7.5 Setting Up Password Synchronization Filters

The driver needs to be configured to run on only one Windows machine.

However, after you install and configure the driver, do the following on each of the other domain controllers:

  1. Install a password filter (pwfilter.dll file).

  2. Configure the registry to capture passwords so that passwords can be sent to Identity Manager.

The password filter is automatically started when the domain controller is started. The filter captures password changes that users make by using Windows clients, encrypts the changes, and sends them to the driver to update the Identity Manager data store.

NOTE:For information about configuring Password Synchronization, see Implementing Password Synchronization in the Novell Identity Manager 3.0.1 Administration Guide.

To simplify your setup and administration of password filters, a Identity Manager PassSync utility is added to the Control Panel when the driver is installed. This utility gives you two choices for setting up the password filters, depending on whether you are willing to allow remote access to the registry on your domain controllers:

7.5.1 Configuring Password Filters for All Domain Controllers from One Machine

This procedure explains how to install and configure the password filter on each domain controller, all from the same machine where you are running the driver.

Use this method if you allow remote access to the registry.

Because setting up the filter requires rebooting the domain controller, you might want to perform this procedure after hours, or reboot only one domain controller at a time. If the domain has more than one domain controller, keep in mind that each domain controller where you want Password Synchronization to function must have the filter installed and must be rebooted.

  1. Confirm that port 135 (the RPC endpoint mapper) is accessible on the domain controllers and on the machine where the Identity Manager Driver for Active Directory is configured to run.

    If you are using NetBIOS over TCP, you also need these ports:

    • 137: NetBIOS name service
    • 138: NetBIOS datagram service
    • 139: NetBIOS session service

    A firewall could prevent the ports from being accessible remotely.

  2. At the computer where the driver is installed, click Start > Settings > Control Panel.

    Identity Manager PassSync Icon

  3. Double-click Identity Manager PassSync.

    The first time you open the utility, it asks whether this is the machine where the Identity Manager driver is installed.

    Is this the machine where the DirXML driver is configured to run?

    After you complete the configuration, you are not shown this prompt again unless you remove this domain from the list.

  4. Click Yes.

    A list appears, labeled Synchronized Domains.

    Synchronized Domains

  5. To add a domain that you want to participate in password synchronization, click Add.

    The Add Domain dialog box appears.

    Add Domain

  6. Specify or select the domain name that you want to add.

    Enter the Name of the Domain

    The drop-down list displays known domains.

  7. (Optional) Specify a computer in the domain.

    Enter a Computer Name

    If you leave the Computer edit box blank, PassSync queries the local machine. Therefore, if you are running PassSync on a domain controller, you don’t need to enter a name. PassSync queries the local machine (in this case, a domain controller) and gets (from the database) the list of all domain controllers in the domain.

    If you aren’t installing on a domain controller, enter the name of a computer that is in the domain and that can get to a domain controller.

    If you receive an error message indicating that PassSync can’t locate a domain, enter a different name.

  8. Decide whether to use the domain’s DNS name.

    The DNS name provides more advanced authentication and the ability to more reliably discover domains in bigger installations. However, the choice depends on your environment.

  9. Log in with administrator rights.

    The Identity Manager PassSync utility discovers all the domain controllers for that domain, and installs pwfilter.dll on each domain controller. It also updates the registry on the computer where you are running the drivers, and on each domain controller. This might take a few minutes.

    The pwfilter.dll doesn’t capture password changes until the domain controller has been rebooted. The Identity Manager PassSync utility lets you see a list of all the domain controllers and the status of the filter on them. It also lets you reboot the domain controller from inside the utility.

  10. Click the name of the domain in the list, then click Filters.

    The utility displays the names of all the domain controllers and the status of the filter on each of them.

    The status for each domain controller should indicate that it needs rebooting. However, it might take a few minutes for the utility to complete its automated task, and in the meantime the status might say Unknown.

    Password Filters Status

  11. Reboot each domain controller.

    You can choose to reboot them at a time that makes sense for your environment. Just keep in mind that password synchronization won’t be fully functional until every domain controller has been rebooted.

  12. When the status for all domain controllers says Running, test password synchronization to confirm that it is working.

  13. To add more domains, click OK to return to the list of domains, and repeat Step 6 through Step 12.

7.5.2 Separately Configuring Password Filters on Each Domain Controller

The procedure described in this section explains how to install and configure the password filter on each domain controller, one at a time.

Use this method if you don’t want to allow remote access to the registry.

In this procedure, you install the driver so that you have the Identity Manager PassSync utility. Then you use the utility to install the pwfilter.dll file, specify the port to use, and specify which host machine is running the Identity Manager Driver for Active Directory.

Because setting up the filter requires rebooting the domain controller, you might want to perform this procedure after hours, or reboot only one domain controller at a time. If a domain has more than one domain controller, keep in mind that each domain controller where you want Password Synchronization to function must have the filter installed and must be rebooted.

  1. Confirm that these ports are available on both the domain controller and the machine where the Identity Manager Driver for Active Directory is configured to run:

    • 135: The RPC endpoint mapper
    • 137: NetBIOS name service
    • 138: NetBIOS datagram service
    • 139: NetBIOS session service

  2. On the domain controller, use the Identity Manager Installation to install only the Identity Manager Driver for Active Directory.

    Installing the driver installs the Identity Manager PassSync utility.

  3. Click Start > Settings > Control Panel, then locate the Identity Manager PassSync utility.

    Identity Manager PassSycn Icon

  4. Double-click Identity Manager PassSync.

    The first time you open the utility, it asks whether this is the machine where the Identity Manager driver is installed.

    Is this the machine where the DirXML driver is configured to run?

  5. Click No.

    After you complete the configuration, you are not shown this prompt again unless you remove the password filter by using the Remove button in the Password Filter Properties dialog box.

    After you click No, the Password Filter Properties dialog box appears, with a status message indicating that the password filter is not yet set up on this domain controller.

    Password Filter Properties

  6. Click the Setup button to install the password filter, pwfilter.dll.

  7. For the Port setting, specify whether to use dynamic port or static port.

    Use the static port option only if you have decided to configure your remote procedure call (RPC) for the domain controller differently than the default.

  8. Specify the location of the Identity Manager driver, click the Add button, specify the Host Name of the machine that is running the Identity Manager driver in the Password Sync Filter - Add Host dialog box, then click OK.

    Enter the name of the machine where the Driver is running

    This step is necessary so that the password filter knows where to send the password changes. The password filter captures password changes, and must send them to the Identity Manager driver to update the Identity Manager data store.

  9. In the Password Filter Properties dialog box, click OK.

  10. Reboot the domain controller to complete the installation of the password filter.

    You can choose to reboot at a time that makes sense for your environment. Just keep in mind that password synchronization won’t be fully functional until every domain controller has the password filter installed and has been rebooted.

    After the installation is complete and the domain controller is rebooted, the password filter is loaded automatically whenever the domain controller starts up.

  11. Check the status for the password filter again by clicking Start > Settings > Control Panel, and double-clicking the Identity Manager PassSync utility.

    Confirm that the status says Running.

  12. Repeat Step 2 through Step 11 for each domain controller that you want to participate in Password Synchronization.

  13. When the status says Running for all the domain controllers, test Password Synchronization to confirm that it is working.