0

我想了解 ACL 在 Tivoli Identity Manager 中的工作原理。我正在尝试从用户控制台请求服务上的空调但收到错误：

" 无法提交请求，因为同步密码不符合管理服务的密码规则。请更改或重置同步密码以符合以下密码规则。"

我已将配置策略中的默认密码设置为“12345”，密码策略中的密码长度从 0 到 8，并在 ACL 中授予“添加”操作，但仍然不知道我在做什么错。请建议

以下是 ITIM 默认身份策略下的规则。

function createIdentity()  {   
var EXISTING_CASE=0;   
var UPPER_CASE=1;   
var LOWER_CASE=2;   
var tf = false;   
var identity = "";   
var baseidentity = "";   
 var counter = 0;   
var locale = subject.getProperty("erlocale");   
var fAttrKey = "uid";   
var sAttrKey = "";   
var idx1 = 0;   
var idx2 = 0;   
var fCase = 2;   
var sCase = 2;   
if ((locale != null) && (locale.length > 0)) {     
 locale = locale[0];   
}
if (locale == null || locale.length == 0)
locale = "";   
 var firstAttribute = "";   
 var secondAttribute = "";   
 if (((fAttrKey != null) && (fAttrKey.length > 0)) || ((sAttrkey != null) &&     (sAttrkey.length > 0))) {
 if ((fAttrKey != null) && (fAttrKey.length > 0)) {       
firstAttribute = subject.getProperty(fAttrKey);       
if (((firstAttribute != null) && (firstAttribute.length > 0)))         
 firstAttribute = firstAttribute[0];       
 if (firstAttribute == null || firstAttribute.length == 0)          
 firstAttribute = "";       
 else {         
 firstAttribute=IdentityPolicy.resolveAttribute(fAttrKey,firstAttribute);         
 if ((idx1>firstAttribute.length) || (idx1==0))            
   idx1=firstAttribute.length;         
 firstAttribute = firstAttribute.substring(0,idx1);       
 }       
if (fCase == UPPER_CASE)         
 firstAttribute = firstAttribute.toUpperCase(locale);       
 else if (fCase == LOWER_CASE)          
 firstAttribute = firstAttribute.toLowerCase(locale);     
}     
if ((sAttrKey != null) && (sAttrKey.length > 0)) {       
secondAttribute = subject.getProperty(sAttrKey);       
 if (((secondAttribute != null) && (secondAttribute.length > 0)))          
 secondAttribute = secondAttribute[0];       
 if (secondAttribute == null || secondAttribute.length == 0)          
 secondAttribute = "";       
 else {         
 secondAttribute=IdentityPolicy.resolveAttribute(sAttrKey,secondAttribute);         
 if ((idx2>secondAttribute.length) || (idx2==0))            
   idx2=secondAttribute.length;         
 secondAttribute = secondAttribute.substring(0,idx2);       
 }       
 if (sCase == UPPER_CASE)          
 secondAttribute = secondAttribute.toUpperCase(locale);       
 else if (sCase == LOWER_CASE)          
 secondAttribute = secondAttribute.toLowerCase(locale);     
 }     
 baseidentity = firstAttribute + secondAttribute;   
 }   
 if ((baseidentity == null) || (baseidentity.length == 0)) {     
var givenname = subject.getProperty("givenname");     
 if (((givenname != null) && (givenname.length > 0)))        
 givenname = givenname[0];     
  if(givenname == null || givenname.length == 0)        
 givenname = "";     
 else        
  givenname = givenname.substring(0,1);     
  baseidentity = givenname + subject.getProperty("sn")[0];   
  }   
  tf = IdentityPolicy.userIDExists(baseidentity, false, false);   
 if (!tf)      
 return baseidentity;   
  while (tf) {     
 counter+=1;     
  identity = baseidentity + counter;     
  tf = IdentityPolicy.userIDExists(identity, false, false);   
 }   
 return identity; 
 }  

 return createIdentity();
4

1 回答 1

0

I am going to assume when you are requesting access you don't already have an account for the service. Hence, it is trying to create a new account for that service before provisioning the access. When the new account is created, it will use the password from the identity for the service if you have global password synchronization turned on.

The password set on the identity (erSynchPassword) does not meet the password requirements for the individual service. Try changing the password on the identity and make sure that the password meets the service's password requirements. Or, temporarily for testing, disable the password policy that applies to that service and attempt to request access.

If this is a development question, personally I would disable all password policies temporarily to determine if the problem is really a password policy issue. That is the easiest way to troubleshoot the error you are seeing.

于 2014-10-10T19:22:58.720 回答