Release Notes
IBM® Security® Identity Manager
Desktop Password Reset Assistant (DPRA)
Version 7.0.15
This edition applies to version 7.0 of IBM Security Identity Manager and to all subsequent releases and modifications until otherwise indicated in new editions.
Copyright
International Business Machines Corporation 2003, 2016. All rights reserved.
US Government Users Restricted Rights -- Use, duplication or disclosure
restricted by GSA ADP Schedule Contract with IBM Corp.
Contents
Component Features and Purpose
Installation and Configuration Notes
Welcome to the IBM Security Identity Manager Desktop Password Reset Assistant
These Release Notes contain information for the following products that was not available when the IBM Security Identity Manager manuals were printed:
The Desktop Password Reset Assistant (DPRA) software allows a Windows user to perform self-service password resets and self-service unlocks from their workstation. The DPRA software performs these functions even if the user has forgotten their Windows password and is unable to log in to their Windows account on their workstation.
The DPRA is distributed as a Credential Provider module and is easily installed on the user’s Windows login desktop.
The DPRA software provides the following benefits:
ü Self-service password change and synchronization of all accounts
ü Self-service Windows password unlock without a password change
ü Self-service password reset (generated password) emailed to you and configured contact
ü Authentication via secure Challenge/Response features of Identity Manager
ü Translated user interface and support for double-byte languages
ü Customizable UI with support for company logos and backgrounds
ü Installation via GUI installer
ü Optional integration with TAM ESSO through TAM ESSO Assistant
ü Compatible with deployment tools such as Tivoli Provisioning Manager or Microsoft SMS
|
Component |
Version |
|
Release Date |
2019 September 11 18.52.13 |
|
Assistant Version |
7.0.15 |
|
Component Versions |
N/A |
|
Documentation |
Identity Manager Desktop Password Reset Assistant Installation and User. Available at the IBM Security Identity Manager Information Center
|
|
Enhancement # (FITS) |
Description |
|
|
Items included in 7.0.15 release |
|
TS002249123 |
Added
support to allow unlocking accounts when password sync is enabled and show
accounts is disabled |
|
|
Items included in 7.0.11 release |
|
40136 (80676) 39417 (78542) |
Desktop Password Reset Assistant - Unlock option only to show windows accounts |
|
30316 (55937) |
GINA reset entered text on wrong answers |
|
internal |
Added support for TLS 1.1 and 1.2 |
|
|
Items included in 6.0.10 release |
|
internal |
Allow limiting the languages displayed in the language drop down. |
|
internal |
Add registry value to disable the account selection screen when password synch is enabled |
|
internal |
Add registry value to disable the account unlock option |
|
63261 |
DPRA accessibility – Language dropdown |
|
63262 |
DPRA accessibility – Select accounts list |
|
63263 |
DPRA accessibility – Top navigation |
|
|
Items included in 6.0.9 release |
|
65478 |
Added Turkish language string table |
|
|
Items included in 6.0.6 release |
|
61370 |
Color contrast issue |
|
59927 |
Provide a text area on DPRA screen for user instructions |
|
62119 |
French DRPA displays error codes in English |
|
|
Items included in 6.0.5 release |
|
61221 |
Identify Yourself text is misaligned |
|
|
Items included in 6.0.4 release |
|
51145 |
Added support for “unlock only” when password synchronization is enabled on the ISIM server |
|
42148 |
Added timeout capability. Defaults to 1 minute. Set to custom value with registry value “TimeoutMS” in milliseconds |
|
42150 |
Updated account selection to remove radio buttons for selecting all accounts and added a checkbox to the column header to select/unselect all. |
|
42156 |
Added updated version number to installer package to show correct version number in Windows control panel |
|
|
Items included in 6.0.3 release |
|
|
Added support for custom string files in multiple languages. The file names used for the language specific files are “DPRA_str_xx.txt”, where “xx” is the language identifier. If no language specific file is found, the DPRA will still look for DPRA_str.txt. |
|
Internal# |
APAR# |
PMR# / Description |
|
|
|
|
Items closed in 7.0.14 version |
|
|
|
TS001410024 |
Unable to customize DPRA link string |
|
|
|
|
Items closed in 7.0.13 version |
|
|
|
TS001410024 |
DPRA in endless loop on Windows 10 (build 1709) with more than 7 languages installed |
|
|
|
|
Items closed in 7.0.11 version |
|
|
internal |
|
Fixed stack overflow crash on 32 bit systems
|
|
|
|
|
Items closed in 6.0.10 version |
|
|
|
IV71756 |
DPRA Turkish keyboard cannot be set
|
|
|
|
IV65716 |
DPRA on French Windows pc shows English label
|
|
|
|
IV65460 |
Unexpected back button behavior in DPRA
|
|
|
|
IV62661 |
WRONG FILE NAMES SPECIFIED IN DPRA INSTALL AND CONFIG GUIDE. |
|
|
|
|
Items closed in 6.0.9 version |
|
|
44402,057,649 |
|
DPRA Accessibility - JAWS doesn't read language dropdown value.
|
|
|
|
|
Items closed in 6.0.8 version |
|
|
43929,057,649 |
|
DPRA keyboard layout changes French > English
|
|
|
44342,057,648 |
|
French link sometimes displays for English workstation
|
|
|
44341,057,649 |
|
On DPRA 6.0.7 DPRA is a beta drop, customer is observing accessibility issues with error pop-up box not taking focus.
|
|
|
|
|
Items closed in 6.0.7 version |
|
|
|
|
DPRA on French Windows switches keyboard layout to English.
|
|
|
|
|
DPRA doesn't take focus from locked Windows screen and DPRA doesn't check for other instances of itself..
|
|
|
|
|
DPRA - Status bar messages disappear after popup message box.
|
|
|
|
|
Items closed in 6.0.6 version |
|
|
|
IV65716 |
DPRA on French Windows PC shows English Label on first start.
|
|
|
|
|
Items closed in 6.0.5 version |
|
|
|
IV65460 |
DPRA Back button doesn't work as expected.
|
|
|
|
|
Items closed in 6.0.4 version |
|
|
|
IV52856 |
The word “Static” shows in the background in the upper left corner of DPRA dialog
|
|
|
|
IV52857 |
Unexpected results of accounts selection page if going back to the page/view in DPRA
|
|
|
|
IV59283 |
Submit button disabled after clicking Back and Next
|
|
|
|
IV59511 |
Duplicate credential in Remote Desktop window
|
|
|
71363,100,838 |
|
|
|
|
|
|
Items closed in 6.0.3 version |
|
|
|
IV51798 |
DPRA Template file not matching up with the documentation
|
|
|
|
IV52080 |
When “All Accounts” is selected during DPRA password reset, this is changing password of more than just displayed AD and Windows accounts
|
|
CMVC# |
APAR# |
PMR# / Description |
|
|
|
Installation on German OS Versions If the installer language is set to Deutsch, the DPRA installer may not properly display the text entry box required for entry of the IP address of the ITIM server. Depending on the default font size, the text box may be pushed off the right edge of the form.
This issue affects only the installation of DPRA. The end user operation in Deutsch is not affect.
|
|
|
|
Strings not Translated The following strings have been added to this release and have not been translated from English. The work-around is to manually translate and replace the string in DPRA_str.txt as described in the “Customizing the UI Strings” section of this document.
10009 "Challenge/Response not configured for this user" 20024 "Unlock account request successfully issued to ITIM" 20025 "Unlock request failed"
|
The DPRA now clears all responses when revisiting the challenges. If an incorrect response is giving you are returned to the start screen and must enter the user ID again. This was done for security purposes.
Chapter 4
The following text is incorrect.
“Your options depend on whether password synchronization is enabled or disabled. If enabled, you see only your Windows accounts and the Unlock only button is enabled. If password synchronization is disabled, the Unlock only button is disabled. Your choice is to enter a new password.”
The opposite is true. When password synchronization is disabled, you will have the option to Unlock only. When password synchronization is enabled, the Unlock only option is disabled.
==================================================================
Change to Unlock functionality
The unlock functionality has been moved to the account selection screen. When you check the “Unlock selected accounts” checkbox, the “Next” button will change to “Submit”. Clicking “Submit” will issue unlock requests to the selected accounts and DPRA will close.
The password screen now only has fields for entering the new password.
==================================================================
Change to registry configuration
The following configuration items have been added:
Inactivity Timeout
You can configure the amount of time the DPRA remains inactive before it times out and closes itself. The value is given in milliseconds. By default, the inactivity timeout is 60000 milliseconds ( 1 minute ).
Table 8. TimeoutMS string details
|
Key |
HKEY_LOCAL_MACHINE\SOFTWARE\IBM\ISIM\ChallengeResponse |
|
String |
TimeoutMS |
|
Value |
60000 |
Keyboard mapping
When you select a different language, the DPRA will load the associated keyboard map for that language. This key allows you to disable the keyboard mapping. If this is set to true, when a new language is selected, only the text associated with that language is used and the keyboard mapping is not changed.
Table 8. NoKeyboardMapping string details
|
Key |
HKEY_LOCAL_MACHINE\SOFTWARE\IBM\ISIM\ChallengeResponse |
|
String |
NoKeyboardMapping |
|
Value |
false |
Allow selected unlock requests when Password Synch is enabled
When password synchronization is enabled on the ISIM server, you will only have the option to set a new password for all of the accounts owned by the ISIM user. The “Unlock selected accounts” option is not shown. This setting allows you to select accounts to be unlocked even if password synchronization is enabled on the ISIM server. Note that this is only valid for Windows accounts. Since all accounts are shown when password synchronization is enabled, there may be non-Windows accounts displayed. Attempting to unlock a non-Windows account will result in an internal error response from the ISIM server.
Table 8. AllowPasswordSynchUnlock string details
|
Key |
HKEY_LOCAL_MACHINE\SOFTWARE\IBM\ISIM\ChallengeResponse |
|
String |
AllowPasswordSynchUnlock |
|
Value |
false |
Skip account selection when password synchronization is enabled
This setting allows you to skip the account selection screen when password synchronization is enabled. When password synchronization is enabled all accounts are automatically selected. The account selection screen is only informational to allow you to see which accounts will be affected. To simplify password resets for end users, this screen can be skipped when password synchronization is enabled by setting this to false.
Table 8. AllowPasswordSynchUnlock string details
|
Key |
HKEY_LOCAL_MACHINE\SOFTWARE\IBM\ISIM\ChallengeResponse |
|
String |
PasswordSynchShowAccounts |
|
Value |
true |
Disable account unlock function
This setting allows you to disable the account unlock function. The checkbox for selecting account unlock is not displayed. Only password resets are allowed. The Windows Active Directory Adapter can be configured to automatically issue an account unlock when passwords are changed.
Table 8. AllowPasswordSynchUnlock string details
|
Key |
HKEY_LOCAL_MACHINE\SOFTWARE\IBM\ISIM\ChallengeResponse |
|
String |
AllowAccountUnlock |
|
Value |
true |
==================================================================
Starting with version 6.0.10, the DPRA is now implemented as
a property sheet wizard. This has affected the title bitmap images.
The title bitmap should be 48 x 552 pixels. On Windows 8.1 and Windows
10, the dialog is rendered with different dimensions. On those systems
the title bitmap should be 39 x 449 pixels. The customization examples
have been updated with sample bitmaps. DPRA_title.bmp (
48 x 552) and DPRA_title_small.bmp ( 39 x 449 ).
Supported Languages
Starting with version 6.0.10, the list of languages in the language selection list only contains languages that have the corresponding dll file installed in system32. By default all supported languages are installed. If you wish to limit the languages shown in the language list, you can simply remove the language dll files from system32. The language file names are in the format ItimCR_xx.dll, where ‘xx’ is the two letter code for the language.
Installation and Configuration Notes
See the IBM Security Desktop Password Reset Assistant Installation Guide for detailed instructions.
The following configuration notes apply to this release:
See the IBM Security Desktop Password Reset Assistant Installation Guide for detailed instructions.
|
Warning or error message |
Recommended Action |
|
Internal error on ISIM sever- OPERATION_NOT_ALLOWED |
Ensure that user has privilege in order to unlock their accounts without password change. Either create new ACI (or modify existing) that has a permission for "Account Locked out". To verify this explore Set System Security --> Change Access Control Items --> Permissions. |
The IBM Security Identity Manager Desktop Password Reset Assistant was built and tested on the following product versions.
Assistant Installation Platform:
Installable on the 32 or 64-bit versions of the following Operating systems on x86 or x64 compatible CPU:
Windows 7
Windows 8.x
Windows Server 2016
Windows Server 2019
Windows 10
Managed Resource:
N/A
IBM Security Identity Manager:
Identity Manager 6.0
Identity Manager 7.0
This information was developed for products and services offered in the U.S.A. IBM may not offer the products, services, or features discussed in this document in other countries. Consult your local IBM representative for information on the products and services currently available in your area. Any reference to an IBM product, program, or service is not intended to state or imply that only that IBM product, program, or service may be used. Any functionally equivalent product, program, or service that does not infringe any IBM intellectual property right may be used instead. However, it is the user's responsibility to evaluate and verify the operation of any non-IBM product, program, or service.
IBM may have patents or pending patent applications covering subject matter described in this document. The furnishing of this document does not give you any license to these patents. You can send license inquiries, in writing, to:
IBM Director of Licensing
IBM Corporation
North Castle Drive
Armonk, NY 10504-1785 U.S.A.
For license inquiries regarding double-byte (DBCS) information, contact the IBM Intellectual Property Department in your country or send inquiries, in writing, to:
IBM World Trade Asia Corporation
Licensing
2-31 Roppongi 3-chome, Minato-ku
Tokyo 106-0032, Japan
The following paragraph does not apply to the United Kingdom or any other country where such provisions are inconsistent with local law: INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Some states do not allow disclaimer of express or implied warranties in certain transactions, therefore, this statement may not apply to you.
This information could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein; these changes will be incorporated in new editions of the publication. IBM may make improvements and/or changes in the product(s) and/or the program(s) described in this publication at any time without notice.
Any references in this information to non-IBM Web sites are provided for convenience only and do not in any manner serve as an endorsement of those Web sites. The materials at those Web sites are not part of the materials for this IBM product and use of those Web sites is at your own risk.
IBM may use or distribute any of the information you supply in any way it believes appropriate without incurring any obligation to you.
Licensees of this program who wish to have information about it for the purpose of enabling: (i) the exchange of information between independently created programs and other programs (including this one) and (ii) the mutual use of the information which has been exchanged should contact:
IBM Corporation
2ZA4/101
11400 Burnet Road
Austin, TX 78758 U.S.A.
Such information may be available, subject to appropriate terms and conditions, including in some cases, payment of a fee.
The licensed program described in this information and all licensed material available for it are provided by IBM under terms of the IBM Customer Agreement, IBM International Program License Agreement, or any equivalent agreement between us.
Any performance data contained herein was determined in a controlled environment. Therefore, the results obtained in other operating environments may vary significantly. Some measurements may have been made on development-level systems and there is no guarantee that these measurements will be the same on generally available systems. Furthermore, some measurements may have been estimated through extrapolation. Actual results may vary. Users of this document should verify the applicable data for their specific environment.
Information concerning non-IBM products was obtained from the suppliers of those products, their published announcements or other publicly available sources. IBM has not tested those products and cannot confirm the accuracy of performance, compatibility or any other claims related to non-IBM products. Questions on the capabilities of non-IBM products should be addressed to the suppliers of those products.
The following terms are trademarks or registered trademarks of International Business Machines Corporation in the United States, other countries, or both:
IBM
IBM logo
WebSphere
Adobe, Acrobat, Portable Document Format (PDF), and PostScript are either registered trademarks or trademarks of Adobe Systems Incorporated in the United States, other countries, or both.
Cell Broadband Engine and Cell/B.E. are trademarks of Sony Computer Entertainment, Inc., in the United States, other countries, or both and is used under license therefrom.
Java and all Java-based trademarks are trademarks of Sun Microsystems, Inc. in the United States, other countries, or both.
Microsoft, Windows, Windows NT®, and the Windows logo are trademarks of Microsoft Corporation in the United States, other countries, or both.
Intel®, Intel logo, Intel Inside®, Intel Inside logo, Intel Centrino™, Intel Centrino logo, Celeron®, Intel Xeon™, Intel SpeedStep®, Itanium®, and Pentium® are trademarks or registered trademarks of Intel Corporation or its subsidiaries in the United States and other countries.
UNIX is a registered trademark of The Open Group in the United States and other countries.
Linux is a trademark of Linus Torvalds in the U.S., other countries, or both.
ITIL® is a registered trademark, and a registered community trademark of the Office of Government Commerce, and is registered in the U.S. Patent and Trademark Office.
IT Infrastructure Library® is a registered trademark of the Central Computer and Telecommunications Agency which is now part of the Office of Government Commerce.
Other company, product, and service names may be trademarks or service marks of others.
End of Release Notes