Uniform password

Last modified by Ondřej Kopr on 2026/09/09 13:06

Which feature do you need?

Uniform password is an umbrella name for several related features. They are easy to confuse with each other, so start by picking the one you actually need:

Password synchronization from an external system - a password changed on a workstation (typically in Active Directory) is sent to IdM and distributed to the other connected systems.
One password through all connected systems - one password change (from IdM or from an external system) is applied to all systems in the same uniform password definition. This is the behaviour configured in the uniform password agenda.
Password filter - dll library - the Active Directory component that sends the password change to IdM.
Uniform password for new accounts - a separate feature (@since 11.0.0) that gives one password to all accounts of an identity created within a single synchronization run.

None of these features can unify passwords of accounts that are created at different times. IdM never stores a password in plain text, so for an account created later it has nothing to reuse - such an account always gets its own generated password. If you need one password on two systems, either set the password (instead of generating it), or change the password once after both accounts exist.

Password synchronization from external system to IdM

Since version 10.5.0 CzechIdM allows to synchronize a password from an external system. Passwords can be synchronized for example from Active Directory. Password synchronization helps standard users a lot, because they do not need to change their password on every system that they use separately. They simply change the password on their own workstation. The external system sends the password change request to IdM and IdM takes care of the rest of the password change process -> distribution of the password to the next systems like AD, Open LDAP, card system, ... .

CzechIdM prevents cycles between password synchronization and a classic password change with the ECHO system.

More about the password synchronization can be found there.

One password through all connected systems

The uniform password feature simplifies the password change form for basic CzechIdM users and always enforces that the password is changed through all systems in the given uniform password definition.

Combined with password synchronization, the uniform password is a powerful tool that allows one password through all systems connected to IdM.

More about one password through all systems can be found there.

Password filter - dll library

The password filter is a useful Active Directory extension which provides a way for common MS Windows users to change their password in the standard way (ctrl + alt + del) and have this new password propagated to IdM. Depending on the IdM configuration, the new password may be propagated into other related systems and thus keep a unified password on them. An integral part is also the validation whether the new password meets all password policies. More about the password filter dll library for AD can be found there.

Uniform password for new accounts

The goal of the uniform password for new accounts is to make sure that an identity whose accounts are all created within a single synchronization run gets one password for all of them, and one notification instead of one notification per account.

This is a different feature than the uniform password agenda described above. It is bound to the creation of an account during a synchronization, not to a password change, and it does not apply to accounts created manually, from a role request, or at a different time.

More about this you can find here.