OU Passwords What they all mean

What is a password Webster’s Online Dictionary describes a password as “a sequence of characters required for access to a computer system” ( OU passwords are associated with an OUNetID and allow access to all of the secure IT services.

Security OU passwords should be 5 to 8 characters – Special characters are allowed (e.g. [ & $ ! < / ) – The only requirement is that you cannot have a as the leading character in a password. Passwords are not perfectly secure and can be cracked. – To prevent this from happening, it is recommended that passwords use the full 8 characters and include lower and upper case letters, numbers and special characters.

Security (continued) Passwords should not be something that is easily guessed (e.g. spouses name, birthday, boomer or sooner, pet’s name) There are also word lists of pop culture subjects (e.g. all the planets in Star Trek or different types of ships in Star Wars). So it is ill advised to use a term from pop culture (or even the dictionary) as your password.

Security (continued) In an effort to prevent hackers from trying multiple passwords until they find the correct password, OU accounts on the Sooner domain will become “locked” after several failed attempts at logging into a resource. – When an account becomes locked, it is inaccessible to the customer until they contact the Helpdesk and we unlock their account.

Just one password? OU IT currently maintains several password stores – NT domains (admin, academic, sooner, ou, ounet, image) – Oracle – Old LDAP – New LDAP – CICS/TSO – Sybase – Newsgroups

NT Domain Passwords The NT 4.0 Domain Controllers store information about the computers that attach to it There are several other NT Domains on campus that IT does not maintain (SATTRN, HOUSING, ATHLETIC). The passwords for the NT domains are separate from the other passwords and do not necessarily synchronize with the other password stores – This might result in a customer having more than one password associated with their OUNet ID

Sooner Domain This is the Active Directory (AD) password. The AD domain controllers are just a big LDAP server that stores lots of things. Whenever someone connects to the Sooner domain, the password they enter is verified against that stored in domain controller.

Oracle Oracle is a database that is eventually going to feed everything – That is, once you put someone into Oracle, they will eventually get populated into all the other databases The password stored in this database is changed via the SupportTool

LDAP Lightweight Directory Access Protocol – It’s a big database to store user info LDAP is a well accepted protocol and is easy to access – For example, if you want to use password security for a web service, this would be a good protocol to which to connect A more thorough description is on the next two screens.

LDAP (continued) LDAP (Lightweight Directory Access Protocol) is a software protocol for enabling anyone to locate organizations, individuals, and other resources such as files and devices in a network, whether on the public Internet or on a corporate intranet. LDAP is a "lightweight" (smaller amount of code) version of Directory Access Protocol (DAP), which is part of X.500, a standard for directory services in a network. LDAP is lighter because in its initial version it did not include security features. LDAP originated at the University of Michigan and has been endorsed by at least 40 companies. Netscape includes it in its latest Communicator suite of products. Microsoft includes it as part of what it calls Active Directory in a number of products including Outlook Express. Novell's NetWare Directory Services interoperates with LDAP. Cisco also supports it in its networking products. In a network, a directory tells you where in the network something is located. On TCP/IP networks (including the Internet), the domain name system (DNS) is the directory system used to relate the domain name to a specific network address (a unique location on the network). However, you may not know the domain name. LDAP allows you to search for an individual without knowing where they're located (although additional information will help with the search).protocolInternetintranetX.500 directoryActive DirectoryTCP/IPDNS source:

LDAP (continued) An LDAP directory is organized in a simple "tree" hierarchy consisting of the following levels: – The root directory (the starting place or the source of the tree), which branches out toroot directory – Countries, each of which branches out to – Organizations, which branch out to – Organizational units (divisions, departments, and so forth), which branches out to (includes an entry for) – Individuals (which includes people, files, and shared resources such as printers) An LDAP directory can be distributed among many servers. Each server can have a replicated version of the total directory that is synchronized periodically. An LDAP server is called a Directory System Agent (DSA). An LDAP server that receives a request from a user takes responsibility for the request, passing it to other DSAs as necessary, but ensuring a single coordinated response for the user. source:

LDAP (continued) IT currently maintains a primary LDAP server – Chewy This server is part of the new POP main system and will become the primary LDAP server to which people connect Customer can access this server by using either ldapv3.ou.edu (the preferred method) or ldap.ou.edu.

CICS/TSO These passwords are used to access either CICS or TSO (via either the SNA client or Host On Demand). – This allows the user to interact with the mainframe – These passwords cannot start with a number – This password can never be reset to a password previously used by the customer

Sybase Sybase is the old database system that we use. It gets its information from the mainframe and pushes it to Oracle and OUsql the Exchange System Current plans are to get rid of this database in the near future. Within 2-3 years we should only have Oracle, LDAP, and SOONER.

How is the password changed? The SupportTool calls scripts from a couple of different places to change the NT passwords; it also connects to a stored procedure in Oracle to change the Oracle password.

Exchange Passwords Exchange passwords authenticate against trusted NT domains (Admin, Academic, Athletic, Sooner, et al)

Passwords The POP system authenticates passwords against the new LDAP system (Chewy).

Password Sources Oracle SoonerLDAP Sybase Propagates to