Novell IDENTITY MANAGER 3.6.1 Installation guide

Novell®
www.novell.com
novdocx (en) 13 May 2009
AUTHORIZED DOCUMENTATION
Identity Manager 3.6.1 Overview
Identity Manager
3.6.1
June 05, 2009
Overview

novdocx (en) 13 May 2009
Legal Notices
Novell, Inc. makes no representations or warranties with respect to the contents or use of this documentation, and
specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose.
Further, Novell, Inc. reserves the right to revise this publication and to make changes to its content, at any time,
without obligation to notify any person or entity of such revisions or changes.
Further, Novell, Inc. makes no representations or warranties with respect to any software, and specifically disclaims
any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc.
reserves the right to make changes to any and all parts of Novell software, at any time, without any obligation to
notify any person or entity of such changes.
Any products or technical information provided under this Agreement may be subject to U.S. export controls and the
trade laws of other countries. You agree to comply with all export control regulations and to obtain any required
licenses or classification to export, re-export, or import deliverables. You agree not to export or re-export to entities
on the current U.S. export exclusion lists or to any embargoed or terrorist countries as specified in the U.S. export
laws. You agree to not use deliverables for prohibited nuclear, missile, or chemical biological weaponry end uses.
Please refer to the International Trade Services (http://www.novell.com/company/policies/trade_services) for more
information on exporting Novell software. Novell assumes no responsibility for your failure to obtain any necessary
export approvals.
Copyright © 2008-2009 Novell, Inc. All rights reserved. No part of this publication may be reproduced, photocopied,
stored on a retrieval system, or transmitted without the express written consent of the publisher.
Novell, Inc. has intellectual property rights relating to technology embodied in the product that is described in this
document. In particular, and without limitation, these intellectual property rights may include one or more of the U.S.
patents listed on the Novell Legal Patents Web page (http://www.novell.com/company/legal/patents/) and one or
more additional patents or pending patent applications in the U.S. and in other countries.
Novell, Inc.
404 Wyman Street, Suite 500
Waltham, MA 02451
U.S.A.
www.novell.com
Online Documentation: To access the latest online documentation for this and other Novell products, see
the Novell Documentation Web page (http://www.novell.com/documentation).

novdocx (en) 13 May 2009
Novell Trademarks
For Novell trademarks, see the Novell Trademark and Service Mark list (http://www.novell.com/company/legal/
trademarks/tmlist.html).
Third-Party Materials
All third-party trademarks are the property of their respective owners.

4Identity Manager 3.6.1 Overview
novdocx (en) 13 May 2009

Contents 5
Contents
novdocx (en) 13 May 2009
About This Guide 7
1 Identity Manager and Business Process Automation 9
1.1 Data Synchronization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
1.2 Workflow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
1.3 Roles and Attestation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
1.4 Self-Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
1.5 Auditing and Reporting. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
2 Identity Manager Architecture 19
2.1 Data Synchronization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
2.1.1 Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
2.1.2 Key Concepts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
2.2 Workflow, Roles, Attestation, and Self-Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
2.2.1 Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
2.2.2 Key Concepts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
2.3 Auditing and Reporting. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
3 Identity Manager Tools 29
3.1 Designer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
3.2 iManager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
3.3 User Application Administration Console . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

6Identity Manager 3.6.1 Overview
novdocx (en) 13 May 2009

About This Guide 7
novdocx (en) 13 May 2009
About This Guide
This guide introduces you to the business issues that Novell®Identity Manager can help you solve
and provides a technical overview of the Identity Manager software components and tools you can
use in your solution. The guide is organized as follows:
Chapter 1, “Identity Manager and Business Process Automation,” on page 9
Chapter 2, “Identity Manager Architecture,” on page 19
Chapter 3, “Identity Manager Tools,” on page 29
Audience
This guide is intended for administrators, consultants, and network engineers who require a high-
level introduction to Identity Manager business solutions, technologies, and tools.
Documentation Updates
For the most recent version of this document, see the Identity Manager Documentation Web site
(http://www.novell.com/documentation/idm36/index.html).
Additional Documentation
For documentation on other Identity Manager drivers, see the Identity Manager Drivers Web site
(http://www.novell.com/documentation/idm36drivers/index.html).
Documentation Conventions
In Novell documentation, a greater-than symbol (>) is used to separate actions within a step and
items in a cross-reference path.
A trademark symbol (®, TM, etc.) denotes a Novell trademark. An asterisk (*) denotes a third-party
trademark.
When a single pathname can be written with a backslash for some platforms or a forward slash for
other platforms, the pathname is presented with a backslash. Users of platforms that require a
forward slash, such as Linux* or UNIX*, should use forward slashes as required by your software.

8Identity Manager 3.6.1 Overview
novdocx (en) 13 May 2009

Identity Manager and Business Process Automation
1
9
novdocx (en) 13 May 2009
1
Identity Manager and Business
Process Automation
The following information identifies some of the business processes you can automate through the
implementation of a Novell®Identity Manager system. If you are already aware of the business
automation solutions provided by Identity Manager, you might want to skip to the technical
introduction provided in Chapter 2, “Identity Manager Architecture,” on page 19.
Managing identity needs is a core function of most businesses. For example, imagine that it’s early
Monday morning. You scroll down the list of requests in your queue:
Jim Taylor’s cell phone number has changed. You need to update it in the HR database and four
other independent systems.
Karen Hansen, just returning from an extended leave of absence, has forgotten her e-mail
password. You need to help her retrieve or reset it.
Jose Altimira just hired a new employee. You need to give the employee network access and an
e-mail account.
Ida McNamee wants access to the Oracle* financial database, which requires you to get
approval from three different managers.
John Harris just moved from the Accounts Payable department to the Legal department. You
need to give him access to the same resources as the other members of the Legal team and
remove his access to Accounts Payable resources.
Karl Jones, your own boss, saw a copy of Ida McNamee’s request for access to the Oracle
financial database and is concerned about the number of people with access. You need to
generate a report for him that shows everyone who has access to the database.
You take a deep breath and start in on the first request, knowing that you’ll be hard-pressed to keep
up with all of the requests, let alone have time to finish the other projects assigned to you.
If this sounds like a common workday for you or someone in your organization, Identity Manager
can help. In fact, the core Identity Manager capabilities, introduced in the following illustration, can
help you automate all of these tasks and more. Centered on multi-system data synchronization
driven by your business policies, the capabilities—workflow, roles, attestation, self-service,
auditing, and reporting—combine to automate the processes involved in provisioning users and
managing passwords, two of the most difficult and time-consuming duties of an IT organization.

10 Identity Manager 3.6.1 Overview
novdocx (en) 13 May 2009
Figure 1-1 Identity Manager Core Capabilities
The following sections introduce you to these Identity Manager capabilities and how they can help
you successfully meet the identity needs of your organization:
Section 1.1, “Data Synchronization,” on page 10
Section 1.2, “Workflow,” on page 13
Section 1.3, “Roles and Attestation,” on page 14
Section 1.4, “Self-Service,” on page 15
Section 1.5, “Auditing and Reporting,” on page 16
1.1 Data Synchronization
If your organization is like most, you have identity data stored in multiple systems. Or, you have
identity data stored in one system that you could really use in another system. Either way, you need
to be able to easily share and synchronize data between systems.
Identity Manager lets you synchronize, transform, and distribute information across a wide range of
applications, databases, operating systems, and directories such as SAP*, PeopleSoft*, Lotus
Notes*, Microsoft* Exchange, Microsoft Active Directory*, Novell eDirectoryTM, Linux and UNIX,
and LDAP directories.
Workflow Self-ServiceRoles & Attestation
Auditing Reporting
Data Synchronization

Identity Manager and Business Process Automation 11
novdocx (en) 13 May 2009
Figure 1-2 Identity Manager Connecting Multiple Systems
You control the flow of data among the connected systems. Among other things, you determine what
data is shared, which system is the authoritative source for a piece of data, and how the data is
interpreted and transformed to meet the requirements of other systems.
In the following diagram, the SAP HR database is the authoritative source for a user’s telephone
number. The Lotus Notes system also uses telephone numbers, so Identity Manager transforms the
number into the required format and shares it with the Lotus Notes system. Whenever the telephone
number changes in the SAP HR system, it is synchronized to the Lotus Notes system.
Figure 1-3 Data Synchronization between Connected Systems
Managing data for existing users is just the beginning of the data synchronization capabilities of
Identity Manager. In addition, Identity Manager can create new user accounts and remove existing
accounts in directories such as Active Directory, systems such as PeopleSoft and Lotus Notes, and
operating systems such as UNIX and Linux. For example, when you add a new employee to your
SAP HR system, Identity Manager can automatically create a new user account in Active Directory,
a new account in Lotus Notes, and a new account in a Linux NIS account management system.
Identity
Manager
PeopleSoft
Lotus Notes
SAP Novell
eDirectory
Linux LDAP
Directory
Microsoft
Active
Directory
Microsoft
Exchange
Identity
Manager
SAP
801/555-1234 [phone]
Lotus Notes

12 Identity Manager 3.6.1 Overview
novdocx (en) 13 May 2009
Figure 1-4 User Account Creation in Connected Systems
As part of its data synchronization capability, Identity Manager can also help you synchronize
passwords between systems. For example, if a user changes his or her password in Active Directory,
Identity Manager can synchronize that password to Lotus Notes and Linux.
Identity
Manager
Lotus Notes
SAP
User A
User A User A User A
Linux Active
Directory

Identity Manager and Business Process Automation 13
novdocx (en) 13 May 2009
Figure 1-5 Password Synchronization among Connected Systems
1.2 Workflow
More than likely, user access to many of the resources in your organization doesn’t require anyone’s
approval. However, access to other resources might be restricted and require approval from one or
more individuals.
Identity Manager provides workflow capabilities to ensure that your provisioning processes involve
the appropriate resource approvers. For example, assume that John, who has already been
provisioned with an Active Directory account, needs access to some financial reports through Active
Directory. This requires approval from both John’s immediate manager and the CFO. Fortunately,
you’ve set up an approval workflow that routes John’s request to his manager and, after approval
from his manager, to the CFO. Approval by the CFO triggers automatic provisioning of the Active
Directory rights needed by John to access and view the financial documents.
Lotus Notes
User A
User A User A
Linux
Active
Directory
Password: Novell
Password: Novell Password: Novell
Identity
Manager

14 Identity Manager 3.6.1 Overview
novdocx (en) 13 May 2009
Figure 1-6 Approval Workflow for User Provisioning
Workflows can be initiated automatically whenever a certain event occurs (for example, a new user
is added to your HR system) or initiated manually through a user request. To ensure that approvals
take place in a timely manner, you can set up proxy approvers and approval teams.
1.3 Roles and Attestation
Oftentimes, users require access to resources based upon their roles in the organization. For
example, a law firm’s attorneys might require access to a different set of resources than the firm’s
paralegals.
Identity Manager lets you provision users based on their roles in the organization. You define the
roles and make the assignments according to your organizational needs. When a user is assigned to a
role, Identity Manager provisions the user with access to the resources associated with the role. If a
user is assigned multiple roles, he or she receives access to the resources associated with all of the
roles, as shown in the following illustration.
Figure 1-7 Role-Based Provisioning of Resources
Request
Issued
Request
Approved
Request
Approved
Request
Granted
John John’s
Manager
CFO
Active
Directory
John
John
Attorney Role
John
Manager Role
Added to
Roles
Resource 1
Resource 2
Resource 3
Resource 4
Resource 5

Identity Manager and Business Process Automation 15
novdocx (en) 13 May 2009
You can have users automatically added to roles as a result of events that occur in your organization
(for example, a new user being added to your SAP HR database with the job title of Attorney). If
approval is required for a user to be added to a role, you can establish workflows to route role
requests to the appropriate approvers. You can also manually assign users to roles.
In some cases, you might have roles that should not be assigned to the same person because the roles
conflict. Identity Manager provides Separation of Duties functionality that lets you prevent users
from being assigned to conflicting roles unless someone in your organization makes an exception
for the conflict.
Because role assignments determine a user’s access to resources within your organization, ensuring
correct assignments is critical. Incorrect assignments could jeopardize compliance with both
corporate and government regulations. Identity Manager helps you validate the correctness of your
role assignments through an attestation process. Using this process, responsible individuals within
your organization certify the data associated with roles:
User profile attestation: Selected users attest to their own profile information (first name, last
name, title, department, e-mail, and so forth) and correct any incorrect information. Accurate
profile information is essential to correct role assignments.
Separation of Duties violation attestation: Responsible individuals review a Separation of
Duties violation report and attest to the accuracy of the report. The report lists any exceptions
that allow a user to be assigned conflicting roles.
Role assignment attestation: Responsible individuals review a report listing selected roles
and the users, groups, and roles assigned to each role. The responsible individuals must then
attest to the accuracy of the information.
User assignment attestation: Responsible individuals review a report listing selected users
and the roles to which they are assigned. The responsible individuals must then attest to the
accuracy of the information.
These attestation reports are designed primarily to help you ensure that role assignments are
accurate and that there are valid reasons for allowing exceptions for conflicting roles.
1.4 Self-Service
You probably have business managers and departments clamoring to manage their own users’
information and access needs instead of relying on you or your staff. How many times have you
heard “Why can’t I change my own cell phone number in our corporate directory?” or “I’m in the
Marketing department. Why do I have to call the Help Desk to get access to the Marketing
Information database?”
With Identity Manager, you can delegate administrative duties to the people who should be
responsible for them. For example, you can enable individual users to:
Manage their own personal data in the corporate directory. Rather than having you change a
cell phone number, they can change it in one place and have it changed in all the systems
you’ve synchronized through Identity Manager.

16 Identity Manager 3.6.1 Overview
novdocx (en) 13 May 2009
Change their passwords, set up a hint for forgotten passwords, and set up challenge questions
and responses for forgotten passwords. Rather than asking you to reset a password because
they’ve forgotten it, they can do it themselves after receiving a hint or responding to a
challenge question.
Request access to resources such as databases, systems, and directories. Rather than calling you
to request access to an application, they can select the application from a list of available
resources.
In addition to self-service for individual users, Identity Manager provides self-service administration
for functions (management, Help Desk, and so forth) that are responsible for assisting, monitoring,
and approving user requests. For example, consider the scenario used in Section 1.2, “Workflow,”
on page 13 and shown below.
Figure 1-8 Provisioning Workflow with Self-Service
Not only does John use the Identity Manager self-service capability to request access to the
documents he needs, but John’s manager and the CFO use the self-service capability to approve the
request. The established approval workflow allows John to initiate and monitor the progress of his
request and allows John’s manager and CFO to respond to his request. Approval of the request by
John’s manager and the CFO triggers the provisioning of the Active Directory rights needed by John
to access and view the financial documents.
1.5 Auditing and Reporting
Without Identity Manager, provisioning users can be a tedious, time-consuming, and costly effort.
That effort, however, can pale in comparison to verifying that your provisioning activities have
complied with your organization’s policies, requirements, and regulations. Do the right people have
access to the right resources? Are the wrong people shut out of those same resources? Does the
employee who started yesterday have access to the network, his e-mail, and the six other systems
required for his job? Has the access been canceled for the employee who left last week?
Request
Issued
Request
Approved
Request
Approved
Request
Granted
John John’s
Manager
CFO
Active
Directory

Identity Manager and Business Process Automation 17
novdocx (en) 13 May 2009
With Identity Manager, you can relax in your knowledge that all of your user provisioning activities
are being tracked and logged for auditing purposes. Identity Manager issues event messages for all
activities that occur. By using Novell SentinelTM, you can collect these messages in order to generate
the following types of reports:
All approval workflows over a specific period of time, with the actions (started, forwarded,
denied, approved, and so forth) recorded for each workflow.
All resources provisioned over a specific period of time, with the actions (submitted, granted,
revoked, success, and so forth) recorded for each resource.
All workflow statuses, password changes, and administrative changes for a user over a specific
period of time.
All resource provisioning for a user over a specific period of time.
All resource provisioning for all users over a specific period of time.
Novell Sentinel is sold separately from Identity Manager.

18 Identity Manager 3.6.1 Overview
novdocx (en) 13 May 2009

Identity Manager Architecture
2
19
novdocx (en) 13 May 2009
2
Identity Manager Architecture
The following diagram shows the high-level architecture components that provide the Novell®
Identity Manager capabilities introduced in Chapter 1, “Identity Manager and Business Process
Automation,” on page 9: data synchronization, workflow, roles, attestation, self-service, and
auditing/reporting.
Figure 2-1 Identity Manager High-Level Architecture
Each of the components is introduced in the following sections:
Section 2.1, “Data Synchronization,” on page 20
Section 2.2, “Workflow, Roles, Attestation, and Self-Service,” on page 23
Section 2.3, “Auditing and Reporting,” on page 26
Remote
Loader
Auditing
Reporting
Data Synchronization
Workflow
Self-Service
Roles & Attestation
Metadirectory
Engine
Application
Novell
Sentinel
User
Application
Platform
Agent
Driver
Driver Driver
Application
Driver
User
Application
Driver
Role
Service
Driver
Identity
Vault

20 Identity Manager 3.6.1 Overview
novdocx (en) 13 May 2009
2.1 Data Synchronization
Data synchronization provides the foundation for automating business processes. In its simplest
form, data synchronization is the movement of data from the location where a data item is changed
to other locations where the data item is needed. For example, if an employee’s phone number is
changed in a company’s Human Resources system, the change would ideally appear automatically
in all other systems that store the employee’s phone number.
Identity Manager is not limited to the synchronization of identity data. Identity Manager can
synchronize any type of data stored in the connected application or in the Identity Vault.
Data synchronization, including password synchronization, is provided by the five base components
of the Identity Manager solution: the Identity Vault, Metadirectory engine, drivers, Remote Loader,
and connected applications. These components are shown in the following diagram.
Figure 2-2 Identity Manager Architecture Components
Data Synchronization
Remote
Loader
A
uditin
g
A
R
eportin
g
R
W
orkflow
W
S
el
f
-
S
ervice
S
R
oles
&
Attestation
R
Metadirectory
Engine
Application
Novel
l
S
entinel
U
se
r
A
pplication
P
l
a
t
fo
rm
Ag
en
t
Driver
Driver Driver
Application
Driver
U
se
r
A
pp
li
cat
i
o
n
D
r
i
ve
r
R
o
le
S
ervic
e
D
r
i
ve
r
Identity
Vault