manager URL.
    You will be redirected to the OpenSSO login page.
  2. Enter a username and click the "Forgot Password" button.
    You will be redirected to the Identity Manager questionLogin.jsp.
  3. Enter answers to the challenge questions and click the "Login" button.
    You will be redirected to second page.
  4. Enter your new password on this second page.
    This is a temporary password you would've received from contacting the help desk. See the process flow diagram above.
  5. Select the option to update all resource accounts.
    Ensure that both the Identity Manager and OpenSSO resources are selected.
  6. Select the option in the column "Forgot Old Password?" for the OpenSSO Resource.
  7. Click the "Change Password" button.
    The password is now changed. Use the new password next time you log in.

I had to come up with a video for this older post so I just clicked around and found this Queen video, Don't Stop Me Now. I saw this tour at MSG - leather and all!

Posted at 12:00AM Nov 16, 2009 by Michael Teger in Sun  |  Comments[0]

Comments:

Post a Comment:
  • HTML Syntax: NOT allowed