Password management is one of the most problematic areas in managing a user's identity and environment.
For example,
- According to Gartner, if a 10,000-employee company automated password-resetting alone, help-desk calls can drop by one-third and the firm could save US$648,000 each year.
- According to Burton Group, studies show the management of passwords cost US$200 to US$300 per user, per year
Password management includes the following areas:
- Password Policy and Enforcement
- Password Reset
- Provisioning Passwords on New Accounts
- Password Synchronization
- Credential Mapping
Activate Password Reset
Activate has a self-service enabled Password Reset function that allows users to reset their passwords. There are different options that can be implemented depending upon the organizations requirements.
Shared Secrets
This option involves the user pre-registered answers to some questions about themselves that can then be used to reset their password.
Manager
This option allows the user to reset their password, but the new password is emailed to the users manager. They must then contact the Manager to obtain the new Password.
Other
Activate allows just about any business process to be designed. Therefore other password reset options are also possible.
Provisioning Passwords on New Accounts
Activate has the ability to generate passwords for new accounts in any fashion. There are two sample password generation functions provided, others can be scripted simply and easily.
- Generate a random sequence of lowerCase, upperCase and Numeric digits. For example, "Qu8Kl976".
- Pick a random word for a list and append a random number. For example, "chair45".
Password Synchronization
Password Synchronization is the process of maintaining a common password between multiple systems. Activate can perform this task when passwords are reset and changed via the web site. To facilitate this, it is possible with Active Directory (AD) to disable the standard password change functionality.
There are many options for enabling password synchronization in more complex environments. Some of the free products from Microsoft include:
Activate enhances these products by enabling the ability to configure and set attributes that allow these systems to work.
Credential Mapping
Credential mapping is an alternative to Password Synchronization. This technology maps an Active Directory account to a known account and password in the external system. There are a number of advantages to this approach including:
- Users do not have to remember passwords for all external systems
- Users do not have to change passwords on all external systems
- Passwords do not have to be the same across all systems
Activate can enable Credential Mapping by configuring mapping between local and remote accounts and setting and maintaining the passwords.
See Also