README.html revision 4fe4e4f798a84a46e567f64ceadd3648eb0582d4
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster <META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=windows-1252">
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster <META NAME="GENERATOR" CONTENT="StarOffice 9 (Win32)">
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster <META NAME="CREATED" CONTENT="20090729;12142600">
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster <META NAME="CHANGED" CONTENT="20090729;12304100">
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=CENTER STYLE="margin-bottom: 0in"><FONT FACE="Andale Sans UI, sans-serif"><FONT SIZE=5 STYLE="font-size: 20pt">README</FONT></FONT></P>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=CENTER STYLE="margin-bottom: 0in"><FONT FACE="Andale Sans UI, sans-serif"><FONT SIZE=4 STYLE="font-size: 16pt">(
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan FosterIntegration between OpenSSO and Sun Identity Manager )</FONT></FONT></P>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><FONT FACE="Andale Sans UI, sans-serif">The
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterfiles in this directory, are intended as samples, to enable some of
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterthe usecases in the context of integration between OpenSSO and Sun
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan FosterIdentity Manager. The samples are part of the opensso.zip
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><FONT FACE="Andale Sans UI, sans-serif">The
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><FONT FACE="Andale Sans UI, sans-serif"><U><B>(1)
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan FosterConfiguring "Password-Expiry" or "Administrator-Driven
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan FosterPassword-Reset" Behavior</B></U></FONT></P>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><FONT FACE="Andale Sans UI, sans-serif">When
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fostera user's password is close to expiry, the Directory Server will send
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fostera warning, at the time configured in the password policy. When this
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterevent occurs, the user will be redirected by OpenSSO, to IDM, where
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterhe can change his password, the next time the user attempts to login
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><FONT FACE="Andale Sans UI, sans-serif">If
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterthe user does not change his password, and lets his password expire,
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterhe will need to request the Helpdesk, for a password-reset.</FONT></P>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><FONT FACE="Andale Sans UI, sans-serif">When
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fostera help-desk administrator resets an end-user's password, a flag will
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterbe set in the user's profile. The help-desk administrator will give
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterthe temporary password to the end-user, by email or over the phone.</FONT></P>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><FONT FACE="Andale Sans UI, sans-serif">When
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterthe end-user logs in, using the temporary password, he is redirected
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterto Identity Manager's user interface, to reset his password. After
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterhis password has been reset, the flag, that was earlier set, will get
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><A NAME="title-text"></A><A NAME="title-heading"></A>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<FONT FACE="Andale Sans UI, sans-serif"><U><B>(2) Configuring
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster"Self-Service Password-Reset" or "Forgot Password"
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><FONT FACE="Andale Sans UI, sans-serif">If
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterthe user has forgotten his password, he should be allowed to change /
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterreset his password all by himself, without requiring assistance from
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fostera helpdesk. <BR>To identify himself, he should correctly answer his
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterchallenge questions. Unless he does this correctly, he will not be
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterable to change / reset his password. </FONT>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><FONT FACE="Andale Sans UI, sans-serif"><U><B>(3)
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan FosterConfiguring Anonymous-Enrollment Or Self-Registration By User</B></U></FONT></P>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY><FONT FACE="Andale Sans UI, sans-serif">This usecase
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterrequires that an end-user be able to create his account in the
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY><FONT FACE="Andale Sans UI, sans-serif">The user
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterwill be allowed to provide the minimum details required of him, so
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterthat an account can be created for him on IDM. This account will get
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterautomatically provisioned into OpenSSO. </FONT>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY><FONT FACE="Andale Sans UI, sans-serif">Such a
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosteruser-account, would be the most basic account with the least
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterprivileges assigned / available to him.</FONT></P>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><FONT FACE="Andale Sans UI, sans-serif"><U><B>(4)
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan FosterConfiguring First-Time User Login Behavior</B></U></FONT></P>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><FONT FACE="Andale Sans UI, sans-serif">When
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fostera user is logging into the protected application, through OpenSSO,
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterfor the first time, after being provisioned, he should be requested
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterto set his challenge/response answers. These answers could later be
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterused to verify his identity, when he wants to reset a forgotten
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterpassword. </FONT>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><FONT FACE="Andale Sans UI, sans-serif"><U><B>(5)
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan FosterConfiguring Single-Logout (SLO) Between IDM And OpenSSO</B></U></FONT></P>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><FONT FACE="Andale Sans UI, sans-serif">When
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterthe user logs out from the IDM app, he should automatically logged
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><FONT FACE="Andale Sans UI, sans-serif"><U><B>(6)
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan FosterConfiguring User-Account Self-UnLock Behavior</B></U></FONT></P>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY><FONT FACE="Andale Sans UI, sans-serif">When a
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosteruser's account is locked, as a result of the conditions configured in
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterthe password-policy assigned to the user, or as a result of marking
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterhis ldap account as inactive, it is possible to allow the user to
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterunlock his account himself, without requiring an intervention from an
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY><FONT FACE="Andale Sans UI, sans-serif">The user's
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosteraccount could have been locked, due to the following reasons:</FONT></P>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster <LI><P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><FONT FACE="Andale Sans UI, sans-serif">in-memory
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster account locking </FONT>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster <LI><P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><FONT FACE="Andale Sans UI, sans-serif">the
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster user may have exceeded the allowed number of failed attempts to
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster login, as configured in the password policy. In such types of
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster locking, the user may remain locked for a set amount of time, and
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster can only reset his password after that time has passed. The "locked
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster state" of the user account is maintained in memory, and no
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster information is written to his LDAP profile. </FONT>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster <LI><P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><FONT FACE="Andale Sans UI, sans-serif">physical
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster account locking </FONT>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster <LI><P ALIGN=JUSTIFY><FONT FACE="Andale Sans UI, sans-serif">the
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster user's account may have been locked either explicitly by an
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster administrator, or as a result of some automated processes, by
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster changing the value of the </FONT><TT><FONT FACE="Andale Sans UI, sans-serif">inetuserstatus</FONT></TT><FONT FACE="Andale Sans UI, sans-serif">
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster attribute in his profile, to </FONT><TT><FONT FACE="Andale Sans UI, sans-serif">Inactive</FONT></TT><FONT FACE="Andale Sans UI, sans-serif">.
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><FONT FACE="Andale Sans UI, sans-serif"><B>For
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fostera detailed description about how to configure OpenSSO and Sun
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan FosterIdentity Manager, for the above usecases, and how to use the sample
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterfiles included here, please refer to the <A HREF="http://docs.sun.com/app/docs/doc/820-4729/ggsmu">OpenSSO
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><FONT FACE="Andale Sans UI, sans-serif">The
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><IMG SRC="samples_sitemap.jpg" NAME="graphics1" ALIGN=LEFT WIDTH=1134 HEIGHT=697 BORDER=0><BR CLEAR=LEFT><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<P ALIGN=JUSTIFY STYLE="margin-bottom: 0in"><BR>