Password Management through PWM

Abstract

There have been many initiatives around open source identity and access management, federated authentication standards and products for the web. All of these products and standards require a user store with credential information. Most often this is an LDAP directory. The most common type of credentials still is the combination of a username and a password. Even though passwords have downsides and many alternatives to passwords exist [QRP], passwords are still here and probably will be for a long time. Passwords are forgotten and lost or expire due to password policies, requiring actions to reset or update passwords. People forgetting or losing their passwords is not just a problem for the people themselves, but also for your organization. Lost passwords result in cost and risk for your organization. A password management system can help reducing these risks and cost. PWM is a feature rich password management web application for LDAP, written in Java and JavaScript and published under the GNU GPLv2 license. PWM can help your organization by providing end user self service and supporting help desks in assisting their end users. The product has many features, including those that allow for better verification of the user’s identity, enforcing secure password and detect brute force attacks. The version currently under development has many new and useful features and lots of improvements. The presentation will show a short history of PWM and demonstrate how PWM’s rich featureset can help your organization improving password management.