Identity and Access Management

Dir Identity V9.0
Secure and flexible Password Management
The Password Management solution for any organization
The challenges of password
usage
Due to the increasing password proliferation users will have to remember more and more passwords withthe risk that passwords are forgotten
frequently. When a password is forgotten the password reset is mostoften done via the service desk. This
results in high service desk costs
especially when the password resetis requested outside office hours.
Also, password resets cause major
service desk call spikes after public
holidays or after the weekend.
For security and compliancy reasons organizations tend to introduce
stronger password policies resulting
in increasing password complexity
with the consequence that passwords are forgotten more often. So,
there is a delicate balance between
security and compliancy on one
hand and the number of password
reset and related service desk costson the other hand.

For this reason, there is a very strong
demand for self-service password
reset that allows an organization to
enforce stronger password policies
but takes away the password related
service desk costs. From the userside there is a strong demand to havean instant password reset function
anytime, anywhere.
In case users do not have directaccess to target systems to reset
their passwords, a password management solution should support
service desk staff to perform an
assisted password reset on requestof the user. This requires that service
desks agents are supported to properly authenticate users.
As users are required to login with
one password per each IT application
users must remember a lot of different passwords, one for each systemthey need to use. As a result, users
tend to write down their passwords
or to select easy-to-guess passwords
which in turn puts system security at
risk. To reduce the number of passwords users have to manage, there
is also a strong need to synchronize passwords. This helps users tomanage only one single password
based on a single password policy
across multiple IT systems.

Shared, privileged accounts haveadditional requirements in terms ofpassword management and password usage as privileged accounts
are not related to one specific user.
Privileged accounts are often usedby different administrators. Passwords of privileged accounts should
be set by the system, disclosed toadministrators when needed andchanged after use.
To manage consistent password
policies a password management
solution requires password policy
management functionality that also
enforces the defined policies whenusers select new passwords.
To help ensure and document regulatory compliance or to support
billing requirements, audit andreporting functionality is needed tosupport both administrators and service desk staff.
DirX Identity addresses these challenges by providing a password
management solution with a comprehensive feature set.

Feature Overview
DirX Identity Password Management
offers the following features:• Self-service password reset: Users
reset forgotten passwords or
unlock accounts using alternative
credentials.
• Assisted password reset: Administrators or service desk staff reset
forgotten passwords or unlock
accounts for users.
• Password expiration: Remind
users to change their passwords
before they expire.
• User enrollment: Users select andanswer security questions (alsoknown as authentication or challenge questions) as alternative credentials.

Figure 1 - DirX Identity Password Reset - User Dialog via Web Center• Password Listener for Windows:
Catch password changes from
Windows desktop.

fewer service desk calls and fewer
login problems.

• Password synchronization: Synchronize password changes totarget systems in real-time.
• Password policy management:
Manage and enforce rules for complexity, expiration and history of
passwords.
• Privileged account password management: Manage and control
access to passwords for sharedprivileged accounts.
• Audit and reporting: Keep trackrecords of password-related
actions and generate reports.
Eviden also offers Password Resetas a Service to provide end users a
simple and instant way to reset theirpassword or to unlock their account.

Benefits
DirX Identity Password Management
provides the following benefits forusers and organizations:• Enhanced user experience, i.e.,
fewer passwords to remember,
only a single user interface to deal
with, consistent password policies,
early password expiration notifications.
• Seamlessly fits in the enterprise
Identity and Access Management
landscape.

Self-Service Password Reset
DirX Identity Password Management
offers password reset functionality tousers via a Web user interface and a
Windows client.
By default, DirX Identity Password
Reset is provided for Microsoft Active
Directory. Optionally, other target
environments can be supported.
To reset a password, a user is required
to authenticate using alternative credentials. After a positive authentication the password can be changed• Provides end users with a quick
and flexible way to reset their password or to unlock their account.
• Significant reduction of service
desk costs through self-service
and assisted password reset andpassword synchronization.

• Improved user productivity due to

2 | DirX Identity V9.0 Password Management

Authentication Options
DirX Identity Password Reset supports the following options for alternative authentication:• Smart card authentication• Answering security questions• Mobile OTP (One-Time Password)
If security questions are used foralternative authentication, a user
first needs to define the personal setof security questions. After that, theself-service password reset can beused. The number of questions thatneed to be set up and the number ofquestions that need to be answeredis flexible and depends on the security policy of the organization.
Password Reset via Web Center
The Password Reset Web Center canbe accessed via a standard browser.
In the case of a forgotten password,
users may no longer be able to login
to use a browser. In this case, a kiosk
system or a browser session from acolleague must be used.
Through the Web Center interface,
users can:• Strengthened security throughfewer passwords for users toremember, enforcement of strong
password policies, various authentication options, documentation ofpassword-related actions via audit
and reporting.
• Reduced number of passwords
to be managed by users throughpassword synchronization.

for the account(s) that the user isauthorized to. The new password thatis entered will be validated against
the password policy of the user.

• Change their own passwords.
• Reset forgotten passwords byauthenticating with security questions.
• Manage the personal set of security questions.
Figure 2 - DirX Identity
Password Reset using the
DirX Password Reset Client• First time users can register andlogon with their AD password andsetup security questions.
• Change or reset the passwords foronly a subset of their accounts they
have in target systems.
• Monitor the password change
status (pending, succeeded, or
failed) for each of the accounts
they have selected.

Self -service

Windows
DomainController
Password
Password
Password
Listener
Listener
Listener

Password Reset via DirX Password Reset Client
The DirX Password Reset Client(DXPRC) is a Windows client thatmust be deployed on a user’s Microsoft Windows system.
DXPRC can be accessed and used
before logon to Windows (after ctrlalt-del) via an extra option in the login
screen. The advantage of this userinterface is that the password reset
can be done directly from the workstation of the user.

Atos Password
Reset Client

Password change
from desktop

others apps

Web Services

Assisted

Web Center
Audit

DirX Identity
DirX Directory

Report

Sync

ActiveDirectory

OTP

Sync

On -boarding
TargetSystemTargetSystemDirX
Audit

TargetSystemSMS Service

Figure 3 - DirX Identity Password Management Architecture

The DirX Password Reset Client(DXPRC) of fers a configurable
deployment mode for selecting
alternative authentication methods:

Directory account and by selecting
security questions and providing
answers via the Web Center userinterface. Administrators can configure whether users can define theirown security questions or just selectfrom the list of predefined questions.

synchronized to the users’ accounts
in the appropriate target systems.
Preconfigured password synchronization workflows are provided to perform the password synchronization.

• Smart card authentication

Onboarding/offboarding of users

Administrators or service desk staff
can define password policies compliant with application password policies in the enterprise. They determine
password length and complexity,
password aging, password history,
behavior of the system after failed
logins and password reuse after expiration.

• Security questions• Mobile OTP• Any combination of these options.

Assisted Password Reset
For the service desk, DirX Identity
provides additional features to support users who do not have directaccess to IT systems. Through the
Web Center interface, service desk
agents can:• Reset users’ passwords on request.
They can validate users by challenging their attributes or security
questions.
• Create and maintain password
policies that control how passwords are used and administeredin the enterprise, such as password
length and complexity, password
aging, and password reuse after
expiration.
• Create reports on password
changes and resets.

Password Expiration
DirX Identity Password Management
optionally reminds users to change
their passwords before they expire
by regularly checking for user passwords that are about to expire andby informing the affected users by
e-mail notification. The number of
notifications to be sent is configurable.

User Enrollment
First time users enroll to the system
by registering with their Active

Both onboarding of users i.e. initialload of the user population to the
DirX Identity system and adding
users to the system and offboarding
i.e. deleting users from the systemis accomplished via the identity
management functionality of DirX
Identity. Synchronization services
maintain an accurate and up-to-dateidentity store of identities which areallowed to use password reset functionality.

Windows Password Listener
The Windows Password Listenercatches the user password changes
in a Windows domain, encrypts theinformation and generates password
change events. These trigger the
event manager and the corresponding password change workflows tosynchronize changed password to
the connected target systems.
The Windows Password Listeneris suitable for supported Microsoft
Windows Server systems.

Password Synchronization
DirX Identity Password Management
allows users to maintain a single
password that will be automaticallysynchronized with Microsoft Active
Directory and optionally to other relevant IT systems, where the user has
accounts.
This event-driven, real-time password
synchronization service ensures thatpassword changes made from the
Web Center interface or from theWindows system are immediately

Password Policy Management

Privileged AccountPassword Management
In addition to accounts that are
related to just one specified identity(user), target systems typically hold asmall number of privileged accounts
that are entitled to target systemmanagement. Such accounts, as forexample the root account in UNIXsystems, are allowed to performcritical actions in the target systemwith a high security risk. Privileged
accounts are not related to a specificuser. Several persons can use themin parallel.
DirX Identity provides means to control and audit password usage ofprivileged accounts:• Users that are assigned to privileged accounts can read the password in clear text to perform thelogin action.
• They are also entitled to change thepassword of privileged accounts.
• Removal of a user from a privileged
account automatically enforces apassword change.
• Alternatively, one can define thatassignment of a user to a privileged account copies his certificates to the account. This allows
DirX Identity V9.0 Password Management | 3

authentication via certificates at
the target system side.
• DirX Identit y automaticallychanges all expired privileged
account passwords.

Audit and Reporting
To help ensure and document regulatory compliance and to support billing, DirX Identity keeps track recordsof password-related actions via its
audit trail mechanism. Standard
reports are provided, such as:• Number of registered users forpassword management• Users with all properties• Users with compact password
management history• Users with password management• Users with password management history• Users with privilege hierarchy• Users without privileges
Both the audit trails and reports are
configurable and customizable tobest suit customer requirements.

Architecture
DirX Identity Password Management builds on the core features ofthe product DirX Identity and on the
product DirX Directory that serves as
the configuration and user repository.
DirX Identity Password Management
uses the agents and connectors of
the connectivity framework of DirX
Identity to implement the password
reset functionality for the connected
systems. DirX Audit can be used forcentralized, secure storage, analysis, correlation, and review of password-related audit logs.
DirX Identity
DirX Identity provides a comprehensive, process-driven, customizable,
cloud-ready, scalable and highly
available identity management
solution for enterprises and organizations. It delivers risk-based identityand access governance functionality
seamlessly integrated with automated provisioning. Features include
life-cycle management for users androles, cross-platform and rule-based
provisioning in real-time, Web-baseduser self-service and delegatedadministration, request workflows,
access certification, password management, meta directory and auditing and reporting.

4 | DirX Identity V9.0 Password Management

DirX Directory
DirX Directory provides a standards-compliant, high-performance,
highly available, highly reliable andsecure LDAP and X.500 directory
server with very high linear scalability. DirX Directory can act as the identity store for employees, customers,
trading partners, subscribers, andother e-business entities.
DirX Audit
DirX Audit provides auditors, security compliance officers and administrators with analytical insight andtransparency for identity and access.
Based on historical identity data andrecorded events from the identityand access management processes,
DirX Audit allows answering the‘‘what, when, where, who and why’’questions of user access and entitlements.
DirX Audit features historical views
and reports on identity data, agraphical dashboard, a monitor for
identity-related events and job management for report generation. With
its analytical features, DirX Audit
helps enterprises and organizations
to ensure sustainable complianceand provide business intelligence
for the identity and access management processes.

Security
The authentication and authorization
mechanisms of the respective LDAP
directory allow protecting attributes
and passwords. DirX Identity provides additional security features:

their related answers can be stored
in strong encrypted mode in the
Identity store. DirX Identity guarantees that data transfer and logging
is secure up to the interface of theconnected target directory.

Password Reset as a Service
In addition to the password management functionality provided withthe product DirX Identity, Eviden alsooffers Password Reset as a Service
to provide end users a simple andinstant way to reset their password
or to unlock their account.
The Password Reset Service can beoffered as a
• Shared service• Customer dedicated service on
Eviden premises• Customer dedicated service on
customer premises
The Eviden Password Reset Services
is provided for both Microsoft Active
Directory and optionally for otherenvironments.
Password Reset as a Service provides several additional benefits tocustomers:• Provides a high level of agility rapid deployment• All-inclusive approach - avoids
upfront HW/SW investments - no
CAPEX
• Technology agnostic - customer
can focus on functionality insteadof technology• External and internal access• All components can optionallywork in SSL/TLS mode when using
LDAP connections.

• Multiple target platforms supported• Data transfer via the messaging
service can be encrypted to provide high security during networktransfer.

• 24*7*365 available: anytime-anywhere• Passwords, security questions and• Password reset and unlock

System Requirements
Hardware

SoftwareUser interface• Intel server platform forMicrosoft Windows Server• DirX Identity V9.0

• English• Red Hat Enterprise Linux• DirX Audit V7.1 or newer• SUSE Linux Enterprise Server
Memory Requirements:
Main memory:

minimum 8 GB

Disk Space:		minimum 4 GB plus
disk space for data

• DirX Directory V8.9 or newer
For DirX Identity Web Center/
Web Admin/Server Admin• Mozilla Firefox 78 or newer• Google Chrome 96 or newer• Microsoft Edge 96 or newer• Web Center: English/German/customizable• DXPRC: English/German/customizable

Documentation• DirX Identity documentation• DirX Directory documentation

For DirX Password Reset Client• Microsoft Windows 10 64-bit• Microsoft Windows 11 64-bitUserinterface

DirX Identity V9.0 Password Management | 5

DirX Product Suite
The DirX product suite provides the basis for fully integrated identityand access management; it includes the following products, which canbe ordered separately.

DirX Identity
DirX Identity provides a comprehensive, process-driven,customizable, cloud-enabled, scalable, and highly available identity management solution for businesses andorganizations. It provides overarching, risk-based identity and access governance functionality seamlessly
integrated with automated provisioning. Functionality includes lifecycle management for users and roles,
cross-platform and rule-based real-time provisioning,
web-based self-service functions for users, delegatedadministration, request workflows, access certification,
password management, metadirectory as well as auditing and reporting functionality.

DirX Directory
DirX Directory provides a standards-compliant, high-performance, highly available, highly reliable, highly scalable,
and secure LDAP and X.500 Directory Server and LDAP
Proxy with very high linear scalability. DirX Directory canserve as an identity store for employees, customers, partners, subscribers, and other IoT entities. It can also serve asa provisioning, access management and metadirectory
repository, to provide a single point of access to the information within disparate and heterogeneous directories
available in an enterprise network or cloud environment
for user management and provisioning.

DirX Access
DirX Access is a comprehensive, cloud-ready, scalable,
and highly available access management solution providing policy- and risk-based authentication, authorization based on XACML and federation for Web applications
and services. DirX Access delivers single sign-on, versatile authentication including FIDO, identity federation
based on SAML, OAuth and OpenID Connect, just-intime provisioning, entitlement management and policy
enforcement for applications and services in the cloud or
on-premises.

DirX Audit
DirX Audit provides auditors, security compliance officers and audit administrators with analytical insight andtransparency for identity and access. Based on historical identity data and recorded events from the identityand access management processes, DirX Audit allows
answering the “what, when, where, who and why” questions of user access and entitlements. DirX Audit features
historical views and reports on identity data, a graphicaldashboard with drill-down into individual events, an analysis view for filtering, evaluating, correlating, and reviewing of identity-related events and job management forreport generation. With its analytical features, DirX Audit
helps enterprises and organizations to ensure sustainable
compliance and provide business intelligence for the riskbased identity and access management processes.

Eviden is a registered trademark © Copyright 2023, Eviden SAS – All rights reserved.

DS-230613-GW-DirX_Identity_V9.0_Password_Management_Datasheet_EN