Restricting Password Attribute Matching Using PX Policies - Identity Manager

Products

• CA Identity Manager
• CA Identity Suite

Issue/Introduction

Identity Manager Password Policies are designed to perform a comprehensive validation against all profile attributes rather than allowing granular selection of specific fields. This article provides a workaround using Policy Xpress (PX) to implement a custom check that prevents users from setting a password that matches their specific User ID.

Environment

Identity Manager 14.5

Cause

The native Password Policy engine is architecturaly designed to evaluate the entire profile for security compliance. It cannot be configured to selectively ignore certain attributes or exclusively target specific ones (such as the User ID) during the validation phase.

Resolution

To enforce a rule where the password cannot match the User ID, configure a PX Policy as follows:

1. Define Data Elements:

   • getNewPassword: Category: Attributes, Type: User Attribute, Function: Get, Attribute Name: Password (%PASSWORD%)
   • hasPasswordChanged: Category: Attributes, Type: Has the User Attribute Value Changed, Function: Has Changed, Attribute Name: Password (%PASSWORD%)
   • getUserID: Category: Attributes, Type: User Attribute, Function: Get, Attribute Name: User ID (%USER_ID%)
   • compareNewPasswordWithUserID: Category: Comparators, Type: Comparator, Function: Compare Strings, First String: {'getNewPassword'}, Second String: {'getUserID'}

2. Configure Rules:

   • Entry Rule (Check_If_Password_Changed): Data Element: hasPasswordChanged, Operator: Equals, Value: true
   • Action Rule (Check_If_Password_Matches_UserID): Priority: 0, Data Element: compareNewPasswordWithUserID, Operator: Equals, Value: Equals

3. Configure Action:

   • Action: Display Message
   • Function: Displays a message on the screen
   • Message: "Password cannot match UserID"

4. Policy Configuration:

   • Policy Name: CheckPasswordAgainstProfileAttributes
   • Policy Type: UI
   • Event State: Validate On Submit
   • Event Name: Reset User Password (ResetUserPassword)

Additional Information

If you require native support for selective attribute checking in Password Policies, please submit an enhancement request via the Broadcom Ideation Portal.

To speak with a customer representative or a Support Engineer see Contact Support. Scroll to the bottom of the page and click on your respective region.