Mass Updating/Changing SSOP passwords

I haven't tried it, but I think you can do that with loadusers by specifying the SSOPPASSWORD element in the USERDATA node in the XML file. You can also do it with an XML file loaded via ssoconfig.

Hi John,
Thanks for the suggestion.
I tried a POC with an xml file and a handful of users and it worked.
1. ssoconfig -c
2. Type in your security password
3. Choose 5
4. Choose 5 again and point to the xml file
5. Proceed...

ssoconfig can also generate a sample input file to be used.

Next step for me now is to write a program that will generate this xml file and then run ssoconfig.

Thanks for your help.

I have done this using loadusers. The one limitation to using this utility is that you are restricted to either: 1) assigning all users in the XML file the same password, or 2) defaulting all users in the XML file a passwords that are the same as their user names. The way around this is to create and load a separate XML file for each user. Although this sounds tedious, it's not all that difficult to write a script that creates the XML file and loads it.

I used Python for the script that I wrote, but you ought to be able to use any language. I chose Python because it was already required on the system, and the XML module is included in the core language. Creating the XML file is a snap:

Sample XML file to use with SSOCONFIG

To give credit where due, Andrew Provines from Ciber gave me the idea for doing this, and I worked to find the minimum data required to change passwords en masse. SSOCONFIG seems to be the easiest tool to use for this.

This will change marka2's Portal password to pwd123: 

(see first attachment)

Or, you can combine those into a single line, making it easier to use in a spreadshseet, so you can change thousands of passwords to individual values. This does it for 3 users (the display probably wraps, but it's a single line for each user):

(see second attachment)


The description below expands a bit on what shashank wrote above, which is how to use this XML file:

STEPS To update passwords in the Lawson LDAP:

1. From the ssoconfig main menu (ssoconfig -c), type “5” to select “Manage Lawson Services.”

2. At the next menu, type “5” to select “Load service and identity file.”

3. At the prompt “Enter identity file name” prompt, type the file path and name of the XML file.
For example, c:/mypath/my_xml_file.xml

4. At the prompt “Override existing identities?” select ”1” for Yes.

5. You will be prompted to choose the format for credential information.
Select “3” for Plain Text.

I was able to load between 5 and 10 passwords per second this way. It takes a few minutes to load thousands, but is far more secure than giving everyone the same password!

I am moving this to the security forum. Also, be on the lookout for an upcoming LawsonGuru Letter article on generating a "password reset" XML file using ProcessFlow Integrator and the ResourceQuery node.

Along similar lines to this request - does anyone know of a way to automatically require each User to change their password on a timely basis (say 90 days)?

You can't do that within LSF9; you would need to 'bind' to an LDAP that supports it, like Active Directory.