Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-110204

RFE: Enable external password reset agents to use ipa_pwd_extop in RHEL IdM

Linking RHIVOS CVEs to...Migration: Automation ...SWIFT: POC ConversionSync from "Extern...XMLWordPrintable

    • ipa-4.12.2-27.el10
    • None
    • 1
    • rhel-idm-ipa
    • 13
    • 15
    • 1
    • QE ack, Dev ack
    • False
    • False
    • Hide

      None

      Show
      None
    • Yes
    • IPA: RHELs for 10.2 and 9.8
    • Feature
    • Hide
      Feature, enhancement: LDAP system accounts
      IdM now provides the ability to configure external password reset agents

      Reason: When integrating IdM with external applications that do not support kerberos authentication, it is now possible to define a system account for the external application that may be granted password reset privileges and authenticates using LDAP.

      Result: External applications can now integrate their own secure password reset solutions with IdM

      Show
      Feature, enhancement: LDAP system accounts IdM now provides the ability to configure external password reset agents Reason: When integrating IdM with external applications that do not support kerberos authentication, it is now possible to define a system account for the external application that may be granted password reset privileges and authenticates using LDAP. Result: External applications can now integrate their own secure password reset solutions with IdM
    • Proposed
    • Unspecified
    • Unspecified
    • Unspecified
    • None

      Goal

      As an IdM administrator, I want to configure external password reset agents (e.g., CyberArk) to use the ipa_pwd_extop mechanism, so that privileged password resets can be performed securely without forcing users to change their password at next login

      Acceptance criteria

      Acceptance criteria

      • Verify that an external agent can authenticate with a privileged DN.
      • Verify that the agent can reset a user’s password using ipa_pwd_extop.
      • Verify that the user is not forced to reset their password upon next login.
      • Verify that audit/logging records the reset action.
      • Verify that documentation clearly explains setup and security best practices.

              frenaud@redhat.com Florence Renaud
              ftrivino@redhat.com Francisco Trivino Garcia
              Florence Renaud Florence Renaud
              Anuja More Anuja More
              Votes:
              0 Vote for this issue
              Watchers:
              9 Start watching this issue

                Created:
                Updated: