To ensure that Identity Manager does not propagate user password changes to Directory Server but instead only propagates them to Active Directory, and then relies on Identity Synchronization for Windows to propagate them to Directory Server, the following form property can be added to any form used for changing a user's password. This will prevent a resource from being displayed in the table of resources where password changes occur.
<Properties\> <Property name='Exclude'\> <list\> /<new class='com.waveset.object.AttributeCondition'\> <s\>id</s\> <s\>equals</s\> <s\>#ID#50D9481DC6C43026:3BB34:FFB73A9286:-7FC0</s\> </new\>/ </list\> </Property\> </Properties\>
The resource can be excluded by id as shown in the form above, name (a string), or by type (also a string). The forms to which this property must be included are:
Change My Password Form
Change Password Form
Expired Login Form
Tabbed User Form
Some of the forms above already include the form property. In such scenarios, only the new attribute condition needs to be added from the XML fragment above.
In multiple attribute condition scenarios, the forms are and'ed together (they cannot be or'ed). For example, if the Change My Password form and Change Password form already include an attribute condition to exclude disabled resources, and the condition above is added, a resource will only be excluded if it meets both conditions, that is, it is disabled and has the ID you entered.