Novell Identity Manager ID Provider Driver Implementation Guide
Below you will find brief information for ID Provider Driver. The ID Provider driver enables creating and maintaining a central source of unique IDs consumed by client applications. When the driver receives an ID request from a client, it generates an ID based on defined policies, passes it to the client, and stores it in the Identity Vault.
Advertisement
Advertisement
www.novell.com/documentation
ID Provider Driver Implementation
Guide
Identity Manager 4.0.2
June 2012
Legal Notices
Novell, Inc., makes no representations or warranties with respect to the contents or use of this documentation, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc., reserves the right to revise this publication and to make changes to its content, at any time, without obligation to notify any person or entity of such revisions or changes.
Further, Novell, Inc., makes no representations or warranties with respect to any software, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc., reserves the right to make changes to any and all parts of Novell software, at any time, without any obligation to notify any person or entity of such changes.
Any products or technical information provided under this Agreement may be subject to U.S. export controls and the trade laws of other countries. You agree to comply with all export control regulations and to obtain any required licenses or classification to export, re-export or import deliverables. You agree not to export or re-export to entities on the current U.S. export exclusion lists or to any embargoed or terrorist countries as specified in the U.S. export laws. You agree to not use deliverables for prohibited nuclear, missile, or chemical biological weaponry end uses. See the Novell International Trade
Services Web page (http://www.novell.com/info/exports/) for more information on exporting Novell software. Novell assumes no responsibility for your failure to obtain any necessary export approvals.
Copyright © 2008-2012 Novell, Inc. All rights reserved. No part of this publication may be reproduced, photocopied, stored on a retrieval system, or transmitted without the express written consent of the publisher.
Novell, Inc.
1800 South Novell Place
Provo, UT 84606
U.S.A.
www.novell.com
Online Documentation: To access the latest online documentation for this and other Novell products, see the Novell
Documentation Web page (http://www.novell.com/documentation) .
Novell Trademarks
For Novell trademarks, see the Novell Trademark and Service Mark list (http://www.novell.com/company/legal/trademarks/ tmlist.html) .
Third-Party Materials
All third-party trademarks are the property of their respective owners.
Contents
About This Guide 5
1 Understanding the ID Provider Driver
7
2 Installing Driver Files
11
3 Creating a New Driver Object
13
4 Upgrading an Existing Driver
25
5 Configuring ID Clients
27
6 Managing the ID Provider Driver
7 Troubleshooting
29
31
A Driver Properties 33
Contents
3
4
Identity Manager 4.0.2 ID Provider Driver Implementation Guide
About This Guide
This guide explains the purpose of the ID Provider driver and how to implement the driver.
Chapter 1, “Understanding the ID Provider Driver,” on page 7
Chapter 2, “Installing Driver Files,” on page 11
Chapter 3, “Creating a New Driver Object,” on page 13
Chapter 4, “Upgrading an Existing Driver,” on page 25
Chapter 5, “Configuring ID Clients,” on page 27
Chapter 6, “Managing the ID Provider Driver,” on page 29
Chapter 7, “Troubleshooting,” on page 31
Appendix A, “Driver Properties,” on page 33
Audience
This guide is intended for Identity Manager administrators.
Feedback
We want to hear your comments and suggestions about this manual and the other documentation included with this product. Please use the User Comments feature at the bottom of each page of the online documentation, or go to www.novell.com/documentation/feedback.html and enter your comments there.
Documentation Updates
For the most recent version of this guide, visit the Identity Manager Drivers Documentation Web site
(http://www.netiq.com/documentation/idm402drivers) .
Additional Documentation
For documentation on Identity Manager, see the Identity Manager Documentation Web site (http:// www.netiq.com/documentation/idm402/index.html) .
About This Guide
5
6
Identity Manager 4.0.2 ID Provider Driver Implementation Guide
1
Understanding the ID Provider Driver
The ID Provider driver enables you to create and maintain a central source of unique IDs that can be consumed by client applications or systems. When the driver receives an ID request from a client, it generates an ID based on policies you define, passes it to the client, and then stores it in the Identity
Vault.
Section 1.1, “Why Use the Driver?,” on page 7
Section 1.2, “Design Architecture,” on page 7
Section 1.3, “Schema Architecture,” on page 9
1.1
Why Use the Driver?
There are many different reasons why you would want to use the ID Provider driver. For example:
It is convenient for administrators to have one basic ID for each object in the system, and to have complete control of the ID. No other system can change this ID.
You can use the ID Provider driver in conjunction with the WorkOrder driver to verify that each
WorkOrder ID is unique.
You can use the driver to help manage UIDs and GIDs in Linux.
1.2
Design Architecture
Identity Manager drivers listen for events and then apply the proper Identity Manager policies for the event. That information is then passed to the Metadirectory engine that executes the policies.
The ID Provider driver is different from all other Identity Manager drivers. It also listens for events, but it has two sets of policies: the Identity Manager policies and the ID Provider policies. The ID
Provider policies allow the driver to generate and assign unique IDs to objects.
The driver has three major components:
ID Client: The ID client communicates with the ID Provider driver to obtain a unique ID. The client can be another Identity Manager driver (for example, the WorkOrder driver) or a standalone Java application.
ID Provider Driver: The driver receives ID requests from clients, generates unique IDs that are stored in the Identity Vault, and passes the unique IDs back to the client. The driver uses LDAP to access the Identity Vault and uses Java RMI (Remote Method Invocation) to communicate with ID clients.
Identity Vault: The Identity Vault provides the location for storing unique IDs and also contains the policies used to generate the IDs. All IDs and policies are stored in the ID Policy Container.
Understanding the ID Provider Driver
7
The ID Provider driver can be used in two different scenarios:
“Scenario 1: Using the Identity Vault to Store the ID Provider Policies” on page 8
“Scenario 2: Using an LDAP Database to Store the ID Provider Policies” on page 9
Scenario 1: Using the Identity Vault to Store the ID Provider Policies
This is the most commonly used scenario for this driver. The ID Provider policies are created and
stored in the Identity Vault when the driver is created and configured. Figure 1-1
shows how a unique ID is generated.
Figure 1-1
Identity Vault Stores the ID Provider Policies
Identity Vault IDM
Engine
[root] system services data
ID Policies policies1 policies2 policies3 users user1 user2
New user
add event
1
ID
3
LDAP Interface
Read last ID from policy, generate new ID, and write back new ID to policy
2
1. A new User object is created in the Identity Vault, then the ID Provider driver picks up the
Create event.
8
Identity Manager 4.0.2 ID Provider Driver Implementation Guide
2. The ID Provider driver reads the last ID that was generated from the ID Provider policies in the
Identity Vault and generates a new ID. The ID is then written back to the ID Provider policies in the Identity Vault to track the unique IDs.
3. The ID Provider driver then assigns the new ID to the new User object.
All events are tracked and stored in the Identity Vault.
Scenario 2: Using an LDAP Database to Store the ID Provider Policies
This scenario allows you to use an LDAP database to store the ID Provider policies instead of using the Identity Vault.
Figure 1-2 shows how a unique ID is generated with the LDAP database.
Figure 1-2
LDAP Database Stores the ID Provider Policies
Identity
Vault
[root] data users user1 user2
New user
add event
1
IDM
Engine
Read last ID from policy, generate new ID, and write back to new ID to policy
LDAP
Directory
2
[root] system services
ID Policies policies1 policies2 policies3
ID
3
1. A new User object is created in the Identity Vault, then the ID Provider driver picks up the
Create event.
2. The ID Provider driver reads the last ID that was generated from the ID Provider policies in the
LDAP database and generates a new ID. The ID is then written back to the ID Provider policies in the LDAP database to track the unique IDs.
3. The ID Provider driver then assigns the new ID to the new User object in the Identity Vault.
1.3
Schema Architecture
The Identity Vault’s schema must be extended to support the ID Provider driver functionality. The following two tables describe the schema attributes and classes.
Understanding the ID Provider Driver
9
Table 1-1
Schema Attributes
Attribute Name Syntax Attribute Flags Description
DirXML-IDPolName
DirXML-IDPolLastID
DirXML-IDPolMin
DirXML-IDPolMax
DirXML-IDPolPrefix
DirXML-IDPolFill
DirXML-IDPolArea
DirXML-IDPolAreaEI
DirXML-IDPolAccessControl
DirXML-IDPolACL
DirXML-IDPolicyContainerDN
Case Ignore String Single valued
Synchronize immediately
Numeric String Single-valued
Synchronize immediately
Numeric String Single-valued
Numeric String Single-valued
Case Ignore String Single-valued
Boolean Single-valued
Case Ignore String
Boolean
Boolean
Case Ignore String
Single-valued
Single-valued
Single-valued
Single-valued
Distinguished Name Single-valued
ID Policy object name
Last delivered ID
Minimum value for an ID
Maximum value for an ID
Prefix for a new ID
True: Fill ID with 0 up to maximum length
False or Empty: Do nothing
Exclude/Include list for generated IDs
True: IDPolArea = Include list
False or Empty: IDPolArea
= Exclude list
True: IDPolACL list is used
False or Empty: IDPolACL list is not used
Comma-delimited list of ID clients to be allowed to request an ID from the ID server
Link to the ID Policy
Container
Table 1-2
Schema Classes
Class Name
ID Policy Container
ID Policy
Contained By Attributes Contained
Country, Domain, Locality,
Organization, Organizational Unit,
Tree Root
ID Policy Container
OU
IDPolACL
IDPolAccessControl
IDPolArea
IDPolAreaEI
IDPolFill
IDPolLastID
IDPolMax
IDPolMin
IDPolName
IDPolPrefix
10
Identity Manager 4.0.2 ID Provider Driver Implementation Guide
2
Installing Driver Files
The ID Provider Driver is a service driver that is included with the base Identity Manager product.
The driver is installed when the Metadirectory engine and drivers are installed. For the installation instructions, see “ Installation ” in the
Identity Manager 4.0.2 Integrated Installation Guide
.
Installing Driver Files
11
12
Identity Manager 4.0.2 ID Provider Driver Implementation Guide
3
Creating a New Driver Object
After the ID Provider driver files are installed on the server where you want to run the driver (see
Chapter 2, “Installing Driver Files,” on page 11
), you must create the driver in the Identity Vault. The following sections provide instructions:
Section 3.1, “Creating the Driver Object in Designer,” on page 13
Section 3.2, “Adding Packages to an Existing Driver,” on page 18
Section 3.3, “Creating ID Policies,” on page 20
Section 3.4, “Activating the Driver,” on page 21
Section 3.5, “Adding Packages to an Existing Driver,” on page 21
3.1
Creating the Driver Object in Designer
You can run the driver as a native Java module or as an Identity Manager driver on any supported platform.
To create an ID Provider driver object, install the driver packages and then modify the configuration to suit your environment. After you create and configure the driver object, you need to deploy it to the Identity Vault and start it.
Section 3.1.1, “Importing the Current Driver Packages,” on page 13
Section 3.1.2, “Installing the Driver Packages,” on page 14
Section 3.1.3, “Configuring the Driver Settings,” on page 15
Section 3.1.4, “Deploying the Driver Object,” on page 17
Section 3.1.5, “Starting the Driver,” on page 18
3.1.1
Importing the Current Driver Packages
The driver packages contain the items required to create a driver, such as policies, entitlements (not available in Beta), filters, and Schema Mapping policies. These packages are only available in
Designer. You can upgrade any package that is installed if there is a newer version of the package available. It is recommended to have the latest packages in the Package Catalog before creating a new driver object. For more information on upgrading packages, see “ Upgrading Installed Packages ” in the
Designer 4.0.2 for Identity Manager 4.0.2 Administration Guide
.
To verify you have the most recent version of the driver packages in the Package Catalog:
1
Open Designer.
2
In the toolbar, click Help > Check for Package Updates.
3
Click OK to update the packages or
Creating a New Driver Object
13
Click OK if the packages are up-to-date.
4
In the Outline view, right-click the Package Catalog.
5
Click Import Package.
6
Select any ID Provider driver packages or
Click Select All to import all of the packages displayed.
By default, only the base packages are displayed. Deselect Show Base Packages Only to display all packages.
7
Click OK to import the selected packages, then click OK in the successfully imported packages message.
8
After the current packages are imported, continue with
Section 3.1.2, “Installing the Driver
.
3.1.2
Installing the Driver Packages
After you have imported the current driver packages into the Package Catalog, you can install the driver packages to create a new driver.
1
In Designer, open your project.
2
In the Modeler, right-click the driver set where you want to create the driver, then click New >
Driver.
3
Select ID Provider Base, then click Next.
4
On the ID Provider page, specify a name for the driver, then click Next.
5
On the ID Provider page, fill in the following fields, then click Next:
LDAP server: Specify the IP address or DNS name of the LDAP server that contains the ID policies.
Policy Container DN: Specify the LDAP DN of the policy container.
6
On the ID Provider page, fill in the following fields, then click Next:
Authentication ID: Specify the LDAP DN of a user with read/write access to the ID Policy container and its child objects.
Authentication Password: Specify the password of the user named in the Authentication ID field.
7
Fill in the following fields for Remote Loader information:
Connect To Remote Loader: Select Yes or No to determine if the driver will use the Remote
Loader. For more information, see the
Identity Manager 4.0.2 Remote Loader Guide
.
14
Identity Manager 4.0.2 ID Provider Driver Implementation Guide
If you select No, skip to Step 8
. If you select Yes, use the following information to complete the configuration of the Remote Loader, then click Next:
Host Name: Specify the IP address or DNS name of the server where the Remote Loader is installed and running.
Port: Specify the port number for this driver. Each driver connects to the Remote Loader on a separate port. The default value is 8090.
Remote Loader Password: Specify a password to control access to the Remote Loader. It must be the same password that is specified as the Remote Loader password on the Remote Loader.
Driver Password: Specify a password for the driver to authenticate to the Metadirectory server.
It must be the same password that is specified as the Driver Object Password on the Remote
Loader.
8
Review the summary of tasks that will be completed to create the driver, then click Finish.
9
After the driver packages are installed, if you want to change the configuration of the Role-Based
Entitlement driver, continue to
Section 3.1.3, “Configuring the Driver Settings,” on page 15
.
or
If you do not want to change the configuration of the driver, continue to Section 3.1.4,
“Deploying the Driver Object,” on page 17
.
3.1.3
Configuring the Driver Settings
After you import the driver configuration file, the ID Provider driver will run. However, there are many configuration settings that you can use to customize and optimize the driver. The settings are divided into categories such as Driver Configuration, Engine Control Values, and Global
If you do not have the Driver Properties page displayed in Designer:
1
Open your project.
2
In the Modeler, right-click the driver icon or the driver line, then select Properties.
3
Make the changes you want, then continue to
Section 3.1.5, “Starting the Driver,” on page 18 .
If you want to make additional changes to the driver, the following sections contain information about the driver parameters.
“ID Policy Repository” on page 15
ID Policy Repository
The ID policy repository parameters contain information about the location and how to access any ID policies.
Parameter
LDAP Server
Default Value
127.0.0.1
Description
The IP address or DNS name of the LDAP server holding the ID policies
Creating a New Driver Object
15
Parameter
LDAP Port
Use SSL
Always trust
Policy Container DN
Default Value Description
636 The TCP port that the LDAP server listens on.
The value is usually 389 for non-SSL connections and 636 for SSL connections.
True
True
Specify whether or not you want to use SSL.
Specify whether or not you want to trust all servers. If this option is set to True, the ID provider trusts all LDAP servers even if the server certificate is untrusted.
LDAP DN for the policy container under the driver object. For example cn=id-policies,cd=idprovider,cn=driverset1,dc=idm,d c=services,dc=system.
Specify or browse to the DN of the policy container in your tree. The policy container can only be created under the ID Provider driver.
Client Options
The client options are for the ID Provider clients. For more information, see
.
Parameter
Client name
ID Generation Map
Default Value
ID-Provider Driver workforceID=wfid
Description
This is the name the driver uses when it acts as an ID client and requests and ID from the provider. This is useful for tracing and if access control is enabled on any of the ID policies.
If access control is enabled, a list of ID client names can be specified that are allowed to obtain an ID from the policy. If the client name associated with the request is not in that list, the provider does not issue an ID.
Provide a comma-separated list of attribute=policy pairs.
For example, workforceID=wfid,uniqueID=uid. This example configures the driver to request IDs from the wfid policy and stores them in the workforceID attribute whenever a new object is created or whenever someone tries to change this attribute.
Similarly, IDs from the UID policy are used from the uid attribute. The driver only issues IDs for any attribute if that attribute and the object class holding the attribute are in both the Subscriber, Publisher, Filter, and are set to synchronize.
Attribute names must be in the Identity Namespace (not
LDAP) and must be case-exact.
Server Options
These options allow you to set up clients other than the ID Provider driver by using Java Remote
Method Invocation (RMI). It also allows you to set ID Provider trace level.
16
Identity Manager 4.0.2 ID Provider Driver Implementation Guide
Parameter
Start RMI
RMI server
RMI port
Use legacy ID-server schema?
Trace level
Default Value
True
172.17.2.117
1199
False
ALL
Description
Controls whether the ID provider starts an RMI service or not.
You only need a running RMI service if you request IDs from other clients than the driver (for example, DirXMLScript policies.) If all IDs are managed through this driver’s filter and
ID Generation Map settings, then no RMI service is needed.
Specify the IP address the RMI server binds to. Leave this field empty if you want the server to bind to all IP addresses.
Specify the TCP port the RMI service listens on. The defined standard port for RMI is 1099. If that port is already in use (you see errors in the trace when you start the driver), use a different port higher than 1023. This configuration assumes a port of 1199 to avoid common port conflicts.
Enables the backward compatibility mode when migrating an existing ID-Server configuration to run with the new ID
Provider driver. Setting this to True allows you to keep using legacy ID policies, which do not use the new schema that ships with the ID Provider.
This is not the driver trace level, but the ID Provider trace level. The levels are:
OFF: Tracing is turned off.
FATAL: Displays only fatal messages.
ERROR: Displays only error messages.
WARN: Displays only warning messages.
INFO: Displays only informational messages.
DEBUG: Displays only debug messages.
ALL: Displays all messages.
3.1.4
Deploying the Driver Object
After a driver is created in Designer, it must be deployed into the Identity Vault.
1
In Designer, open your project.
2
In the Modeler, right-click the driver icon or the driver line, then select Live > Deploy.
3
If you are authenticated to the Identity Vault, skip to Step 4 ; otherwise, specify the follow
information, then click OK:
Host: Specify the IP address or DNS name of the server hosting the Identity Vault.
Username: Specify the DN of the user object used to authenticate to the Identity Vault.
Password: Specify the user’s password.
4
Read the deployment summary, then click Deploy.
5
Read the successful message, then click OK.
6
Click Define Security Equivalence to assign rights to the driver.
Creating a New Driver Object
17
The driver requires rights to objects within the Identity Vault and to the input and output directories on the server. The Admin user object is most often used to supply these rights.
However, you might want to create a DriversUser (for example) and assign security equivalence to that user. Whatever rights that the driver needs to have on the server, the DriversUser object must have the same security rights.
6a
Click Add, then browse to and select the object with the correct rights.
6b
Click OK twice.
For more information about defining a Security Equivalent User in objects for drivers in the
Identity Vault, see “Establishing a Security Equivalent User” in the Identity Manager 4.0.2
Security Guide .
7
Click Exclude Administrative Roles to exclude users that should not be synchronized.
You should exclude any administrative User objects (for example, Admin and DriversUser) from synchronization.
7a
Click Add, then browse to and select the user object you want to exclude, then click OK.
7b
Repeat
for each object you want to exclude, then click OK.
8
Click OK.
3.1.5
Starting the Driver
When a driver is created, it is stopped by default. To make the driver work, you must start the driver and cause events to occur. Identity Manager is an event-driven system, so after the driver is started, it won’t do anything until an event occurs.
To start the driver:
1
In Designer, open your project.
2
In the Modeler, right-click the driver icon or the driver line, then select Live > Start Driver.
For information about management tasks for the driver, see
Chapter 6, “Managing the ID Provider
3.2
Adding Packages to an Existing Driver
You can add new functionality to an existing driver by adding new packages to an existing driver.
1
Right-click the driver, then click Properties.
2
Click Packages, then click the Add Packages icon .
3
Select the packages to install. If the list is empty, there are no available packages to install.
18
Identity Manager 4.0.2 ID Provider Driver Implementation Guide
4
(Optional) Deselect the Show only applicable package versions option, if you want to see all available packages for the driver, then click OK.
This option is only displayed on drivers. By default, only the packages that can be installed on the selected driver are displayed.
5
Click Apply to install all of the packages listed with the Install operation.
6
(Conditional) Fill in the fields with appropriate information to install the package you selected for the driver, then click Next.
7
Read the summary of the installation, then click Finish.
8
Click OK to close the Package Management page after you have reviewed the installed packages.
Creating a New Driver Object
19
9
Repeat
through
Step 8 for each driver where you want to add the new packages.
3.3
Creating ID Policies
An ID Policy container is a repository for ID policies and is used in conjunction with the ID
Provider driver. An ID policy allows the ID Provider driver to generate unique IDs. When the ID
Provider driver receives an ID request from a client, it generates an ID based on the ID policy specified in the request and passes it to the client.
Section 3.3.1, “Default Policies,” on page 20
Section 3.3.2, “Creating an ID Policy,” on page 20
Section 3.3.3, “Managing the Access Control List,” on page 21
3.3.1
Default Policies
By default, there are three ID policies that are created when the driver is imported. The three policies are sample policies. You can use these policies or create your own. The default policies are:
pid: The pid policy generates unique IDs between 100000 to 2000000000. It also adds the prefix of “PID” to each unique ID.
wfid: The wfid policy generates unique IDs between 10000000 to 99999999. It also adds the prefix of “WFID” to each unique ID for the workforce ID.
woid: The woid policy generates unique IDs between 100000 to 2000000000. It also adds the prefix of “WOID” to each unique ID.
3.3.2
Creating an ID Policy
To create an ID policy:
1
In Designer, right-click the ID Policy container in the Outline tab, then click New > ID Policy.
The ID Policy container is created when the ID Provider driver is created. The ID Policy container can only reside under the ID Provider driver.
2
Specify the name for the ID policy, then click OK.
3
Double-click the ID policy to access the properties page.
4
Use the following information to create your ID policy:
Policy Name: Specify the name of the ID policy.
20
Identity Manager 4.0.2 ID Provider Driver Implementation Guide
Policy’s Last ID: The last ID number that was used by this ID policy. If you have deployed this
ID policy, use the Connect icon to update this field to the last ID number that was stored in the
Identity Vault for this ID policy.
NOTE: Only the ID Provider driver can update the last value stored in the Identity Vault.
Constraints Minimum/Maximum: Numbers must be between 0 and 2147483647. If you have a fixed system that can only handle eight digits, set the Maximum to 99999999.
Constraints Exclude/Include: Allows you to include or exclude a set of numbers that you type in. Numbers can be typed in a coma-delimited list and you can use ranges, such as
10,100,1000,5000-10000,1099, etc.
Constraints Prefix: Allows you to give a prefix to the IDs that are generated using this ID policy.
If you create multiple ID policies, a prefix is useful to see which ID policies are being used. An example is WFID, for workforce IDs.
Constraints Fill Yes/No: If you choose Yes, the ID is filled with leading zeros (0) up to the maximum length. This helps keep generated IDs at the same length. If you select No, it does nothing and the ID lengths increment over time.
Access Control Enabled: Check this box if you want to enable access control list.
Access Control ACL: Type in the access control lists you want to use. Access control must be enabled before you can type in ACLs. For more information, see
Access Control List,” on page 21 .
5
Click OK to save the information.
3.3.3
Managing the Access Control List
The Access Control List (ACL) is also called the Object Trustee property. Whenever you make a trustee assignment, the trustee is added as a value to the Object Trustees (ACL) property of the target.
The value for the ACL parameter must match the value that the ACL client is using.
3.4
Activating the Driver
If you created the driver in a driver set where you have already activated the Metadirectory engine and service drivers, the driver inherits the activation. If you created the driver in a driver set that has not been activated, you must activate the driver within 90 days. Otherwise, the driver stops working.
For information on activation, refer to the “ Activating Novell Identity Manager Products ” in the
Identity Manager 4.0.2 Framework Installation Guide
.
3.5
Adding Packages to an Existing Driver
You can add new functionality to an existing driver by adding new packages to an existing driver.
1
Right-click the driver, then click Properties.
2
Click Packages, then click the Add Packages icon .
3
Select the packages to install. If the list is empty, there are no available packages to install.
Creating a New Driver Object
21
4
(Optional) Deselect the Show only applicable package versions option, if you want to see all available packages for the driver, then click OK.
This option is only displayed on drivers. By default, only the packages that can be installed on the selected driver are displayed.
5
Click Apply to install all of the packages listed with the Install operation.
6
(Conditional) Fill in the fields with appropriate information to install the package you selected for the driver, then click Next.
7
Read the summary of the installation, then click Finish.
8
Click OK to close the Package Management page after you have reviewed the installed packages.
22
Identity Manager 4.0.2 ID Provider Driver Implementation Guide
9
Repeat
through
Step 8 for each driver where you want to add the new packages.
Creating a New Driver Object
23
24
Identity Manager 4.0.2 ID Provider Driver Implementation Guide
4
Upgrading an Existing Driver
The following sections provide information to help you upgrade an existing driver:
Section 4.1, “What’s New in Version 4.0.2,” on page 25
Section 4.2, “Upgrade Procedure,” on page 25
4.1
What’s New in Version 4.0.2
Version 4.0.2 of the driver does not include any new features.
From 4.0 version of the driver, driver content is delivered in packages instead of through a driver configuration file.
4.2
Upgrade Procedure
The process for upgrading the ID Provider driver is the same as for other Identity Manager drivers.
For details instructions, see “ Upgrading Drivers to Packages ” in the
Identity Manager 4.0.2 Upgrade and Migration Guide
.
Upgrading an Existing Driver
25
26
Identity Manager 4.0.2 ID Provider Driver Implementation Guide
5
Configuring ID Clients
An ID client can be run as a standalone Java process or included in another Identity Manager driver.
All clients must use the Java RMI (Remote Method Invocation) interface to request a new ID from the
ID Provider driver.
Section 5.1, “ID Client,” on page 27
Section 5.2, “Standalone Client,” on page 28
5.1
ID Client
The ID client can be used inside of DirXML style sheets calling the getNextID function of the com.novell.ncs.idsrv.IDClient Java class.
xmlns:id=http://www.novell.com/nxsl/java/com.novell.idm.idprovider.IDClient
To obtain the next available ID from an ID Policy object in the Identity Vault, the ID client uses the following parameters to communicate with the ID Provider driver:
Parameter Description Sample
$RMIServer RMI server host address.
$RMIPort RMI server port.
$UIDRule
$IDClient
$Tracelevel
ID Policy object name to retrieve an ID from.
ID Client name to identify this client at the RMI server.
Trace level.
You use the trace level setting to see specific trace information in the DirXML ID
Servers main screen.
The trace level is a bit mask and can be combined.
1 localhost
1099 uniqueCN
Client-No2
Trace values and levels:
0 = off
1 = low
2 = medium
3 = high
4 = exceptions
To generate the IDs by the XPATH expression, use the following command: id: getNextID('IP_OF_RMI_SERVER','PORT','POLICY_NAME','CLIENT_NAME',TRACE_LEVEL
The XPATH expression will look like this:
Configuring ID Clients
27
<arg-string>
<token-xpath expression="id:getNextID('172.17.1.3','1199','MYUID','DBUSERS',0)"/>
</arg-string>
5.2
Standalone Client
The standalone client is run as a Java process that calls the main function of the com.novell.ncs.idsrv.IDClient Java class.
%JRE_HOME%\java -noverify -classpath %CLASSPATH% com.novell.idm.idprovider.IDClient <parameters>
To obtain the next available ID from an ID Policy objects in the Identity Vault, the client uses the following parameters to communicate with the driver:
Parameter Description
-o
-c
-h
-p
-t
-m
RMI server host address.
RMI server port.
ID Policy object name to retrieve an ID from.
ID Client name to identify this client at the RMI server.
Sample
-h localhost
-p 1099
-o uniqueCN
-c Client-No1
Trace level.
You use the trace level setting to see specific trace information in the DirXML
ID Servers main screen.
The trace level is a bit mask and can be combined.
-t 1
Trace values and levels:
0 = off
1 = low
2 = medium
3 = high
4 = exceptions
Remote RMI server command to be executed at the RMI server console -m reinitialize
%JRE_HOME%\java -noverify -classpath %CLASSPATH% com.novell.idm.idprovider.IDClient -h localhost -p 1099 -o Policy -t 1 -c Client l 1
28
Identity Manager 4.0.2 ID Provider Driver Implementation Guide
6
Managing the ID Provider Driver
As you work with the ID Provider driver, there are a variety of management tasks you might need to perform, including the following:
Starting, stopping, and restarting the driver
Viewing driver version information
Using Named Passwords to securely store passwords associated with the driver
Monitoring the driver’s health status
Backing up the driver
Inspecting the driver’s cache files
Viewing the driver’s statistics
Using the DirXML Command Line utility to perform management tasks through scripts
Securing the driver and its information
Synchronizing objects
Migrating and resynchronizing data
Activating the driver
Upgrading an existing driver
Because these tasks, as well as several others, are common to all Identity Manager drivers, they are included in one reference, the
Identity Manager 4.0.2 Common Driver Administration Guide
.
Managing the ID Provider Driver
29
30
Identity Manager 4.0.2 ID Provider Driver Implementation Guide
7
Troubleshooting
Viewing driver processes is necessary to analyze unexpected behavior. To view the driver processing events, use DSTrace. You should only use it during testing and troubleshooting the driver. Running
DSTrace while the drivers are in production increases the utilization on the Identity Manager server and can cause events to process very slowly. For more information, see “ Viewing Identity Manager
Processes ” in the
Identity Manager 4.0.2 Common Driver Administration Guide
.
Troubleshooting
31
32
Identity Manager 4.0.2 ID Provider Driver Implementation Guide
A
Driver Properties
This section provides information about the Driver Configuration and Global Configuration Values properties for the ID Provider driver. These are the only unique properties for the ID Provider driver.
All other driver properties (Named Password, Engine Control Values, Log Level, and so forth) are common to all drivers. Refer to “ Driver Properties ” in the
Identity Manager 4.0.2 Common Driver
Administration Guide
for information about the common properties.
The information is presented from the viewpoint of iManager. If a field is different in Designer, it is marked with an icon.
Section A.1, “Driver Configuration,” on page 33
Section A.2, “Global Configuration Values,” on page 37
A.1
Driver Configuration
In iManager:
1
In iManager, click to display the Identity Manager Administration page.
2
Open the driver set that contains the driver whose properties you want to edit:
2a
In the Administration list, click Identity Manager Overview.
2b
If the driver set is not listed on the Driver Sets tab, use the Search In field to search for and display the driver set.
2c
Click the driver set to open the Driver Set Overview page.
3
Locate the ID Provider driver icon, then click the upper right corner of the driver icon to display the Actions menu.
4
Click Edit Properties to display the driver’s properties page.
By default, the properties page opens with the Driver Configuration tab displayed.
In Designer:
1
Open a project in the Modeler.
2
Right-click the driver icon or line, then select click Properties > Driver Configuration.
The Driver Configuration options are divided into the following sections:
Section A.1.1, “Driver Module,” on page 34
Section A.1.2, “Driver Object Password,” on page 34
Section A.1.3, “Authentication,” on page 34
Section A.1.4, “Startup Option,” on page 35
Section A.1.5, “Driver Parameters,” on page 35
Driver Properties
33
Section A.1.6, “ECMAScript,” on page 36
Section A.1.7, “Global Configurations,” on page 36
A.1.1
Driver Module
The driver module changes the driver from running locally to running remotely or the reverse.
Java: Used to specify the name of the Java class that is instantiated for the shim component of the driver. This class can be located in the classes directory as a class file, or in the lib directory as a
.jar
file. If this option is selected, the driver is running locally.
The name of the Java class is: com.novell.idm.dirxml.driver.idprovider.IDProviderShim
Connect to the Remote Loader: Used when the driver is connecting remotely to the connected system. Designer includes two suboptions:
Remote Loader Client Configuration for Documentation: Includes information on the Remote
Loader client configuration when Designer generates documentation for the ID Provider driver.
Driver Object Password: Specifies a password for the Driver object. If you are using the Remote
Loader, you must enter a password on this page. Otherwise, the remote driver does not run. The
Remote Loader uses this password to authenticate itself to the remote driver shim.
A.1.2
Driver Object Password
Driver Object Password: Use this option to set a password for the driver object. If you are using the
Remote Loader, you must enter a password on this page or the remote driver does not run. This password is used by the Remote Loader to authenticate itself to the remote driver shim.
A.1.3
Authentication
The authentication section stores the information required to authenticate to the connected system.
Authentication ID: Specify a user application ID. This ID is used to pass Identity Vault subscription information to the application. For example, Administrator.
Authentication Context: Specify the IP address or name of the server the application shim should communicate with.
Remote Loader Connection Parameters: Used only if the driver is connecting to the application through the Remote Loader. The parameter to enter is hostname=xxx.xxx.xxx.xxx port=xxxx kmo=certificatename
, when the hostname is the IP address of the application server running the
Remote Loader server and the port is the port the remote loader is listening on. The default port for the Remote Loader is 8090.
The kmo entry is optional. It is only used when there is an SSL connection between the Remote Loader and the Metadirectory engine.
Example: hostname=10.0.0.1 port=8090 kmo=IDMCertificate
Application Password: Specify the password for the user object listed in the Authentication ID field.
Remote Loader Password: Used only if the driver is connecting to the application through the
Remote Loader. The password is used to control access to the Remote Loader instance. It must be the same password specified during the configuration of the Remote Loader on the connected system.
34
Identity Manager 4.0.2 ID Provider Driver Implementation Guide
Cache limit (KB): Specify the maximum event cache file size (in KB). If it is set to zero, the file size is unlimited. Click Unlimited to set the file size to unlimited in Designer.
A.1.4
Startup Option
The startup options allow you to set the driver state when the Identity Manager server is started.
Auto start: The driver starts every time the Identity Manager server is started.
Manual: The driver does not start when the Identity Manager server is started. The driver must be started through Designer or iManager.
Disabled: The driver has a cache file that stores all of the events. When the driver is set to Disabled, this file is deleted and no new events are stored in the file until the driver state is changed to Manual or Auto Start.
Do not automatically synchronize the driver: This option only applies if the driver is deployed and was previously disabled. If this is not selected, the driver re-synchronizes the next time it is started.
A.1.5
Driver Parameters
The Driver Parameters section lets you configure the driver-specific parameters. When you change driver parameters, you tune driver behavior to align with your network environment. The driver parameters are divided into categories:
“ID Policy Repository” on page 35
ID Policy Repository
LDAP server: The IP address or DNS name of the LDAP server that contains the ID policies.
LDAP port: The TCP port of the LDAP server. The default port is 389 for a non-SSL connection and
636 for an SSL connection.
Use SSL: Select True to use an SSL/TLS connection to the LDAP server.
Always trust: If this options is set to True, the ID Provider driver trusts all LDAP servers even if their certificates are untrusted.
Policy Container DN: Specify the DN of the policy container in your Identity Vault.
Client Options
Client name: The name the driver uses when it acts as an ID client and requests an ID from the provider. This is useful for tracing, and if access control is enabled on any of the ID policies. If access control is enabled, the ID client names that obtain an ID from the policy are specified. If the client name associated with the request is not in the list, the provider does not issue an ID.
ID Generation Map: Specify a comma-separated list of attribute=policy pairs. For example: workforceID=wfid,uniqueID=uid
.
Driver Properties
35
This example configures the driver to request IDs from the wfid policy and store them in the workforceID attribute whenever a new object is created or when someone tries to change this attribute. IDs from the uid policy are used for the uniqueID attribute. The driver only issues IDs from an attribute if that attribute and the object class holding the attribute are in the Subscriber channel and the Publisher channel of the filter and are set to synchronize.
NOTE: Attribute names must be in the Identity Manager namespace (not LDAP) and must be caseexact.
Server Options
Start RMI?: Controls whether the ID Provider starts an RMI service or not. An RMI service is needed if you request IDs from other clients than the driver for example, from DirXML Script policies or style sheets. If all IDs are managed through this driver’s filter and ID Generation Map settings, no RMI service is needed.
RMI server: The IP address of the RMI server. Leave this field blank for the server to bind to all available addresses.
RMI port: The TCP port of the RMI service. The default port for RMI is 1099. If that port is in use, change to a different port that is lower than 1024. If the port is in conflict, you see errors in the trace when the driver starts. The configuration assumes a port of 1099 to avoid common port conflicts.
RMI Service port: The TCP port for the RMI ID Provider service. The server uses an ephemeral port if the value of this parameter is zero.
RMI ID Provider Service IP: The IP address of the server where the ID Provider service is available.
This parameter is useful in NAT environments where ID Provider service has to be on a specific network interface. The IP address of the server where the client can access the ID Provider Service. In a NAT environment, this is the public IP address through which the clients can connect to the
Identity Vault server.
Use legacy ID Server schema: Enables a backward-compatibility mode when migrating an existing
ID server configuration to run with the new ID Provider shim. True allows you to use legacy ID policies which do not use the schema that ships with the ID Provider driver.
Trace level: Select On to enable the ID Provider trace level, not the driver trace level.
A.1.6
ECMAScript
Enables you to add ECMAScript resource files. The resources extend the driver’s functionality when
Identity Manager starts the driver.
A.1.7
Global Configurations
Displays an ordered list of Global Configuration objects. The objects contain extension GCV definitions for the driver that Identity Manager loads when the driver is started. You can add or remove the Global Configuration objects, and you can change the order in which the objects are executed.
36
Identity Manager 4.0.2 ID Provider Driver Implementation Guide
A.2
Global Configuration Values
Global configuration values (GCVs) allow you to specify settings for the Identity Manager features such as driver heartbeat, as well as settings that are specific to the function of an individual driver configuration. The ID Provider driver does not included any preconfigured GCVs.
In iManager:
1
In iManager, click to display the Identity Manager Administration page.
2
Open the driver set that contains the driver whose properties you want to edit:
2a
In the Administration list, click Identity Manager Overview.
2b
If the driver set is not listed on the Driver Sets tab, use the Search In field to search for and display the driver set.
2c
Click the driver set to open the Driver Set Overview page.
3
Locate the ID Provider driver icon, then click the upper right corner of the driver icon to display the Actions menu.
4
Click Edit Properties to display the driver’s properties page.
By default, the properties page opens with the Driver Configuration tab displayed.
In Designer:
1
Open a project in the Modeler.
2
Right-click the driver icon or line, then select Properties > Global Configuration Values.
Driver Properties
37
38
Identity Manager 4.0.2 ID Provider Driver Implementation Guide
Download
Public link updated
The public link to your chat has been updated. You may view and manage your chat links after registration here.
Document public link
Advertisement
Key features
Centralized ID management
Unique ID generation
Policy-based ID creation
Integration with Identity Vault
Support for Java RMI clients
LDAP integration
Frequently asked questions
The ID Provider driver enables you to create and maintain a central source of unique IDs that can be consumed by client applications or systems.
When the driver receives an ID request from a client, it generates an ID based on policies you define, passes it to the client, and then stores it in the Identity Vault.
Java RMI (Remote Method Invocation)
