Novell IDENTITY MANAGER 3.6.1 User manual

Novell®
www.novell.com
novdocx (en) 17 September 2009
AUTHORIZED DOCUMENTATION
Identity Manager 3.6.1 Installation Guide
Identity Manager
3.6.1
January 05, 2010
Installation Guide

novdocx (en) 17 September 2009
Legal Notices
Novell, Inc. makes no representations or warranties with respect to the contents or use of this documentation, and
specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose.
Further, Novell, Inc. reserves the right to revise this publication and to make changes to its content, at any time,
without obligation to notify any person or entity of such revisions or changes.
Further, Novell, Inc. makes no representations or warranties with respect to any software, and specifically disclaims
any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc.
reserves the right to make changes to any and all parts of Novell software, at any time, without any obligation to
notify any person or entity of such changes.
Any products or technical information provided under this Agreement may be subject to U.S. export controls and the
trade laws of other countries. You agree to comply with all export control regulations and to obtain any required
licenses or classification to export, re-export, or import deliverables. You agree not to export or re-export to entities
on the current U.S. export exclusion lists or to any embargoed or terrorist countries as specified in the U.S. export
laws. You agree to not use deliverables for prohibited nuclear, missile, or chemical biological weaponry end uses.
Please refer to the International Trade Services (http://www.novell.com/company/policies/trade_services) for more
information on exporting Novell software. Novell assumes no responsibility for your failure to obtain any necessary
export approvals.
Copyright © 2007-2010 Novell, Inc. All rights reserved. No part of this publication may be reproduced, photocopied,
stored on a retrieval system, or transmitted without the express written consent of the publisher.
Novell, Inc. has intellectual property rights relating to technology embodied in the product that is described in this
document. In particular, and without limitation, these intellectual property rights may include one or more of the U.S.
patents listed on the Novell Legal Patents Web page (http://www.novell.com/company/legal/patents/) and one or
more additional patents or pending patent applications in the U.S. and in other countries.
Novell, Inc.
404 Wyman Street, Suite 500
Waltham, MA 02451
U.S.A.
www.novell.com
Online Documentation: To access the latest online documentation for this and other Novell products, see
the Novell Documentation Web page (http://www.novell.com/documentation).

novdocx (en) 17 September 2009
Novell Trademarks
For Novell trademarks, see the Novell Trademark and Service Mark list (http://www.novell.com/company/legal/
trademarks/tmlist.html).
Third-Party Materials
All third-party trademarks are the property of their respective owners.

4Identity Manager 3.6.1 Installation Guide
novdocx (en) 17 September 2009

Contents 5
Contents
novdocx (en) 17 September 2009
About This Guide 9
Part I Planning 11
1 Setting Up a Development Environment 13
2 Creating a Project Plan 15
2.1 Discovery Phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
2.1.1 Defining Current Business Processes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
2.1.2 Defining How the Identity Manager Solution Affects the Current Business
Processes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
2.1.3 Identifying the Key Business and Technical Stakeholders . . . . . . . . . . . . . . . . . . . . 18
2.1.4 Interviewing All Stakeholders. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
2.1.5 Creating a High-level Strategy and an Agreed Execution Path . . . . . . . . . . . . . . . . . 18
2.2 Requirements and Design Analysis Phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
2.2.1 Define the Business Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
2.2.2 Analyze Your Business Processes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
2.2.3 Design an Enterprise Data Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
2.3 Proof of Concept . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
2.4 Data Validation and Preparation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
2.5 Production Pilot . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
2.6 Production Rollout Planning. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
2.7 Production Deployment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
3 Technical Guidelines 27
3.1 Management Tools Guidelines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
3.1.1 Designer Guidelines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
3.1.2 iManager Guidelines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
3.2 Metadirectory Server Guidelines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
3.3 eDirectory Guidelines. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
3.3.1 Identity Manager Objects in eDirectory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
3.3.2 Replicating the Objects that Identity Manager Needs on the Server . . . . . . . . . . . . . 31
3.3.3 Using Scope Filtering to Manage Users on Different Servers . . . . . . . . . . . . . . . . . 32
3.4 User Application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
3.5 Auditing and Reporting Guidelines. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Part II Installation 37
4 Basic Identity Manager System Checklist 39
4.1 Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
4.2 Planning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
4.3 Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
4.4 Driver Configuration with the Remote Loader . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
4.5 Driver Configuration without the Remote Loader . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
4.6 Additional Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

6Identity Manager 3.6.1 Installation Guide
novdocx (en) 17 September 2009
5 Where to Get Identity Manager 43
6 System Requirements 45
6.1 eDirectory and iManager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
6.2 Metadirectory Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
6.2.1 Supported Processors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
6.2.2 Server Operating Systems. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
6.3 Remote Loader . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
6.4 User Application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
6.5 Auditing and Reporting. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
6.6 Workstations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
6.6.1 Workstation Platforms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
6.6.2 iManager and Web Browsers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
7 Installing Identity Manager 55
7.1 Installing Designer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
7.2 Installing the Metadirectory Server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
7.2.1 Nonroot Installation of the Metadirectory Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
7.2.2 Silent Installation of the Metadirectory Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
7.3 Installing the Remote Loader . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
7.3.1 Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
7.3.2 Supported Drivers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
7.3.3 Installation Procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
7.3.4 Silent Installation of the Remote Loader . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
7.3.5 Installing the Java Remote Loader on UNIX, Linux, or AIX . . . . . . . . . . . . . . . . . . . . 63
7.4 Installing the Roles Based Provisioning Module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
7.5 Installing a Custom Driver . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
7.6 Installing Identity Audit or Sentinel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
7.7 Installing Identity Manager in Clustering Environment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
8 Activating Novell Identity Manager Products 65
8.1 Purchasing an Identity Manager Product License . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
8.2 Installing a Product Activation Credential . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
8.3 Viewing Product Activations for Identity Manager and for Drivers . . . . . . . . . . . . . . . . . . . . . . 66
9 Troubleshooting Identity Manager 67
Part III Upgrading 69
10 What’s New 71
10.1 Support for 64-Bit Operating Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
10.2 Support for 32-Bit Remote Loader Installation on 64-Bit Operating Systems . . . . . . . . . . . . . 71
10.3 Identity Manager Driver for SAP Portal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
10.4 Updated Identity Manager Driver for SAP HR and Identity Manager Driver for SAP User
Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
11 Supported Versions for Upgrades and System Requirements 73
11.1 Supported Versions for Upgrades . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73

Contents 7
novdocx (en) 17 September 2009
11.2 System Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
12 In-place Upgrade Versus Migration 75
12.1 In-place Upgrade . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
12.2 Migration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
12.3 Multiple Servers Associated with a Single Driver Set. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
13 Performing an In-place Upgrade 77
13.1 Creating a Backup of the Current Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
13.1.1 Ensuring that Your Designer Project is Current. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
13.1.2 Creating an Export of the Drivers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
13.2 Stopping the Drivers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
13.2.1 Using Designer to Stop the Drivers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
13.2.2 Using iManager to Stop the Drivers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
13.3 Adding Files to the Correct Location on Linux/UNIX Platforms . . . . . . . . . . . . . . . . . . . . . . . . 82
13.4 Upgrading Designer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
13.5 Upgrading the Metadirectory Engine and Driver Configuration Files . . . . . . . . . . . . . . . . . . . . 83
13.6 Upgrading the Remote Loader . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
13.7 Overlaying the New Driver Configuration File over the Existing Driver . . . . . . . . . . . . . . . . . . 84
13.7.1 Using Designer to Overlay the New Driver Configuration File over the Existing
Driver . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84
13.7.2 Using iManager to Overlay the New Driver Configuration File over the Existing
Driver . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
13.8 Restoring Custom Policies and Rules to the Driver . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
13.8.1 Using Designer to Restore Custom Policies and Rules to the Driver . . . . . . . . . . . . 85
13.8.2 Using iManager to Restore Custom Policies and Rules to the Driver . . . . . . . . . . . . 86
13.9 Deploying the Converted Project . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
13.10 Starting the Drivers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
13.10.1 Using Designer to Start the Drivers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
13.10.2 Using iManager to Start the Drivers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
14 Performing a Migration 89
14.1 Adding the New Server to the Driver Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90
14.2 Changing Server-Specific Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90
14.2.1 Changing the Server-Specific Information in Designer . . . . . . . . . . . . . . . . . . . . . . . 91
14.2.2 Changing the Server-Specific Information in iManager . . . . . . . . . . . . . . . . . . . . . . . 91
14.3 Removing the Old Server from the Driver Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92
14.3.1 Using Designer to Remove the Old Server from the Driver Set. . . . . . . . . . . . . . . . . 92
14.3.2 Using iManager to Remove the Old Server from the Driver Set . . . . . . . . . . . . . . . . 92
14.3.3 Decommissioning the Old Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93
Part IV Uninstalling Identity Manager 95
15 Removing Objects from eDirectory 97
16 Uninstalling the Metadirectory Server and Drivers 99
16.1 Uninstalling on Windows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
16.2 Uninstalling on Linux/UNIX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99

8Identity Manager 3.6.1 Installation Guide
novdocx (en) 17 September 2009
17 Uninstalling Designer 101
A Documentation Updates 103
A.1 July 31, 2009 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103
A.1.1 What’s New . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103

About This Guide 9
novdocx (en) 17 September 2009
About This Guide
Novell®Identity Manager is a data sharing and synchronization service that enables applications,
directories, and databases to share information. It links scattered information and enables you to
establish policies that govern automatic updates to designated systems when identity changes occur.
Identity Manager provides the foundation for account provisioning, security, single sign-on, user
self-service, authentication, authorization, automated workflow, and Web services. It allows you to
integrate, manage, and control your distributed identity information so you can securely deliver the
right resources to the right people.
This guide contains information about how to plan, install, or upgrade an Identity Manager system
that is useful for your environment.
Part I, “Planning,” on page 11
Chapter 2, “Creating a Project Plan,” on page 15
Chapter 3, “Technical Guidelines,” on page 27
Part II, “Installation,” on page 37
Chapter 4, “Basic Identity Manager System Checklist,” on page 39
Chapter 5, “Where to Get Identity Manager,” on page 43
Chapter 6, “System Requirements,” on page 45
Chapter 7, “Installing Identity Manager,” on page 55
Chapter 8, “Activating Novell Identity Manager Products,” on page 65
Part III, “Upgrading,” on page 69
Chapter 10, “What’s New,” on page 71
Chapter 11, “Supported Versions for Upgrades and System Requirements,” on page 73
Chapter 12, “In-place Upgrade Versus Migration,” on page 75
Chapter 13, “Performing an In-place Upgrade,” on page 77
Chapter 14, “Performing a Migration,” on page 89
Part IV, “Uninstalling Identity Manager,” on page 95
Chapter 15, “Removing Objects from eDirectory,” on page 97
Chapter 16, “Uninstalling the Metadirectory Server and Drivers,” on page 99
Audience
This guide is intended for administrators, consultants, and network engineers who plan and
implement Identity Manager in a network environment.
Documentation Updates
For the most recent version of this document, see the Identity Manager Documentation Web site
(http://www.novell.com/documentation/idm361/index.html).

10 Identity Manager 3.6.1 Installation Guide
novdocx (en) 17 September 2009
Additional Documentation
For additional Identity Manager documentation, see the Identity Manager Documentation Web site
(http://www.novell.com/documentation/idm361/index.html).
For User Application documentation, see the Identity Manager Roles Based Provisioning Module
Documentation Web site (http://www.novell.com/documentation/idmrbpm361/index.html).
Documentation Conventions
In Novell documentation, a greater-than symbol (>) is used to separate actions within a step and
items in a cross-reference path.
A trademark symbol (®, TM, etc.) denotes a Novell trademark. An asterisk (*) denotes a third-party
trademark.
When a single pathname can be written with a backslash for some platforms or a forward slash for
other platforms, the pathname is presented with a backslash. Users of platforms that require a
forward slash, such as Linux* or UNIX*, should use forward slashes as required by your software.