SAP Identity Management Password Hook Configuration Guide Company
Total Page:16
File Type:pdf, Size:1020Kb
CONFIGURATION GUIDE | PUBLIC Document Version: 1.0 – 2019-11-25 SAP Identity Management Password Hook Configuration Guide company. All rights reserved. All rights company. affiliate THE BEST RUN 2019 SAP SE or an SAP SE or an SAP SAP 2019 © Content 1 SAP Identity Management Password Hook Configuration Guide.........................3 2 Overview.................................................................. 4 3 Security and Policy Issues.....................................................5 4 Files and File Locations .......................................................6 5 Installing and Upgrading Password Hook..........................................8 5.1 Installing Password Hook....................................................... 8 5.2 Upgrading Password Hook...................................................... 9 6 Configuring Password Hook....................................................11 7 Integrating with the Identity Center.............................................18 8 Implementation Considerations................................................21 9 Troubleshooting............................................................22 SAP Identity Management Password Hook Configuration Guide 2 PUBLIC Content 1 SAP Identity Management Password Hook Configuration Guide The purpose of the SAP Identity Management Password Hook is to synchronize passwords from a Microsoft domain to one or more applications. This is achieved by capturing password changes from the Microsoft domain and updating the password in the other applications through a provisioning solution. Prerequisites To get the most benefit from this guide, you should have the following knowledge: ● Knowledge of the Identity Center ● Microsoft domain security ● Knowledge of the security policy of your organization ● Knowledge of Windows PowerShell The following software is required: ● You have installed SAP Identity Management 8.0 SP05 or higher ● You have installed the correct version of the Password Hook (a 32- or a 64-bit version) on the Microsoft domain controller. ● You have installed Windows PowerShell 4.0 or higher. Related Documents You can find useful information in the following documents: ● Article in Microsoft Developer Network Library: Password Filters ● SAP Identity Management Security Guide SAP Identity Management Password Hook Configuration Guide SAP Identity Management Password Hook Configuration Guide PUBLIC 3 2 Overview The SAP Identity Management Password Hook is a password hook DLL that can be installed on the Microsoft domain controller(s) in the password verification chain. If the correct domain security policy is enabled, the Password Hook will be notified whenever a user tries to change his or her password. This allows the hook to intercept password changes in the Microsoft domain and distribute it to other applications using the SAP Identity Management Identity Center. This allows the user passwords of other applications to be synchronized with the passwords in the Windows domain. The Password Hook can be one of several password hooks installed on the Microsoft controller. All enabled password hooks will be notified for each password change. Scenario The Password Hook uses REST API v2 over HTTPS to write the password to an identity store in the Identity Center. From there, the new password is distributed to a number of target applications using mechanisms in the Identity Center. SAP Identity Management Password Hook Configuration Guide 4 PUBLIC Overview 3 Security and Policy Issues Note By installing the Password Hook, changed passwords are sent to SAP Identity Management over HTTPS. Make sure the channel is encrypted and protected. When implementing the Password Hook, avoid any security breaches and be careful not to violate the security policy of your organization. It is important to understand the nature of passwords when implementing a solution using the Password Hook. A password is used by a user to authenticate against an application, and will give the user certain rights within that system. The password is known as a "shared secret", based on the assumption that it is known only by the user and the application. If the password is exposed, an attacker may be able to masquerade as (that is, log in as) the user, and perform operations only allowed by this user. There is no way of detecting or logging this kind of security attack. Applications make efforts to store the password as securely as possible, for example, using a one-way encryption algorithm. By implementing any type of password hook, you will in most cases increase the risk of password exposure, and this risk should be carefully assessed with regards to consequences of exposure. Another detail that should be considered is to which applications a password is synchronized. When the same password is used in all applications, a security attack with the purpose of obtaining a given user's password could be directed towards the application with the weakest security. Therefore, you should carefully consider which systems should be synchronized. For Password Hook security-relevant information, see the Password Hook section in SAP Identity Management Security Guide. Related Information Password Hook SAP Identity Management Password Hook Configuration Guide Security and Policy Issues PUBLIC 5 4 Files and File Locations The Password Hook is distributed together with the Identity Center, but it is not installed together with the Identity Center. It needs to be installed separately. You can find the files you need to install/update (and configure) the Password Hook in the installation kit, that is, in the Core components under the PasswordHook folder. The Password Hook is available in both 32-bit and 64-bit version. When the Password Hook is installed, the default destination directory is C:\usr\sap\IdM\Identity Center. The .dll file is installed in the Windows System directory (C:\WINDOWS\system32\MxPwdHook.dll). File Directory Description setup.exe <installation kit>\Core Run this file to install the Password \PasswordHook Hook. Install the Password Hook on the Microsoft domain controller. HookConfig.exe C:\usr\sap\IdM\Identity Open this file to configure the Password Center\ (by Hook. The file is included in the installa tion. default) newpass.bat C:\usr\sap\IdM\Identity This is a sample BAT file that can be Center\ (by used to test the Password Hook. The file is included in the installation. default) TestHook.exe C:\usr\sap\IdM\Identity This is a small test program included in Center\ (by the installation. It simulates a password change for a test user and can be used default) to test the configuration of the Pass word Hook. SAP Identity Management Password Hook Configuration Guide 6 PUBLIC Files and File Locations File Directory Description Send-Password.ps1 C:\usr\sap\IdM\Identity This script sends a REST API request to Center\ update the value of the MX_PASS WORD* attribute with the new pass word. The user (identified with its MSKEY) and the new password are passed as arguments to the script. The script is included in the installation. * SAP Identity Management Password Hook uses MX_PASSWORD_HOOK at tribute for password transportation. The attribute is internally converted to MX_PASSWORD. Set-Credentials.ps1 C:\usr\sap\IdM\Identity This script sets the credentials for the Center\ user that makes the REST API request. The script is included in the installation. SAP Identity Management Password Hook Configuration Guide Files and File Locations PUBLIC 7 5 Installing and Upgrading Password Hook Even though the Password Hook is distributed together with the Identity Center, it still needs to be installed separately. The necessary data for installing the Password Hook is included in the installation kit. The files are located in the Core components under the Password Hook folder. The Password Hook is available for both 32- and 64- bit operating systems. Select the correct version of the Password Hook and install it on the Microsoft domain controller. Note Make sure that you are logged on as a user with administrator privileges when running the installation program. Related Information Installing Password Hook [page 8] Upgrading Password Hook [page 9] 5.1 Installing Password Hook Context To install the program, proceed as follows: Procedure 1. Navigate to the correct version of the Password Hook (a 32- or a 64-bit version) in the Core Components PasswordHook folder in the installation kit. 2. Start the installation by choosing setup.exe. You can use the default values for all steps in the process (that is, installation directoryC:\usr\sap\IdM\Identity Center). Make sure the Key folder containing the Keys.ini file is available in the Password Hook installation directory. The default location of the Key folder is C:\usr\sap\IdM\Identity Center. SAP Identity Management Password Hook Configuration Guide 8 PUBLIC Installing and Upgrading Password Hook 3. Enable the following setting, if necessary: ○ Choose All Programs Administrative Tools Domain Controller Security Policy from the Start menu to open the Domain Controller Security Policy window. ○ Choose Windows Settings Security Settings Account Policies Password Policy in the console tree and enable Passwords must meet complexity requirements. 4. Restart the server. 5.2 Upgrading Password Hook Context If you are upgrading the Password Hook, you must disable the Password Hook and restart the server before the program can be upgraded. This is because the Windows LSA (Local Security Authority) locks the DLL file until the DLL