Can IDN do Password History?

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

When looking at using IDN for password management, one of the client requirements is to have a password history. They want the users to not be able to use the last 5 passwords, or the same password they used in the last 12 months.

Is this possible in IDN?

If not directly, is there a work around for it?

2

IdentityNow does not keep current or historical passwords. They are encrypted and sent to the target source so it would not have a way to directly tell you that you can’t use your previous 5 passwords.

3 Likes
3

Hi,
This is not possible for Identitynow default authentication method. If you have source like Active Directory then yes you can use the pass through authentication to achieve your requirement.

Thanks
Rakesh

1 Like
4

I setup an OpenLDAP with PTA and both reset password and update password once authenticated don’t seem to check the password history in LDAP, it seems to be using the admin account to make the password change. It definitely is enforced in my LDAP:
image

5

Hi Paul,
There is a setting in the source which needs to be checked to enforce password policy.
DId you check the same ?

image
image1830Ă—559 59.2 KB

Thanks

6

Looks like this is only on AD and not OpenLDAP. Can someone provide a screenshot of what it looks like when you set a password that is in password history?

7

image

This is the error message you get when you have Password History configured. I am not sure about OpenLDAP but this works fine for Active Directory.

Can you please open a Sailpoint ticket to confirm that OpenLDAP do support Password history OOTB ?

Thanks
Rakesh Bhati

8

I added “enforcePasswordPolicy”: “true” to the OpenLDAP connector and that doesn’t appear to change the behavior so I am guessing it isn’t supported. As long as AD works, I was skeptical it wouldn’t. I appreciate the insight.

1 Like
9

Can we prevent users from using Password Reset i.e. there is a security incident on the user’s account and they shouldn’t be able to self-service without calling a Help Desk? I assume if the AD account is disabled it won’t let them? I also don’t see any way to disable the unlock option is that correct?

10

Hi Paul,
Thats correct, the only option is you disable AD account. Once you disable AD account no one can login into using Pass Through authentication

11

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.