Novell Identity Manager 4.0.1 Installation guide

Novell
Brand
Novell
Model
Identity Manager 4.0.1
Category
Network management software
Type
Installation guide
www.novell.com/documentation
Role Mapping Administrator
Installation and Configuration Guide
Identity Manager 4.0.1
December 08, 2011
Legal Notices
Novell,Inc.makesnorepresentationsorwarrantieswithrespecttothecontentsoruseofthisdocumentation,andspecifically
disclaimsanyexpressorimpliedwarrantiesofmerchantabilityorfitnessforanyparticularpurpose.Further,Novell,Inc.
reservestherighttorevisethispublicationandtomakechangestoitscontent,at
anytime,withoutobligationtonotifyany
personorentityofsuchrevisionsorchanges.
Further,Novell,Inc.makesnorepresentationsorwarrantieswithrespecttoanysoftware,andspecificallydisclaimsany
expressorimpliedwarrantiesofmerchantabilityorfitnessforanyparticularpurpose.Further,Novell,Inc.reservestheright
to
makechangestoanyandallpartsofNovellsoftware,atanytime,withoutanyobligationtonotifyanypersonorentityof
suchchanges.
AnyproductsortechnicalinformationprovidedunderthisAgreementmaybesubjecttoU.S.exportcontrolsandthetrade
lawsofothercountries.Youagreeto
complywithallexportcontrolregulationsandtoobtainanyrequiredlicensesor
classificationtoexport,re‐exportorimportdeliverables.Youagreenottoexportorre‐exporttoentitiesonthecurrentU.S.
exportexclusionlistsortoanyembargoedorterroristcountriesasspecifiedintheU.S.
exportlaws.Youagreetonotuse
deliverablesforprohibitednuclear,missile,orchemicalbiologicalweaponryenduses.SeetheNovellInternationalTrade
ServicesWebpage(http://www.novell.com/info/exports/)formoreinformationonexportingNovellsoftware.Novellassumes
noresponsibilityforyourfailuretoobtainanynecessaryexportapprovals.
Copyright©2007‐2011
Novell,Inc.Allrightsreserved.Nopartofthispublicationmaybereproduced,photocopied,storedon
aretrievalsystem,ortransmittedwithouttheexpresswrittenconsentofthepublisher.
Novell, Inc.
1800 South Novell Place
Provo, UT 84606
U.S.A.
www.novell.com
OnlineDocumentation:ToaccessthelatestonlinedocumentationforthisandotherNovellproducts,seetheNovell
DocumentationWebpage
(http://www.novell.com/documentation).
Novell Trademarks
ForNovelltrademarks,seetheNovellTrademarkandServiceMarklist(http://www.novell.com/company/legal/trademarks/
tmlist.html).
Third-Party Materials
Allthird‐partytrademarksarethepropertyoftheirrespectiveowners.
Contents 3
Contents
About This Guide 5
1 Overview 7
1.1 How Role Mapping Works . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7
1.2 Role Mapping Administrator. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .9
1.3 Identity Vault Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
1.4 System Access. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .10
1.5 Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .10
1.6 Authorization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .10
1.7 Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11
1.8 Role Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11
2 Meeting Prerequisites and System Requirements 13
2.1 Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
2.2 System Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .13
2.3 Installing the iManager Plug-Ins for Identity Manager 4.0.1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .14
2.4 Granting Rights to the Role Mapping Administrator. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .15
2.4.1 Identity Vault Rights for Administration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .15
2.4.2 Roles Based Provisioning Module Assignments for Administration. . . . . . . . . . . . . . . . . . .16
2.4.3 Required Rights for the Role Mapping Administrator . . . . . . . . . . . . . . . . . . . . . . . . . . . . .16
3 Installing the Role Mapping Administrator 17
3.1 Installing the Role Mapping Administrator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
3.2 Installing the Role Mapping Administrator in Silent Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .18
3.3 Reconfiguring the Role Mapping Administrator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .19
3.3.1 Changing the Port Number . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .19
3.3.2 Changing the Password. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .19
4 Configuring the Application 21
4.1 Providing Identity Vault Connection Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .21
4.2 Configuring the Drivers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .23
4.3 Loading Authorizations into the Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .24
4.4 Enabling SSL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .24
4.4.1 Enabling an SSL Connection from the Role Mapping Administrator to the Identity
Vault. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .25
4.4.2 Enabling SSL for a Browser to Access the Role Mapping Administrator. . . . . . . . . . . . . . .26
4.5 Configuring the Role Mapping Administrator for Automatic Startup. . . . . . . . . . . . . . . . . . . . . . . . . .26
4.5.1 Linux . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .26
4.5.2 Windows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .27
4.6 Changing the Java Heap Size . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .27
4 Contents
5 Changing the Configuration 29
6 Configuring Authentication 31
6.1 Configuring Single Sign-On Through the Roles Based Provisioning Module. . . . . . . . . . . . . . . . . . .31
6.1.1 Enabling the Roles Based Provisioning Module for Single Sign-On . . . . . . . . . . . . . . . . . .31
6.1.2 Creating a Shared Page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .32
6.1.3 Assigning Permissions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .32
6.1.4 Selecting Content . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
6.2 Configuring Single Sign-On Through Access Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .33
6.2.1 Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
6.2.2 Configuring Active Directory to Assign Kerberos Tickets . . . . . . . . . . . . . . . . . . . . . . . . . .34
6.2.3 Configuring the Access Manager Identity Server to Consume the Kerberos Tickets . . . . . 36
6.2.4 Configuring the User’s Web Browser. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
7 Enabling Auditing 43
7.1 Configuring the Role Mapping Administrator Auditing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .43
7.1.1 Default Values of Role Mapping Administrator Auditing Configuration . . . . . . . . . . . . . . . .44
7.1.2 Examples of Role Mapping Administrator Auditing Configuration . . . . . . . . . . . . . . . . . . .44
8 Security Best Practices 45
8.1 Tuning Session Timeouts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .45
A Role Mapping Administrator Audit Events 47
A.1 Event ID 00031550 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .47
A.2 Event ID 00031551 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .48
A.3 Event ID 00031630 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .49
A.4 Event ID 00031631 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .49
A.5 Event ID 00031632 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .50
A.6 Event ID 00031633 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .51
A.7 Event ID 00031634 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .52
A.8 Event ID 000361635 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .52
A.9 Event ID 00031670 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .53
A.10 Event ID 00031671 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
A.11 Event ID 00031674 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
A.12 Event ID 00031675 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
A.13 Event ID 00031676 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
A.14 Event ID 00031677 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
A.15 Event ID 0003167A . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .57
A.16 Event ID 0003167B . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .58
About This Guide 5
About This Guide
ThisguideprovidesinstallationandconfigurationinstructionsfortheNovellIdentityManagerRole
MappingAdministrator.Theguideisorganizedasfollows:
InstallationInformation:
Chapter 1,“Overview,”onpage 7
Chapter 2,“MeetingPrerequisitesandSystemRequirements,”onpage 13
Chapter 3,“InstallingtheRoleMappingAdministrator,”onpage 17
ConfigurationInformation:
Chapter 4,“ConfiguringtheApplication,”onpage 21
Chapter 6,
“ConfiguringAuthentication,”onpage 31
Chapter 7,“EnablingAuditing,”onpage 43
Chapter 8,“SecurityBestPractices,”onpage 45
Audience
Thisguideisintendedforpartners,consultants,andcustomerswhoareveryfamiliarwiththe
productsintheNovellComplianceManagementPlatformextensionforSAPenvironments.
Feedback
Wewanttohearyourcommentsandsuggestionsaboutthismanualandtheotherdocumentation
includedwiththisproduct.PleaseusetheUserCommentsfeatureatthebottomofeachpageofthe
onlinedocumentationandenteryourcommentsthere.
Documentation Updates
ForthemostrecentversionoftheNovellIdentityManagerRoleMappingAdministratorInstallationand
ConfigurationGuide,visittheIdentityManager4.0.1DocumentationWebsite(http://
www.novell.com/documentation/idm401).
Additional Documentation
FordocumentationontheNovellComplianceManagementPlatform,seetheNovellCompliance
ManagementPlatformDocumentationWebsite( http:// www.novell.com/documentation/ncmp10/
index.html).
FordocumentationontheIdentityManagerRolesBasedProvisioningModule,seetheIdentity
ManagerRolesBasedProvisioningModule4.0.1DocumentationWebsite(http:// www.novell.com/
documentation/idmrbpm401/index.html).
FordocumentationontheSAPdrivers,seethe
IdentityManager4.0.1DriversDocumentationWeb
site(http://www.novell.com/documentation/idm401drivers/index.html).
6 Identity Manager Role Mapping Administrator 4.0.1 Installation and Configuration Guide
FordocumentationonAccessManager,seetheAccessManager3.1DocumentationWebsite(http://
www.novell.com/documentation/novellaccessmanager31/index.html).
FordocumentationonSentinel,seetheSentinel6.1DocumentationWebsite(http://www.novell.com/
documentation/sentinel61/index.html).
FordocumentationontheSAPConnector,SAPCollector,andtheSAPSolutionPack,seetheSentinel
6.1downloadWebsite(http://support.novell.com/products/sentinel/secure/sentinel61.html).
1
Overview 7
1
Overview
TheNovellIdentityManagerRoleMappingAdministratorletsyoumaproles,compositeroles,and
profiles(collectivelyreferredtoasauthorizations)toIdentityManagerroles.Whenauserisassigned
anIdentityManagerroleintheRolesBasedProvisioningModule,heorshereceivesall
authorizationsmappedtothatrole.
Thefollowing
sectionsprovideinformationyoushouldunderstandbeforeinstallingandconfiguring
theRoleMappingAdministrator:
Section 1.1,“HowRoleMappingWorks,”onpage 7
Section 1.2,“RoleMappingAdministrator,”onpage 9
Section 1.3,“IdentityVaultAccess,”onpage 9
Section 1.4,“SystemAccess,”onpage 10
Section 1.5,“Authentication,”onpage 10
Section 1.6,“Authorization,”onpage 10
Section 1.7,“Database,”onpage 11
Section 1.8,“RoleManagement,”onpage 11
1.1 How Role Mapping Works
TheRoleMappingAdministratorisonepartoftheNovellrolemappingsolution.Itisdependenton
theproperinstallationandconfigurationofallrolemappingcomponents.Therolemappingprocess
isexplainedinFigure1‐1.
8 Identity Manager Role Mapping Administrator 4.0.1 Installation and Configuration Guide
Figure 1-1 HowtheRoleMappingAdminist ra torWorks
1. TheRoleMappingAdministratorconnectstotheIdentityVaultandreadstheIdentityManager
rolesstoredinthevault.
2. TheRoleMappingAdministratorretrievesthemanagedsystemauthorizationsbyusingthe
managedsystemdrivertoquerythemanagedsystems.Theretrievedmanagedsystem
authorizationsareaddedtotheRoleMappingAdministrator
database.
3. AuseroftheRoleMappingAdministratormapsauthorizationstooneormoreIdentity
Managerroles.Whenanauthorizationismappedtoarole,aresourceiscreatedandupdatedto
reflecttheauthorizationmapping.TheroleisupdatedintheIdentityVaulttomaptothenewly
createdresource.
IMPORTANT:InearlierversionofRoleMappingAdministrator,rolesweremappeddirectlyto
theauthorizations.Withthisreleaseonwards,resourcesareintroduced.Rolesaremappedto
resourcesthatareinturnaremappedtoauthorizations.Whenyoucreateamappingbetweena
roleandanentitlement/authorization,resourcesareautomaticallycreated
intheRoleMapping
Administrator.
Overview 9
Resourcesprovidetheabilityforenduserstorequestprovisioningofauthorizationsfor
themselvesorforusersthattheyhavearelationshipwith.WithRoleMappingAdministrator
1.0,userscouldnotunderstandwhattheyrequestedorthestatusofwhattheyhadrequested.
Providinganinterfacethatconveysthisinformationis
criticaltothesuccessoftheproduct.
Resourcesprovidetheabilityforadministratorstogainbettercontroloverthemanagementof
useraccesstoentitlements/authorizations,ensuringthattherightpeoplehavetherightaccessto
therightresources.
4. AuserisassignedtheroleintheRolesBasedProvisioningModule,atwhichpointtheRole
Servicedrivergrantstheuseranauthorizationtoallmanagedsystemauthorizationsthatare
mappedtotherole.
5. Themanagedsystemdriverrespondstotheentitlementgrantbyinitiatingtheauthorization
assignmentinthemanagedsystem.
1.2 Role Mapping Administrator
TheRoleMappingAdministratorisaWebapplication.Allcomponentsrequiredfortheapplication
areincludedintheinstallationfile,includingaTomcatapplicationserverandanHSQLdatabase.See
Chapter 2,“MeetingPrerequisitesandSystemRequirements,”onpage 13fortheapplication’s
systemrequirements.
1.3 Identity Vault Access
TheRoleMappingAdministratorrequiresaccesstotheIdentityVault.ThisenablestheRole
MappingAdministratortoperformtherequiredIdentityVaultoperations,including:
AuthenticatinguserswhologintotheRoleMappingAdministratorandestablishingtheir
authorizationlevel.TheusersshouldhavebothResourceAdministratorandRoleAdministrator
roles.
RetrievingrolesinformationtodisplayiftheauthenticateduserisaRoleModuleAdministrator.
IftheauthenticateduserisaRoleMa nager,theRoleMappingAdministratorusestheuser’s
credentialstodisplayroles.
Creatingresourceswiththeselectedauthorization/entitlementandmappingthemwiththe
IdentityVaultrole.
Accessinginformationstoredon
theIdentityManagerdriverobjecttobuildthequeriesrequired
toretrieveauthorizationsfrommanagedsystems.
Sendingthequeriestothe IdentityManagerdrivers.
Creating,editing,anddeletingroles.
Formoreinformation,seeSection 2.4,“GrantingRightstothe RoleMappingAdministrator,”on
page 15.
IMPORTANT:Becausenowarningsaredisplayedintheuserinterface,youmustnotperformany
modificationsonthemappingsunlessyouaresureaboutwhatyouaredoing.
role_mappi
n
10 Identity Manager Role Mapping Administrator 4.0.1 Installation and Configuration Guide
1.4 System Access
TheRoleMappingAdministratordoesnotrequiredirectaccesstothemanagedsystems.All
authorizationsareretrievedthroughtheIdentityManagerdriversthatsupporttheRoleMapping
Administrator.
WhentheRoleMappingAdministratorconnectstotheIdentityVault,itautomaticallydetectsthe
IdentityManagerdriversconfiguredinthevault.TheRole
MappingAdministratordisplayseach
systemconnectedviaadriverandallowsyoutoretrieveauthenticationsfromanyofthosesystems.
ForalistofthesupportedIdentityManagerdrivers,seeChapter 2,“MeetingPrerequisitesand
SystemRequirements,”onpage 13.
1.5 Authentication
TheRoleMappingAdministratorusestheIdentityVaulttoauthenticateusers.Accessisrestrictedto
IdentityVaultuserswhoaredefinedasboth ResourceAdministratorsandRoleAdministratorsinthe
RolesBasedProvisioningModuleapplication.
YoucansetupRoleMappingAdministratorauthenticationthroughthefollowingmethods:
Directlogin:Theuser
providescredentials(usernameandpassword)ontheRoleMapping
Administratorloginpage.
Singlesign‐onthroughtheRolesBasedProvisioningModule:ARoleMappingAdministrator
linkisaddedtotheRolesBasedProvisioningModule.Whenauserclicksthelink,theRoles
BasedProvisioningModulepassestheuser’scredentialstothe
RoleMappingAdministrator.
Singlesign‐onthroughAccessManager:AccessManagerprovidestheuserʹscredentials
(usernameandpasswordorSAMLtoken)totheRoleMappingAdministratorthroughAccess
ManagerIdentityInjection.Theuserisnotpromptedforanycredentialinformation.
Forinformationonhowtoconfiguresinglesign‐on,see
Chapter 6,“ConfiguringAuthentication,”on
page 31.
1.6 Authorization
OnlyuserswhoaredefinedasRoleAdministrators,RoleManagers,ResourceAdministrators,and
ResourceManagersintheRolesBasedProvisioningModulecanlogintotheRoleMapping
Administrator.Afterauserisloggedin,theusercanperformonlythetasksassociatedwith hisorher
assignedrole:
Overview 11
Table 1-1 AllowedOperationsforVariousRolesinRMA
NOTE:Restrictedaccessmeansread‐onlyaccesstorolesandmappingsinRoleMapping
Administrator.
Forinformation,seeSection 2.4,“GrantingRightstotheRoleMappingAdministrator,”onpage 15.
1.7 Database
TheRoleMappingAdministratorusesHSQLDB,alightweight100%JavaSQLdatabase,tostore
authorizationsthatitretrievesfromthemanagedsystems.ThisallowstheRoleMapping
Administratortoquicklydisplayauthorizationsformapping.
Themanagedsystemauthorizationsmustbemanuallyloadedintothedatabase.Youcanselect
whichauthorizationsyou
wantloadedforeachsystemconnectedthroughasupportedIdentity
Managerdriver.Aftertheauthorizationshavebeenloadedintothedatabase,authorizationsmustbe
manuallyrefreshedtoreflectanynewauthorizationsinthemanagedsystems.
IdentityManagerrolesarenotstoredintheRoleMappingAdministratordatabase.TheRole
MappingAdministrator
readsanddisplaystherolesdirectlyfromtheIdentityVault.
1.8 Role Management
Inadditiontomappingroles,theRoleMappingAdministratorcancreatenewIdentityManager
roles,editexistingroles,andremoveexistingroles.Whenyoucreateanewrole,youcanaddtherole
tothecorrectcategory,giveitalevellocation,andassignowners.
Role Allowed Operation in RMA
roleAdministrator, resourceAdministrator Unrestricted access.
Create mappings
Edit mappings
Delete mappings
roleAdministrator, resourceManager Restricted access
roleManager, resourceAdministrator Restricted access
roleManager, resourceManager Restricted access
12 Identity Manager Role Mapping Administrator 4.0.1 Installation and Configuration Guide
2
Meeting Prerequisites and System Requirements 13
2
Meeting Prerequisites and System
Requirements
Section 2.1,“Prerequisites,”onpage 13
Section 2.2,“SystemRequirements,”onpage 13
Section 2.3,“InstallingtheiManagerPlug‐InsforIdentityManager4.0.1,”onpage 14
Section 2.4,“GrantingRightstotheRoleMappingAdministrator,”onpage 15
2.1 Prerequisites
VerifythatthefollowingprerequisiteshavebeenmetbeforeinstallingtheRoleMapping
Administrator:
InstallandconfigureIdentityManager4.0.1.Formoreinformation,seethe IdentityManager4.0.1
InstallationGuide(http://www.novell.com/documentation/idm401/idm_install/
index.html?page=/documentation/idm40/idm_install/data/front.html).
InstallandconfiguretheRolesBasedProvisioningModule.Formoreinformation,seetheRoles
BaseProvisioningModuleInstallationGuide(http://www.novell.com/documentation/idmrbpm401/
install/data/bcy2k2j.html).
YoumusthaveupdatediManagerplug‐insandanupdatedDesignerinordertomanagethese
newdrivers.
InstallDesigner4.0.1
InstalltheiManagerplug‐insforIdentityManager4.0.1
InstallandconfigurethesupportedIdentityManagerdrivers.Youcanhaveoneormoreofeach
supporteddriver.
OnlytheIdentityManager3.6.1,4.0,orlaterdriversaresupported.TheycanrunonIdentity
Manager3.6,3.6.1,or4.0orlater.Forinstallationinstructions,seetheseguidesatIdentity
Manager3.6.1
Drivers(http://www.novell.com/documentation/idm361drivers/)andIdentity
Manager4.0.1Drivers(http://www.novell.com/documentation/idm401drivers/).
GrantuserssufficientrightstousetheRoleMappingAdministrator,sotheycanloginanduse
theapplication.Forinstructions,seeSection 2.4,“Gra ntingRightstotheRoleMapping
Administrator,”onpage 15.
Resourceswillbecreatedwiththeselectedauthorization/entitlementandmappedtotherole
2.2 System Requirements
ThefollowingisthelistofsystemrequirementsfortheRoleMappingAdministrator.Onlyone
instanceoftheRoleMappingAdministratorcanbeinstalledperserver.
14 Identity Manager Role Mapping Administrator 4.0.1 Installation and Configuration Guide
2.3 Installing the iManager Plug-Ins for Identity Manager 4.0.1
InordertomanagedriverswithstructuredGCVs,youmustinstalltheiManagerplug‐insforIdentity
Manager4.0.1.
1 LaunchiManagerandlog inasanadministrativeuser.
2 Onthetoolbar,clicktheConfigureicon .
3 ClickPlug‐inInstallation>AvailableNovellPlug‐inModules.
4 SelectNovellIdentityManagerPlug‐insfor4.0,thenclickInstall.
5 SelectIAgreeinthelicenseagreement,thenclickOK.
6 Aftertheinstallationfinishes,clickClosetwice.
7 LogoutofiManagerandrestartTomcattohavethechangestakeeffect.
or
1 IftheNovellIdentityMana gerPlug‐insfor4.0.1arenotinthelist,downloadtheIdentity
Manager4.0plug‐insforiManager2.7fromtheNovellproductdownloadWebsite(http://
download.novell.com)toyouriManagerserver.
2 LaunchiManagerandlog inasanadministrativeuser.
3 Onthetoolbar,clicktheConfigureicon .
4 ClickPlug‐inInstallation>AvailableNovellPlug‐inModules.
5 ClickAdd.
6 BrowsetoandselecttheIdentityManager
.npm
file,thenclickOK.
7 Aftertheinstallationfinishes,clickClosetwice.
8 LogoutofiManagerandrestartTomcattohavethechangestakeeffect.
System Component Requirement
Role Mapping Administrator SUSE Linux Enterprise Server 10 SP3 32 and 64-bit, SUSE Linux
Enterprise Server 11 32 and 64-bit, Windows Server 2003 SP2 32-bit, or
Windows 2008 R2 64-bit, Red Hat Enterprise Linux 5.4 32 and 64-bit
Web Browser Microsoft Internet Explorer 7, 8, and 9
Mozilla Firefox 3.5, Firefox 3.6.x, and Firefox 5.x
Java Sun JRE 1.6
Meeting Prerequisites and System Requirements 15
2.4 Granting Rights to the Role Mapping Administrator
UsersmusthaveaspecificsetofrightsintheIdentityVaultandspecificroleassignmentsintheRoles
BasedProvisioningModuletousetheRoleMappingAdministrator.
ThebestpracticeistocreateauserthatisusedforadministrationoftheRoleMapping
Administrator.Allotherusersthatuse
theRoleMappingAdministratorshouldhavetheirrights
limitedtomatchtheirjobduties.
Section 2.4.1,“IdentityVaultRightsforAdministration,”onpage 15
Section 2.4.2,“RolesBasedProvisioningModuleAssignmentsforAdministration,”onpage 16
Section 2.4.3,“RequiredRightsfortheRoleMapping Administrator,”onpage 16
2.4.1 Identity Vault Rights for Administration
AnadministrativeuserneedsthefollowingminimalrightstousetheRoleMappingAdministrator:
BrowseentryrightssotheycanselectobjectsintheconfigurationpaneloftheRoleMapping
Administrator.Forexample,theRootUsercontainer,DriverDiscoveryDN,andtheUser
ApplicationdriverDN.
Browseentryandreadrights
ontheuserscontainedwithintheRootUsercontainerdefinedin
theconfigurationpaneloftheRoleMappingAdministrator.Thelistofpotentialroleownersis
derivedbytheserights.
BrowseentryrightsontheactiveDriverSetobjectthatislocatedundertheDriverDiscoveryDN
asdefinedin
theRoleMappingAdministratorconfigurationpanel.
Inheritedbrowserightsandreadattributerightsonthedriversthatparticipateinrolemapping.
TheRoleMapping Administratorneedsaccesstotheentitlementsandentitlementconfiguration
objectsthatarecontainedwithinthedriversthatparticipateinrolemapping.
Inheritedbrowseentryandreadattribute
rightsontheUserApplicationdriver.TheRole
MappingAdministratorneedsaccesstoDALcategorydefinitions,roleconfigurationobjects,
androledefinitioncontainers.
InheritablesupervisorrightstotheRoleDefs.RoleConfig.AppConfig,
ResourceDefs.RoleConfig.AppConfigandResourceAssociations.RoleConfig.AppConfig
containerswithintheUAD.Allroleandresourceadds,modifies,anddeletesaredonewith
theserights.Rights
canbepareddownasneeded.
Youcanmaketheseassignmentstospecificusersoryoucanmaketheassignmentstoagroupora
container,thenassignuserstothegrouporadduserstothecontainer.
1 LogintoiManagerasanadministrativeuserforyourIdentityVault.
2 SelectViewObjectsonthetoolbar,thenbrowsetoandselecttheuser,group,orcontaineryou
wanttoassignrightsto.
3 Selecttheobject,thenclickActions>ModifyTrust ees.
4 Addtherightsasdefinedabove,thenclickOKtosavethechanges.
16 Identity Manager Role Mapping Administrator 4.0.1 Installation and Configuration Guide
2.4.2 Roles Based Provisioning Module Assignments for Administration
TheadministrationorconfigurationusersmustbemembersoftheRoleManagerroleortheRole
ModuleAdministratorroleintheRolesBasedProvisioningModule.Youcanmaketheserole
assignmentstospecificusersoryoucanmaketheassignmentstoagrouporacontainer,thenassign
userstothe
grouporadduserstothecontainer.
1 LogintotheRolesBasedProvisioningModuleasanadministrationuser.
2 ClickRoles>RolesAssignments.
3 SelectUser,Group,orContainertomaketheroleassignment.
4 Searchfortheuser,group,orcontainer,thenselectthedesiredobject.
5 ClickNewAssignment.
6 Fillinthefollowingfields:
InitialRequestDescription:Specifyareasonforrequestingtherole.
SelectRoles:SearchfortheRoleManagerrole,RoleAdministratorrole,ResourceManagerrole,and
theResourceAdministratorrole,selecttheroles,thenclickSelect.
EffectiveDate:(Optional)Specifyadatethisassignmentiseffective.
ExpirationDate:
(Optional)Selectwhetherthereisanexpirationdateforthisassignment.
7 ClickSubmittomaketheassignments.
2.4.3 Required Rights for the Role Mapping Administrator
Usersshouldbeonlygrantedtheminimalrightsrequiredtofulfilltheirjobduties.Youcanrestrict
rightsbyrestrictingtherightstotherolestheuserisassignedtoandrestrictinghisorherrightsinthe
IdentityVaultaswell.
3
Installing the Role Mapping Administrator 17
3
Installing the Role Mapping
Administrator
TheRoleMappingAdministratorcanbeinstalledasrootorthroughasilentinstallation.
Section 3.1,“InstallingtheRoleMappingAdministrator,”onpage 17
Section 3.2,“InstallingtheRoleMappingAdministratorinSilentMode,”onpage 18
Section 3.3,“ReconfiguringtheRoleMappingAdministrator,”onpage 19
3.1 Installing the Role Mapping Administrator
ToinstalltheRoleMappingAdministrator:
1 LocatetheRoleMappingAdministratorinstallationfileontheIdentityManagermedialocated
here:
Windows:
IDM4.0.1_Win:\products\RMA\IDMRMAP.jar
Linux:
IDM4.0.1_Lin/products/RMA/IDMRMAP.jar
2 FromacommandlineaccessRoleMapping Administratorinstallationdirectory,thenenter
java
-jar IDMRMAP.jar
.
NOTE:Forsecurityreasons,itisrecommendedtoinstalltheRoleMappingAdministratorasa
nonroot
user,onLinux.
3 Enter
Yes
toacceptthelicenseagreement.
4 SpecifytheinstallationdirectoryfortheRoleMappingAdministrator.Thedefaultpathisyour
currentlocation.
5 SpecifytheportionoftheURLrepresentingtheRoleImpingingAdministratorname.The
defaultvalueisIDMRMAP.
6 SpecifytheHTTPport.Thedefaultvalueis8081.
7 Specifyapasswordfortheconfigurationadministrator.
TheRoleMappingAdministratorisnowinstalled.Theapplicationisnotautomaticallystartedafter
theinstallationfinishes.Usethefollowingscriptstointheinstallationdirectorytostopandstartthe
application.
Windows:Thestartscriptis
start.bat
andthestopscriptis
stop.bat
.
Linux:Thestartscriptis
start.sh
andthestopscriptis
stop.sh
.
Aftertheapplicationisinstalledandstarted,youmustconfigureit.ProceedtoChapter 4,
“ConfiguringtheApplication,”onpage 21.
18 Identity Manager Role Mapping Administrator 4.0.1 Installation and Configuration Guide
Ifyouneedtochangeanyoftheinformationspecifiedduringtheinstallation,seeChapter 5,
“ChangingtheConfiguration,”onpage 29.
NOTE:YoushouldnotinstalltheRoleMappingAdministratoras
root
forsecurityconsiderations.
3.2 Installing the Role Mapping Administrator in Silent Mode
TheRoleMappingAdministratorcanbeinstalledsilentlywithouthumanintervention.Usethe
followingcommandtoconfiguretheunattendedinstallation,includingtheinstalllocation,port
configuration,RoleMappingAdministratoradministrationconfigurationpassword,andsoon.
java -jar IDMRMAP.jar [-h] [-s] [-i <install path>] [-p <port>] [-w <password>] [-
n <name>] [-l <log path>]
where[‐s]specifiessilentinstallation.
Table 3-1 SilentInstallationCLIArguments
Ifthesilentinstallationargumentsarenotpassed,defaultvaluesareassumed.
Argument Description
-h
Displays help.
-i
Specifies the installation location.
-l
<log directory>
Specifies the Role Mapping Administrator installation log file location, rma-
install.log. By default, the log file is located in the installation directory.
-n
<name>
Specifies the Role Mapping Administrator application name. The default name is
IDMRMAP.
-p
<port>
Specifies the Role Mapping Administrator HTTP port number. The default port is
8081.
-s -i
is a mandatory argument for silent installation. It performs the silent
installation.
-w
<password> |
<env:VAR>
Specifies the Role Mapping Administrator administration configuration password.
The password can be passed in clear text or through a user defined environment
variable. The installer reads the password from the environment variable.
Example 1:
-w mypassword
,
The user password is mypassword.
Example 2:
-w env:RMA_PASSWD
The installer reads the password from the RMA_PASSWD environment variable.
On Windows, run the
set RMA_PASSWD=novell
command.
On Linux, run the
export RMA_PASSWD=novell
command.
Installing the Role Mapping Administrator 19
3.3 Reconfiguring the Role Mapping Administrator
Section 3.3.1,“ChangingthePortNumber,”onpage 19
Section 3.3.2,“ChangingthePassword,”onpage 19
3.3.1 Changing the Port Number
YoucanchangetheRoleMappingAdministratorportnumbersbyeditingthefollowingentriesinthe
<rma_install_path>/rma/tomcat/conf/server.xml
file.
Replace8081and8443portnumberswiththenewportnumbersinthefollowingentriesforthe
HTTPservice.
<Connector port="8081" protocol="HTTP/1.1
ʺ
connectionTimeout="20000"
redirectPort="8443" />
Replacethe8006portnumberwiththenewportnumberusedtoshutdowntheTomcatservice.
<Server port="8006" shutdown="SHUTDOWN">
Theseportnumberscanbechangedwhenportnumbersareinuse.
3.3.2 Changing the Password
TheRoleMappingAdministratoradminpasswordcanbesetthroughthecommandlineinterface
duringtheinstallationprogrameitherthroughthepasswordpromptorbypassingitwith
-w
password|env:ENV_VAR
commandlineargument.YoucanalsosetitthroughtheWebportal.
Ifapasswordhasnotbeensetthroughthecommandlineinterfaceduringinstallation,youcansetit
throughtheWebportal.
1 StarttheRoleMappingAdministratorbyexecuting
<rma_install_path>/rma/start.sh
or
<rma_install_path>\rma\start.bat
commandrelevanttoyourplatform.
2 WhentheRoleMappingAdministratorWebportalislaunchedwith
http://localhost:8081,
settheRoleMappingAdministratoradministratorpassword.Ifthepasswordhasnotbeenset
throughthecommandlineinterfaceduringtheinstallationprogram,thereisnochangeinthe
behaviorandyoucanseetheadministratorloginpage.
20 Identity Manager Role Mapping Administrator 4.0.1 Installation and Configuration Guide
Entertheadminpassword.TheRoleMappingAdministratoradminpasswordissetwhenthe
textstringintheAdministratorPasswordandConfirmPasswordfieldsmatch.
3 ClickOK.Youareagainpromptedtoentertheadminpassword.
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
  • Page 1 1
  • Page 2 2
  • Page 3 3
  • Page 4 4
  • Page 5 5
  • Page 6 6
  • Page 7 7
  • Page 8 8
  • Page 9 9
  • Page 10 10
  • Page 11 11
  • Page 12 12
  • Page 13 13
  • Page 14 14
  • Page 15 15
  • Page 16 16
  • Page 17 17
  • Page 18 18
  • Page 19 19
  • Page 20 20
  • Page 21 21
  • Page 22 22
  • Page 23 23
  • Page 24 24
  • Page 25 25
  • Page 26 26
  • Page 27 27
  • Page 28 28
  • Page 29 29
  • Page 30 30
  • Page 31 31
  • Page 32 32
  • Page 33 33
  • Page 34 34
  • Page 35 35
  • Page 36 36
  • Page 37 37
  • Page 38 38
  • Page 39 39
  • Page 40 40
  • Page 41 41
  • Page 42 42
  • Page 43 43
  • Page 44 44
  • Page 45 45
  • Page 46 46
  • Page 47 47
  • Page 48 48
  • Page 49 49
  • Page 50 50
  • Page 51 51
  • Page 52 52
  • Page 53 53
  • Page 54 54
  • Page 55 55
  • Page 56 56
  • Page 57 57
  • Page 58 58
  • Page 59 59
  • Page 60 60

Novell Identity Manager 4.0.1 Installation guide

Novell
Brand
Novell
Model
Identity Manager 4.0.1
Category
Network management software
Type
Installation guide
Download PDF
report

Ask a question and I''ll find the answer in the document

Finding information in a document is now easier with AI

Related papers

Other documents