Send Password to user through email on new Active Directory(AD) account Creation

Identity Security Cloud (ISC) ISC Discussion and Questions
, ,
1

While creating a New AD account , we have a rule which generates a random password. Now once this AD Account is created we are sending a notification to the user that AD account is created. The password is not available in the account attributes , please help me with a way to retrieve a dynamically created password so that can be shared with the user in the email.

Thanks in advance…!!

1 Like
2

Hi Shivam,

Can you please let me know when AD Account is created, is it created from SailPoint? if so are you sending password through provisioningPolicy to AD?

3

Hi Dheeraj,

Yes, the AD account is created from Identity Now. We are sending the randomly generated password through the create policy of AD source.

4

Sailpoint uses two layers of encryption, it stores only cryptographic hash and never stores plain text password making it very difficult to decrypt it. So it’s not possible to get the random password that gets set so you won’t be able to email it.

5

The only way to retrieve it would be to park it in an AD attribute that you read back into an Identity Attribute. Be aware though that the password will be in clear text till the user logs in the first time to reset it (provided you’ve got that configured). It is generally not a good idea to send passwords around in emails regardless.

6

You can handle this in an AfterCreate or AfterModify (operation Enable for rehires) in PowerShell.

Add-Type -AssemblyName System.Web
$pass = ConvertTo-SecureString $([system.web.security.membership]::GeneratePassword(16, 2)) -AsPlainText -Force
Set-ADAccountPassword -Identity $nativeIdentity -NewPassword $pass -Confirm:$false
Set-ADUser $nativeIdentity -ChangePasswordAtLogon $true
$BSTR = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($pass)
$Password = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto($BSTR)

$body = "$Password with other text"

$splat = @{
    SMTPServer = "smtp.server.com"
    Port       = 25
    Credential = $creds
    From       = $from
    To         = $to
    Subject    = ""
    Body       = $body
    BodyAsHtml = $true
}

Send-MailMessage @splat
2 Likes
7

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.