Novell IDENTITY MANAGER 3.6.1 - STAGING BEST PRACTICES GUIDE... User manual

Novell®
www.novell.com
novdocx (en) 16 April 2010
AUTHORIZED DOCUMENTATION
Identity Manager 3.6.1 Staging Best Practices Guide
Identity Manager TM
3.6.1
June 24, 2010
Identity Manager 3.6.1 Staging Best Practices Guide

novdocx (en) 16 April 2010
Legal Notices
Novell, Inc. makes no representations or warranties with respect to the contents or use of this documentation, and
specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose.
Further, Novell, Inc. reserves the right to revise this publication and to make changes to its content, at any time,
without obligation to notify any person or entity of such revisions or changes.
Further, Novell, Inc. makes no representations or warranties with respect to any software, and specifically disclaims
any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc.
reserves the right to make changes to any and all parts of Novell software, at any time, without any obligation to
notify any person or entity of such changes.
Any products or technical information provided under this Agreement may be subject to U.S. export controls and the
trade laws of other countries. You agree to comply with all export control regulations and to obtain any required
licenses or classification to export, re-export, or import deliverables. You agree not to export or re-export to entities
on the current U.S. export exclusion lists or to any embargoed or terrorist countries as specified in the U.S. export
laws. You agree to not use deliverables for prohibited nuclear, missile, or chemical biological weaponry end uses.
Please refer to www.novell.com/info/exports/ for more information on exporting Novell software. Novell assumes no
responsibility for your failure to obtain any necessary export approvals.
Copyright © 2009-2010 Novell, Inc. All rights reserved. No part of this publication may be reproduced, photocopied,
stored on a retrieval system, or transmitted without the express written consent of the publisher.
Novell, Inc.
404 Wyman Street, Suite 500
Waltham, MA 02451
U.S.A.
www.novell.com
Online Documentation: To access the online documentation for this and other Novell products, and to get
updates, see www.novell.com/documentation.

novdocx (en) 16 April 2010
Novell Trademarks
For Novell trademarks, see the Novell Trademark and Service Mark list (http://www.novell.com/company/legal/
trademarks/tmlist.html).
Third-Party Materials
All third-party trademarks are the property of their respective owners.

4Identity Manager 3.6.1 Staging Best Practices Guide
novdocx (en) 16 April 2010

Contents 5
Contents
novdocx (en) 16 April 2010
About This Guide 7
1Overview 9
1.1 What is Staging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
1.2 Staging Use Cases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
2 Preparing for Staging 11
2.1 Identity Vault Structure. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
2.2 Drivers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
2.2.1 Driver Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
2.2.2 Using GCVs in Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
2.2.3 Simulation and Staging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
2.3 Objects That Designer Models. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
2.4 Objects That Designer Does Not Model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
2.5 Rights . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
2.5.1 Driver Equivalences. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
2.5.2 Roles Based Entitlements Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
2.5.3 Jobs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
3 Staging a Project 17
3.1 Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
3.1.1 Importing Objects. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
3.2 Staging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
3.3 Post-staging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
4 Best Practices in Moving Objects Across Stages 25

6Identity Manager 3.6.1 Staging Best Practices Guide
novdocx (en) 16 April 2010

About This Guide 7
novdocx (en) 16 April 2010
About This Guide
Welcome to Novell Identity Manager 3.6.1 Staging Best Practices Guide. This guide provides step-
by-step procedures to move your Identity Management solutions from one stage to the subsequent
stages.
This guide introduces the following:
Chapter 1, “Overview,” on page 9
Chapter 2, “Preparing for Staging,” on page 11
Chapter 3, “Staging a Project,” on page 17
Chapter 4, “Best Practices in Moving Objects Across Stages,” on page 25
Audience
The guide is intended for Identity Manager consultants and customers.
Feedback
We want to hear your comments and suggestions about this manual and the other documentation
included with this product. Please use the User Comments feature at the bottom of each page of the
online documentation, or go to www.novell.com/documentation/feedback.html and enter your
comments there.
Documentation Updates
For the most recent version of the Novell Identity Manager 3.6.1 Staging Best Practices Guide, visit
the Identity Manager Web site (http://www.novell.com/identity/access/identity_integration).
Additional Documentation
Understanding Designer for Identity Manager (http://www.novell.com/documentation/
designer30/designer_intro/data/front.html)
Identity Manager 3.6.1 Installation Guide (http://www.novell.com/documentation/idm36/
idm_install/data/front.html)
Understanding Policies for Identity Manager 3.6 (http://www.novell.com/documentation/
idm36/policy/data/bookinfo.html)
Policies in Designer 3.5 (http://www.novell.com/documentation/idm36/policy_designer/data/
bookinfo.html)
Novell Credential Provisioning for Identity Manager 3.6 (http://www.novell.com/
documentation/idm36/policy_credprov/data/bookinfo.html)
Identity Manager 3.6 DTD Reference (http://www.novell.com/documentation/idm36/
policy_dtd/data/bookinfo.html)
Identity Manager 3.6 Driver Guides (http://www.novell.com/documentation/idm36drivers/
index.html)

8Identity Manager 3.6.1 Staging Best Practices Guide
novdocx (en) 16 April 2010

Overview
1
9
novdocx (en) 16 April 2010
1
Overview
1.1 What is Staging
Software products need testing before they are deployed in an IT environment. Staging is a process
of development and testing software products. Staging provides users the flexibilty to validate
applications in real time to ensure uniformity across all stages.
Identity Manager staging is similar to any software deployment process. Nearly all the Identity
Manager projects operate in more than two stages, such as development, testing, and the production
environment.
Figure 1-1 Staging Movement
Figure 1-1 shows a basic representation of the movement of Identity Manager projects across
different stages. Three projects are developed and tested in three individual setups and then
connected in the next stage. The scale of projects grows with stages, but not necessarily the scale of
an individual driver.
Managing the movement of a tested solution across different stages and ensuring that nothing is left
out can be challenging for Identity Management consultants and customers. When Identity Manager
projects are moved from one stage to another, moving driver configurations becomes critical. To
successfully stage Identity Manager projects, certain other configurations must also be taken care of.
Novell Identity Manager Best Practices Staging Guide provides step-by-step procedures to move
your Identity Management solutions from one stage to the subsequent stages. The guide helps you to
reduce complexity in your Identity Manager deployment process, by helping you to test your
Identity Manager project at multiple stages before it is live.
In the following sections, you will find Designer at the center of discussion. As you already know,
Designer is critical to the Identity Manager project development, for developing policies, drivers,
PRDs, and so on. Designer is highly capable of bringing/creating the Identity Manager
configurations required for running an Identity Manager project and then deploying the

10 Identity Manager 3.6.1 Staging Best Practices Guide
novdocx (en) 16 April 2010
configuration on another Identity Manager deployment. You must make certain other changes that
are discussed in this guide. Designer can also export Identity Manager environments into a single
configuration file and use the file later in a different environment. You can also use any version
control system to distribute projects.
Before you begin to use this guide, you should be familiar with Identity Manager and Designer. As
you create projects, you should have a uniform Identity Vault design across all the states so that
common objects are available. Some objects are moved automatically by Designer, but others
should be moved explicitly to make them available in the next stage. See Chapter 2, “Preparing for
Staging,” on page 11 for more information.
Moving authorizations across stages is a key issue for an Identity Vault security model. eDirectoryTM
authorizations are assigned to individual objects or to a collection of objects. These authorizations
play an important role in the object security because they determine the permission to access the
object to which they have been assigned. eDirectory authorizations can be performed through
Access Control Lists (ACLs) or Security Equivalances/Exclude Roles. Drivers, jobs, RBEs, and so
on should have enough permissions to successfully perform the desired operations. See Chapter 2,
“Preparing for Staging,” on page 11 for more information.
1.2 Staging Use Cases
The staging discussion is centered on these scenarios:
New Deployment: New drivers and applications are developed during the development stage,
then they are tested and moved to the test setup. These applications are put together and moved
to the production setup.
Existing Deployment: You already have a development, test, and production setup ready and
you want to move a new policy from the development setup in the production setup.
Existing Deployment discussion is not scoped for the current version of this document.