Password synchronization on HCL Domino

Identity Security Cloud (ISC) ISC Discussion and Questions
, ,
1

We have a question about password synchronization on HCL Domino.

We installed PW and created a Sync Group for password synchronization between Active Directory and LDAP, HCL Domino.

After testing, we observed that when a password is changed, PWI detect and send it to ISC, the Sync Group in ISC successfully initiates synchronization across different sources.

We’re not sure if ISC is sending the correct password to HCL Domino.

Questions :

• Could you please confirm if the HCL Domino change password provisioning policy is applied when the ISC synchronizes passwords ?
• Below is the default configuration for the change password policies:

image
image965×625 40.3 KB

• If the policy is applied, what configurations need to be made ?

2

Hi @vju11,

Do you have an idea password synchronization on HCL Domino ?

I see the following section in documentation Update Policies (sailpoint.com)

image
image1080×382 12 KB

And i update change_password provisioning policies like this :

image
image1260×1939 173 KB

And when password is changed on Active Directory, PWI catch it and send it to ISC and we observed in Account Actitity that the password is successfuly syncrhronized:

image

But when we try connect with new password in HCL Domino, it doesn’t work and the last change password date is not updated.

3

@colin_mckibben @colin_mckibben can you please tell us how we can address this kind of connectors specific questions ?

May we create support ticket ?

4

If you are not getting any responses in the forum, you can submit a support ticket or engage with Expert Services.

2 Likes
5

Hi Ousmane,

Has ID Vault been configured in HCL Domino?
To change your password, you must have IDVault configured.

6
7

Just refactoring one point.

It is necessary to validate which type of password should be updated in HCL Domino:

Internet Password

ID Password

There are two objects that can be understood as passwords in HCL Domino.

To change the password in the HCL Domino user’s .ID file, you must have configured the ID Vault. If the password you want to change is the Internet Password, the IDVault is not necessary.

8

Hi @originalmths,

We want to change this two password

Did you update password currently in your environment ?

How we can configure ID Vault Functionnalities ?

9

If the idea is to update these two objects:

Internet Password
ID Password

Since Sailpoint is changing the ID Password, the application (HCL Domino) must have IDVault configured.

And yes, we have implemented this password change process and it is working.

10

And the policy type is not “CHANGE_PASSWORD”, but “UPDATE”. Sailpoint documentation is poorly documented for this connector.

11

In Domino Server Side ID Vault is already configured and we want to know which king of configuration must be performed into ISC.

Do you use any update policies ?

12

image
image1546×808 66.3 KB

2 Likes
13

I will try this update policy.

I also have this following change password policy which exist natively on HCL domino :

image
image765×949 32.5 KB

in your case do you use this policy ?

14

No, This policy is not triggered. Never.

The password change process is done via IQService, that is, the IQService step must be configured in the source.

It is essential that the IQService is 32-bit.

In addition, there must be an administrator .ID in the folder.

Here in this step you will enter the path where the administrator .ID is stored. This .ID will be used for the IQService to authenticate to HCL Domino and perform the password reset.

15

Thank you @originalmths

I try to to modify this update policy several time and it never work.

We already have an IQ Service 32bit and Domino client admin installed.

For the administrator ID filte path where this file must copied ? Domino server or IQ Service ?

16

Administrator .ID must be stored on the IQService machine.

1 Like
17

And in ISC i can give path like : “C:\program files\Notes\adminfile.id” ?

18

Yes.

For example:

C:\SailPoint\IQService\administrator.id

1 Like
19

This file is mandatory ?

I cnnot found it

20

Do you know the account you configured to perform HCL Domino integration?

Admin Name
Admin Password

There is a .ID file for this service account, this .ID should be stored in IQService.