Password Self-Service for Novell edirectory. Brent McCormick Novell Corporate Technology Strategist

Transcription

1 Password Self-Service for Novell edirectory Brent McCormick Novell Corporate Technology Strategist

2 Audience by Industry Government Healthcare Financial Services Education Telecommunications Manufacturing Media/Entertainment Legal Non-profit Retail Transportation Other 2 March 21, 2004 Novell Inc.

3 Novell edirectory OS Platform NetWare Windows Linux HP/UX Solaris AIX 3 March 21, 2004 Novell Inc.

4 Agenda Password Management Business Issues Universal Password Password Self Service Enterprise Password Management Q & A 4 March 21, 2004 Novell Inc.

5 Password Policy The Business Issues Around Passwords 5 March 21, 2004 Novell Inc.

6 Reduce Security Risks Security issues Many weak passwords Single strong password Multi-factor access Employees & customers 6 March 21, 2004 Novell Inc.

7 Business Need The Facts According to Gartner*, Password reset represents a call volume range of 10 percent to 30 percent at the IT service desk... In a nonautomated support model, password reset costs range from $51 (best case) to $147 (worst case) for the labor alone. With Password Self-Service... Eliminate many of the costs associated with resetting lost or forgotten passwords Tighten security by making possible the use of stronger passwords 7 March 21, 2004 Novell Inc. * Password Reset: Self-Service That You Will Love, Roberta Witty & Kris Brittain, April 2002

8 Password Policy Universal Password in Novell edirectory 8 March 21, 2004 Novell Inc.

9 Password History NDS Password Simple Password Enhanced Password Introducing: Universal Password 9 March 21, 2004 Novell Inc.

10 Password History NDS Password Public and Private keys (RSA) are created and stored on the user object. Can be lengthy to generate key pairs. Non-reversible - only the hash of the password is stored. The customer cannot retrieve the password from edirectory. Used by the Novell Client, LDAP and by applications written to the Novell Client APIs The password is never sent on the wire Policy can be applied: Password expiration Intruder lock Password minimum length Time of day restrictions Password uniqueness 10 March 21, 2004 Novell Inc.

11 Password History simple password Originally provided to allow migration from foreign systems, such as iplanet LDAP directory Typically a MD5 or SHA-1 password hash is imported May be reversible - actual password may be stored on user object Passwords are stored encrypted with DES or 3DES, based on setup of tree key Lower security than NDS Password, since the password is sent across the wire and is stored such that the password can be extracted. In addition, a simple password Does not support extended characters Has no password policy enforced 11 March 21, 2004 Novell Inc.

12 Password History enhanced password Enhanced Password offers some policy Min/Max length Repeatable/Consecutive characters Password Synchronization is one way (flows out from enhanced password to Universal Password and NDS passwords) Enhanced Password design was not consistent with Simple or Universal Password, and thus offered different security characteristics Deprecated in favor of Universal Password 12 March 21, 2004 Novell Inc.

13 Universal Password Benefits One password for all access to edirectory #&% Enables the use of extended characters in passwords Enables advanced password policies Provides a foundation for extending password management to other systems 13 March 21, 2004 Novell Inc.

14 Enabling Universal Password Universal Password can be enabled through Novell imanager for a user, a parent container, a partition root or tree wide For detailed instructions on deploying Universal Password, visit: n/data/allq21t.html 14 March 21, 2004 Novell Inc.

15 Password Management Password Policies via Universal Password Available Support: Min/Max characters Repeatable/Consecutive characters Exclude list Expiration settings Numeric/Special characters Require unique passwords Forgotten Passwords 15 March 21, 2004 Novell Inc.

16 Recommended System Requirements Novell edirectory Novell Modular Authentication Service with Universal Password enabled Novell imanager If you ve deployed the Novell Client and want client users to take advantage of Universal Password (though this is not a requirement), the client must be at version 4.9 or later Password Management for Novell edirectory Admin rights to root of tree 16 March 21, 2004 Novell Inc.

17 Password Policy Universal Password & Password Self-Service Administration 17 March 21, 2004 Novell Inc.

18 Password self-service empowers users to help themselves Administrators configure self-service policies Select allowable Challenge/Response options Define Challenge/Response success actions (for example:) hint to user Reset to last good password Display hint on the page Allow users to change their password Users set up their own hints and/or answers to challenge questions Hint is not allowed to contain the password Novell Inc, Confidential & Proprietary

19 Defining and enforcing system-wide password policies Administrators specify required properties of an acceptable password for systems throughout the enterprise Examples of password policy controls: Minimum/maximum number of characters Minimum number of upper case characters Minimum number of numerals Password re-use forbidden Password exclusion lists (forbidden words) And so on A policy can also be set to check/enforce conformance Novell Inc, Confidential & Proprietary

20 Novell Inc, Confidential & Proprietary April 26, 2004

42 System Architecture Novell Inc, Confidential & Proprietary April 26, 2004

44 Password Policy Password Self-Service 44 March 21, 2004 Novell Inc.

45 Forgotten Password: What is it? Forgotten Password: A password policy consisting of configurable content for password self-service, including Challenge Sets and selectable actions. Show hint on page Allow password reset password to user 45 March 21, 2004 Novell Inc.

48 Challenge Sets: What are they? Challenge Sets: A group of questions assigned to a password policy that are used as part of a password policy s method of authentication. Admin-defined User-defined Random questions Mandatory questions Adds additional level of security Allows for forgotten password self-service 48 March 21, 2004 Novell Inc.

50 Password Policy Password Self-Service End-User Experience 50 March 21, 2004 Novell Inc.

51 2002 Novell Inc, Confidential & Proprietary

57 Password Policy Enterprise Password Management 57 March 21, 2004 Novell Inc.

58 Enterprise Applications In addition to edirectory, to which applications would you most like to extend password management, including password self-service? Active Directory Windows NT Domains Microsoft Exchange Lotus Notes PeopleSoft SAP Databases (Oracle, Microsoft, Informix, etc.) Sun Java System Directory Server Unix Linux Mainframe AS/400 Other LDAP-compliant directories 58 March 21, 2004 Novell Inc.

59 Novell Nsure Identity Manager Do you currently own Novell Nsure Identity Manager (formerly DirXML)? Yes No Currently evaluating Nsure Identity Manager 59 March 21, 2004 Novell Inc.

60 Novell Nsure Identity Manager 2 Policy Builder Features Role-based entitlements Password management White pages & self-service Logging, monitoring & auditing Benefits Greatly simplified configuration Expanded effective delivery force Administration leverage Comprehensive, automatic password policy enforcement Empowered users Expanded self-service Non-repudiative security 60 March 21, 2004 Novell Inc.

61 Password Management for edirectory Novell GroupWise Novell ZENworks Novell NetWare Novell edirectory LDAP-compliant applications 61 March 21, 2004 Novell Inc.

62 Enterprise Password Management Novell GroupWise Active Directory Windows NT Domains Novell ZENworks SAP Novell NetWare Novell edirectory Nsure Identity Manager Lotus Notes Solaris LDAP-compliant applications Sun Directory Server Oracle 62 March 21, 2004 Novell Inc.

63 Summary Business issues Reduce/eliminate helpdesk calls for password resets Users can manage a single strong password Universal Password & Password Self Service edirectory Install/configure Enterprise Password Mgmt Bi-directional password synchronization 63 March 21, 2004 Novell Inc.

64 Now It s Your Turn This landing page highlights everything you need to set up password self-service for Novell edirectory, including: Password Self-Service Deployment Guide A copy of this presentation Download Password Management for Novell edirectory 64 Other resources: How to move a Universal Password policy object to a different container other - TID Taking Advantage of the New Universal Password ssword_edir.html March 21, 2004 Novell Inc.

65 Password Policy Q & A 65 March 21, 2004 Novell Inc.

66