What role does NMAS play in synchronizing passwords in an Identity Manager solution?

NMAS (Novell Modular Authentication Service) is the core enforcement engine for Universal Password policies within the Identity Vault (eDirectory). Its role in password synchronization is twofold. First, it manages the password change process itself; when a user changes a password, the request is processed by NMAS, which enforces policies and then generates the event that the Identity Manager engine uses to initiate synchronization. Second, a critical function of NMAS is to block legacy, non-Universal Password-aware utilities from directly modifying the password attribute. This prevents bypasses of the official process, ensuring that all password changes are captured by the Identity Manager engine for reliable synchronization to connected systems.

A. This is incomplete. While NMAS is central to the password change process within the vault, this option omits its critical role in preventing legacy utilities from bypassing the process.

B. This is incorrect. NMAS operates exclusively within the Identity Vault (eDirectory), not in connected systems. The Identity Manager drivers control the flow to connected systems.

C. This is incomplete. Preventing legacy utilities from bypassing the process is a key function, but this option omits the primary role of NMAS in processing the password change itself.

E. This is incorrect. It wrongly claims that NMAS controls the flow of synchronization in a connected system, a function handled by the Identity Manager drivers.

1. Micro Focus, NetIQ Identity Manager 4.8.5 Policies in Designer, Section 6.1, "Understanding Password Synchronization," Page 101.

"For password synchronization to work, you must enable the Universal Password policy on the Identity Vault. When Universal Password is enabled, Novell Modular Authentication Service (NMAS) is also enabled. NMAS prevents legacy utilities that are not Universal Password-enabled from updating an eDirectory password directly. NMAS controls the flow of password synchronization. When a user changes a password, NMAS is notified. NMAS then notifies the Identity Manager engine, which in turn notifies the drivers."

This official documentation directly supports both clauses of option D, stating that NMAS controls the flow and prevents legacy utilities from bypassing the process.

2. Micro Focus, NetIQ eDirectory 8.8 SP8 Administration Guide, Chapter 20, "Passwords," Section "Universal Password," Page 485.

"Universal Password leverages Novell Modular Authentication Services (NMAS™) to provide a secure, extensible, and powerful authentication framework... Because all password modifications are required to go through NMAS, this allows for a single point of administration and control for all password and authentication-related events."

This reference establishes that NMAS is the mandatory channel for all password modifications when Universal Password is active, which is the foundation for reliable synchronization.