Novell IDENTITY MANAGER 3.6. - INTEGRATION Quick setup guide

Novell®
www.novell.com
novdocx (en) 11 July 2008
AUTHORIZED DOCUMENTATION
Identity Manager 3.6 Integration Guide for Novell Audit
Identity Manager
3.6
July 23, 2008
Integration Guide For Novell Audit

novdocx (en) 11 July 2008
Legal Notices
Novell, Inc., makes no representations or warranties with respect to the contents or use of this documentation, and
specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose.
Further, Novell, Inc., reserves the right to revise this publication and to make changes to its content, at any time,
without obligation to notify any person or entity of such revisions or changes.
Further, Novell, Inc., makes no representations or warranties with respect to any software, and specifically disclaims
any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc.,
reserves the right to make changes to any and all parts of Novell software, at any time, without any obligation to
notify any person or entity of such changes.
Any products or technical information provided under this Agreement may be subject to U.S. export controls and the
trade laws of other countries. You agree to comply with all export control regulations and to obtain any required
licenses or classification to export, re-export or import deliverables. You agree not to export or re-export to entities on
the current U.S. export exclusion lists or to any embargoed or terrorist countries as specified in the U.S. export laws.
You agree to not use deliverables for prohibited nuclear, missile, or chemical biological weaponry end uses. See the
Novell International Trade Services Web page (http://www.novell.com/info/exports/) for more information on
exporting Novell software. Novell assumes no responsibility for your failure to obtain any necessary export
approvals.
Copyright © 2008 Novell, Inc. All rights reserved. No part of this publication may be reproduced, photocopied,
stored on a retrieval system, or transmitted without the express written consent of the publisher.
Novell, Inc., has intellectual property rights relating to technology embodied in the product that is described in this
document. In particular, and without limitation, these intellectual property rights may include one or more of the U.S.
patents listed on the Novell Legal Patents Web page (http://www.novell.com/company/legal/patents/) and one or
more additional patents or pending patent applications in the U.S. and in other countries.
Novell, Inc.
404 Wyman Street, Suite 500
Waltham, MA 02451
U.S.A.
www.novell.com
Online Documentation: To access the latest online documentation for this and other Novell products, see
the Novell Documentation Web page (http://www.novell.com/documentation).

novdocx (en) 11 July 2008
Novell Trademarks
For Novell trademarks, see the Novell Trademark and Service Mark list (http://www.novell.com/company/legal/
trademarks/tmlist.html).
Third-Party Materials
All third-party trademarks are the property of their respective owners.

novdocx (en) 11 July 2008

Contents 5
Contents
novdocx (en) 11 July 2008
About This Guide 7
1Overview 9
1.1 Novell Audit Integrated Architecture. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
2 Installing and Configuring Novell Audit 11
2.1 Installing Novell Audit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
2.2 Configuring the Secure Logging Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
2.3 Configuring the Data Store. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
2.4 Configuring System Notifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
3 Installing and Configuring the Platform Agent 13
3.1 Installing the Platform Agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
3.2 Configuring the Platform Agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
4 Managing Identity Manager Events 17
4.1 Selecting Events to Log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
4.1.1 Selecting Events for the User Application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
4.1.2 Selecting Events for the Driver Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
4.1.3 Selecting Events for a Specific Driver . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
4.1.4 Identity Manager Log Levels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
4.2 User-Defined Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
4.2.1 Using Policy Builder to Generate Events. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
4.2.2 Using Status Documents to Generate Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
4.3 eDirectory Objects that Store Identity Manager Event Data. . . . . . . . . . . . . . . . . . . . . . . . . . . 25
5 Using Status Logs 27
5.1 Setting the Log Level and Maximum Log Size. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
5.1.1 Setting the Log Level and Log Size for the Driver Set . . . . . . . . . . . . . . . . . . . . . . . . 27
5.1.2 Setting the Log Level and Log Size for the Driver . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
5.2 Viewing Status Logs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
5.2.1 Accessing the Driver Set Status Log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
5.2.2 Accessing the Publisher Channel and Subscriber Channel Status Logs . . . . . . . . . 30
6 Securing the Connection with Novell Audit 31
6.1 Updating the Novell Audit Certificate Infrastructure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
6.2 The Novell Audit AudCGen Utility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
6.3 Creating a Root Certificate for the Secure Logging Server . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
6.3.1 Creating a Self-Signed Root Certificate for the Secure Logging Server . . . . . . . . . . 35
6.3.2 Using a Third-Party Root Certificate for the Secure Logging Server . . . . . . . . . . . . . 35
6.4 Creating Logging Application Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
6.4.1 Enabling the Identity Manager Instrumentation to Use a Custom Certificate . . . . . . 36
6.5 Validating Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

6Identity Manager 3.6 Integration Guide for Novell Audit
novdocx (en) 11 July 2008
6.6 Securing Custom Certificates. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
6.6.1 Windows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
6.6.2 Linux and Solaris . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
A Identity Manager Events 39
A.1 Event Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
A.2 Error and Warning Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
A.3 Job Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
A.4 Remote Loader Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
A.5 Object Events. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
A.6 Password Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
A.7 Search List Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
A.8 Engine Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
A.9 Server Events. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
A.10 Security Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
A.11 Workflow Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
A.12 Driver Start and Stop Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
B Novell Audit Reports 43
B.1 Administrative Action Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
B.2 Historical Approval Flow Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
B.3 Resource Provisioning Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
B.4 Specific User Audit Trail Report I . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
B.5 Specific User Audit Trail Report II . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
B.6 Specific User Audit Trail III. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
B.7 Specific User Provisioning Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
B.8 User Provisioning Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56

About This Guide 7
novdocx (en) 11 July 2008
About This Guide
Welcome to the Novell®Identity Manager Integration Guide for Novell Audit. This guide provides
the information necessary to integrate Novell Audit with Identity Manager to provide auditing and
reporting services for Identity Manager.
Chapter 1, “Overview,” on page 9
Chapter 2, “Installing and Configuring Novell Audit,” on page 11
Chapter 3, “Installing and Configuring the Platform Agent,” on page 13
Chapter 4, “Managing Identity Manager Events,” on page 17
Chapter 5, “Using Status Logs,” on page 27
Chapter 6, “Securing the Connection with Novell Audit,” on page 31
Appendix A, “Identity Manager Events,” on page 39
Appendix B, “Novell Audit Reports,” on page 43
Audience
This guide is intended for network administrators.
Feedback
We want to hear your comments and suggestions about this manual and the other documentation
included with this product. Please use the User Comments feature at the bottom of each page of the
online documentation, or go to www.novell.com/documentation/feedback.html and enter your
comments there.
Documentation Updates
For the most recent version of the Identity Manager 3.6 Integration Guide for Novell Audit, visit the
Identity Manager Documentation Web site (http://www.novell.com/documentation/idm36).
Additional Documentation
For the current Novell Audit documentation, see the Novell Audit Documentation Web site (http://
www.novell.com/documentation/novellaudit20/index.html).
Documentation Conventions
In Novell documentation, a greater-than symbol (>) is used to separate actions within a step and
items in a cross-reference path.
A trademark symbol (®, TM, etc.) denotes a Novell trademark. An asterisk (*) denotes a third-party
trademark.
When a single pathname can be written with a backslash for some platforms or a forward slash for
other platforms, the pathname is presented with a backslash. Users of platforms that require a
forward slash, such as Linux* or UNIX*, should use forward slashes as required by your software.

8Identity Manager 3.6 Integration Guide for Novell Audit
novdocx (en) 11 July 2008

Overview
1
9
novdocx (en) 11 July 2008
1
Overview
Adding Novell®Audit to you Identity Manager solution provides auditing and reporting services.
By adding auditing and reporting, you can demonstrate that the business policies are implemented as
designed with your Identity Manager solution.
1.1 Novell Audit Integrated Architecture
The following diagram illustrates the Identity Manager logging and reporting architecture when
integrated with Novell Audit.
Figure 1-1 Identity Manager and Novell Audit Integrated Architecture
1. An Identity Manager event occurs and it is sent to the Platform Agent. To capture all Identity
Manager events, the Platform Agent must be installed and configured on each Identity Manager
server.
2. (Conditional) If the Platform Agent cannot connect to the Secure Logging Server, the events
are stored in cache until the connection is reestablished.
3. The Platform Agents sends the event to the Secure Logging Server.
4. The Secure Logging Server sends the events to eDirectoryTM. Through iManager, you configure
the objects that store the events.
5. The Secure Logging Server sends the event to the data store, which stores the events. The data
store is a database that stores the events until they are needed.
The stored events are displayed through Novell Audit reports and iManager queries.
For more information about the Novell Audit architecture, see “System Architecture” in the Novell
Audit 2.0 Administration Guide.
eDirectory
Secure Logging
Server
Identity
Manager
Platform
Agent
Events
Cache
When disconnected
from the Secure
Logging Server
When reconnected
to the Secure
Logging Server
Configuration
data via
iManager
Novell Audit
Report
iManager
Queries
Crystal
Reports
Data Store
Port 289

10 Identity Manager 3.6 Integration Guide for Novell Audit
novdocx (en) 11 July 2008