4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster <META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=windows-1252">
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster <META NAME="GENERATOR" CONTENT="StarOffice 9 (Win32)">
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster <META NAME="CREATED" CONTENT="20090729;12142600">
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster <META NAME="CHANGED" CONTENT="20090729;12304100">
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=CENTER STYLE="margin-bottom: 0in"><FONT FACE="Andale Sans UI, sans-serif"><FONT SIZE=5 STYLE="font-size: 20pt">README</FONT></FONT></P>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=CENTER STYLE="margin-bottom: 0in"><FONT FACE="Andale Sans UI, sans-serif"><FONT SIZE=4 STYLE="font-size: 16pt">(
b93185b577f7150fec37f9999b95b246d73bf63cjeff.schenkIntegration between OpenAM and Sun Identity Manager )</FONT></FONT></P>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><FONT FACE="Andale Sans UI, sans-serif">The
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterfiles in this directory, are intended as samples, to enable some of
b93185b577f7150fec37f9999b95b246d73bf63cjeff.schenkthe usecases in the context of integration between OpenAM and Sun
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan FosterIdentity Manager. The samples are part of the opensso.zip
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><FONT FACE="Andale Sans UI, sans-serif">The
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><FONT FACE="Andale Sans UI, sans-serif"><U><B>(1)
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan FosterConfiguring "Password-Expiry" or "Administrator-Driven
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan FosterPassword-Reset" Behavior</B></U></FONT></P>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><FONT FACE="Andale Sans UI, sans-serif">When
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fostera user's password is close to expiry, the Directory Server will send
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fostera warning, at the time configured in the password policy. When this
b93185b577f7150fec37f9999b95b246d73bf63cjeff.schenkevent occurs, the user will be redirected by OpenAM, to IDM, where
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterhe can change his password, the next time the user attempts to login
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><FONT FACE="Andale Sans UI, sans-serif">If
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterthe user does not change his password, and lets his password expire,
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterhe will need to request the Helpdesk, for a password-reset.</FONT></P>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><FONT FACE="Andale Sans UI, sans-serif">When
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fostera help-desk administrator resets an end-user's password, a flag will
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterbe set in the user's profile. The help-desk administrator will give
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterthe temporary password to the end-user, by email or over the phone.</FONT></P>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><FONT FACE="Andale Sans UI, sans-serif">When
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterthe end-user logs in, using the temporary password, he is redirected
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterto Identity Manager's user interface, to reset his password. After
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterhis password has been reset, the flag, that was earlier set, will get
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><A NAME="title-text"></A><A NAME="title-heading"></A>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<FONT FACE="Andale Sans UI, sans-serif"><U><B>(2) Configuring
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster"Self-Service Password-Reset" or "Forgot Password"
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><FONT FACE="Andale Sans UI, sans-serif">If
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterthe user has forgotten his password, he should be allowed to change /
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterreset his password all by himself, without requiring assistance from
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fostera helpdesk. <BR>To identify himself, he should correctly answer his
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterchallenge questions. Unless he does this correctly, he will not be
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterable to change / reset his password. </FONT>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><FONT FACE="Andale Sans UI, sans-serif"><U><B>(3)
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan FosterConfiguring Anonymous-Enrollment Or Self-Registration By User</B></U></FONT></P>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY><FONT FACE="Andale Sans UI, sans-serif">This usecase
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterrequires that an end-user be able to create his account in the
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY><FONT FACE="Andale Sans UI, sans-serif">The user
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterwill be allowed to provide the minimum details required of him, so
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterthat an account can be created for him on IDM. This account will get
b93185b577f7150fec37f9999b95b246d73bf63cjeff.schenkautomatically provisioned into OpenAM. </FONT>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY><FONT FACE="Andale Sans UI, sans-serif">Such a
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosteruser-account, would be the most basic account with the least
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterprivileges assigned / available to him.</FONT></P>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><FONT FACE="Andale Sans UI, sans-serif"><U><B>(4)
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan FosterConfiguring First-Time User Login Behavior</B></U></FONT></P>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><FONT FACE="Andale Sans UI, sans-serif">When
b93185b577f7150fec37f9999b95b246d73bf63cjeff.schenka user is logging into the protected application, through OpenAM,
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterfor the first time, after being provisioned, he should be requested
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterto set his challenge/response answers. These answers could later be
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterused to verify his identity, when he wants to reset a forgotten
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterpassword. </FONT>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><FONT FACE="Andale Sans UI, sans-serif"><U><B>(5)
b93185b577f7150fec37f9999b95b246d73bf63cjeff.schenkConfiguring Single-Logout (SLO) Between IDM And OpenAM</B></U></FONT></P>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><FONT FACE="Andale Sans UI, sans-serif">When
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterthe user logs out from the IDM app, he should automatically logged
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><FONT FACE="Andale Sans UI, sans-serif"><U><B>(6)
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan FosterConfiguring User-Account Self-UnLock Behavior</B></U></FONT></P>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY><FONT FACE="Andale Sans UI, sans-serif">When a
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosteruser's account is locked, as a result of the conditions configured in
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterthe password-policy assigned to the user, or as a result of marking
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterhis ldap account as inactive, it is possible to allow the user to
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterunlock his account himself, without requiring an intervention from an
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY><FONT FACE="Andale Sans UI, sans-serif">The user's
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosteraccount could have been locked, due to the following reasons:</FONT></P>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster <LI><P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><FONT FACE="Andale Sans UI, sans-serif">in-memory
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster account locking </FONT>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster <LI><P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><FONT FACE="Andale Sans UI, sans-serif">the
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster user may have exceeded the allowed number of failed attempts to
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster login, as configured in the password policy. In such types of
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster locking, the user may remain locked for a set amount of time, and
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster can only reset his password after that time has passed. The "locked
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster state" of the user account is maintained in memory, and no
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster information is written to his LDAP profile. </FONT>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster <LI><P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><FONT FACE="Andale Sans UI, sans-serif">physical
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster account locking </FONT>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster <LI><P ALIGN=JUSTIFY><FONT FACE="Andale Sans UI, sans-serif">the
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster user's account may have been locked either explicitly by an
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster administrator, or as a result of some automated processes, by
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster changing the value of the </FONT><TT><FONT FACE="Andale Sans UI, sans-serif">inetuserstatus</FONT></TT><FONT FACE="Andale Sans UI, sans-serif">
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster attribute in his profile, to </FONT><TT><FONT FACE="Andale Sans UI, sans-serif">Inactive</FONT></TT><FONT FACE="Andale Sans UI, sans-serif">.
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><FONT FACE="Andale Sans UI, sans-serif"><B>For
b93185b577f7150fec37f9999b95b246d73bf63cjeff.schenka detailed description about how to configure OpenAM and Sun
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan FosterIdentity Manager, for the above usecases, and how to use the sample
b93185b577f7150fec37f9999b95b246d73bf63cjeff.schenkfiles included here, please refer to the <A HREF="http://docs.sun.com/app/docs/doc/820-4729/ggsmu">OpenAM
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><FONT FACE="Andale Sans UI, sans-serif">The
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><IMG SRC="samples_sitemap.jpg" NAME="graphics1" ALIGN=LEFT WIDTH=1134 HEIGHT=697 BORDER=0><BR CLEAR=LEFT><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>