Novell IDENTITY MANAGER 3.6.1 User manual

Novell®
www.novell.com
novdocx (en) 13 May 2009
AUTHORIZED DOCUMENTATION
Identity Manager 3.6 Security Guide
Identity Manager
3.6.1
June 05, 2009
Security Guide

novdocx (en) 13 May 2009
Legal Notices
Novell, Inc. makes no representations or warranties with respect to the contents or use of this documentation, and
specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose.
Further, Novell, Inc. reserves the right to revise this publication and to make changes to its content, at any time,
without obligation to notify any person or entity of such revisions or changes.
Further, Novell, Inc. makes no representations or warranties with respect to any software, and specifically disclaims
any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc.
reserves the right to make changes to any and all parts of Novell software, at any time, without any obligation to
notify any person or entity of such changes.
Any products or technical information provided under this Agreement may be subject to U.S. export controls and the
trade laws of other countries. You agree to comply with all export control regulations and to obtain any required
licenses or classification to export, re-export, or import deliverables. You agree not to export or re-export to entities
on the current U.S. export exclusion lists or to any embargoed or terrorist countries as specified in the U.S. export
laws. You agree to not use deliverables for prohibited nuclear, missile, or chemical biological weaponry end uses.
Please refer to the International Trade Services (http://www.novell.com/company/policies/trade_services) for more
information on exporting Novell software. Novell assumes no responsibility for your failure to obtain any necessary
export approvals.
Copyright © 2008-2009 Novell, Inc. All rights reserved. No part of this publication may be reproduced, photocopied,
stored on a retrieval system, or transmitted without the express written consent of the publisher.
Novell, Inc. has intellectual property rights relating to technology embodied in the product that is described in this
document. In particular, and without limitation, these intellectual property rights may include one or more of the U.S.
patents listed on the Novell Legal Patents Web page (http://www.novell.com/company/legal/patents/) and one or
more additional patents or pending patent applications in the U.S. and in other countries.
Novell, Inc.
404 Wyman Street, Suite 500
Waltham, MA 02451
U.S.A.
www.novell.com
Online Documentation: To access the latest online documentation for this and other Novell products, see
the Novell Documentation Web page (http://www.novell.com/documentation).

novdocx (en) 13 May 2009
Novell Trademarks
For Novell trademarks, see the Novell Trademark and Service Mark list (http://www.novell.com/company/legal/
trademarks/tmlist.html).
Third-Party Materials
All third-party trademarks are the property of their respective owners.

4Identity Manager 3.6 Security Guide
novdocx (en) 13 May 2009

Contents 5
Contents
novdocx (en) 13 May 2009
About This Guide 7
1 Security Best Practices 9
1.1 Using SSL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
1.2 Securing Directory Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
1.2.1 Granting Task-Based Access to Drivers and Driver Sets . . . . . . . . . . . . . . . . . . . . . 10
1.3 Managing Passwords . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
1.4 Creating Strong Password Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
1.5 Securing Connected Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
1.5.1 Password Generation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
1.6 Designer for Identity Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
1.7 Industry Best Practices for Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
1.8 Tracking Changes to Sensitive Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
1.8.1 Using iManager to Log Events. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
1.8.2 Using Designer to Log Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

6Identity Manager 3.6 Security Guide
novdocx (en) 13 May 2009

About This Guide 7
novdocx (en) 13 May 2009
About This Guide
This guide contains information about security best practices you might want to implement in your
Identity Manager environment. The guide is organized as follows:
Chapter 1, “Security Best Practices,” on page 9
Audience
This guide is intended for administrators, consultants, and network engineers who require a high-
level introduction to Identity Manager business solutions, technologies, and tools.
Documentation Updates
For the most recent version of this document, see the Identity Manager Documentation Web site
(http://www.novell.com/documentation/idm36/index.html).
Additional Documentation
For documentation on other Identity Manager drivers, see the Identity Manager Drivers Web site
(http://www.novell.com/documentation/idm36drivers/index.html).
Documentation Conventions
In Novell®documentation, a greater-than symbol (>) is used to separate actions within a step and
items in a cross-reference path.
A trademark symbol (®, TM, etc.) denotes a Novell trademark. An asterisk (*) denotes a third-party
trademark.
When a single pathname can be written with a backslash for some platforms or a forward slash for
other platforms, the pathname is presented with a backslash. Users of platforms that require a
forward slash, such as Linux* or UNIX*, should use forward slashes as required by your software.

8Identity Manager 3.6 Security Guide
novdocx (en) 13 May 2009

Security Best Practices
1
9
novdocx (en) 13 May 2009
1
Security Best Practices
The following sections provide information you should consider as you secure your Identity
Manager system:
Section 1.1, “Using SSL,” on page 9
Section 1.2, “Securing Directory Access,” on page 9
Section 1.3, “Managing Passwords,” on page 11
Section 1.4, “Creating Strong Password Policies,” on page 12
Section 1.5, “Securing Connected Systems,” on page 13
Section 1.7, “Industry Best Practices for Security,” on page 14
Section 1.8, “Tracking Changes to Sensitive Information,” on page 15
1.1 Using SSL
Enable SSL for all transports, where it is available. Enable SSL for communication between the
Metadirectory engine and Remote Loader and between the Metadirectory engine or Remote Loader
and the connected systems. For information, see “Creating a Secure Connection” in the Identity
Manager 3.6.1 Remote Loader Guide.
If you don't enable SSL, you are sending sensitive information such as passwords in the clear.
1.2 Securing Directory Access
Make sure that you secure access to Identity Vaults and to Identity Manager objects.
Physical Security: Protect access to the physical location of the servers where an Identity Vault is
installed.
File System Access: The security of the file system for Identity Manager is critical to ensuring the
security of the system as a whole. Verify that the directories containing eDirectoryTM, the
Metadirectory engine, and the Remote Loader are accessible only to the appropriate administrators.
There is an issue with the file system when the Remote Loader is installed on a Windows* 2000
server. For more information, see TID 3243550, Securing a Remote Loader Install on a Microsoft
Windows 2000 Server (http://www.novell.com/support/
search.do?cmd=displayKC&docType=kc&externalId=3243550&sliceId=SAL_Public&dialogID=4
7824778&stateId=0%200%2047832401).
Access Rights: Identity Manager requires Administrative rights to create Identity Manager objects
and configure drivers. Monitor and control who has rights to create or modify the following:
An Identity Manager driver set
An Identity Manager driver

10 Identity Manager 3.6 Security Guide
novdocx (en) 13 May 2009
Driver configuration objects (filters, style sheets, policies), especially policies that are used for
password retrieval or synchronization
Password policy objects (and the iManager task for editing them), because they control which
passwords are synchronized to each other, and which Password Self-Service options are used
1.2.1 Granting Task-Based Access to Drivers and Driver Sets
In addition to the eDirectory standard object-based access controls, Identity Manager lets you assign
trustee rights to perform only certain tasks on an Identity Manager driver, rather than just granting
full Supervisor rights to the driver object. For example, you can assign trustee rights so that one user
can only configure the driver object (create and modify object properties), while another user can
only start and stop the driver.
Identity Manager provides the following driver object attributes that enable role-based access:
Setting trustee rights to these attributes grants access to the associated Identity Manager verbs and
sub-verbs. Read access lets users view state (get verb state), and Write access lets users modify or
change state (set verb state.) For example, granting Read access to a driver object’s DirXML-
AccessRun attribute lets the user get the driver state (started or stopped.) Granting Write access lets
the user set the driver state (change from started to stopped, or vice versa.)
The goal of providing this attribute-based access to driver tasks is to let you create well-defined
administrative roles, perhaps using the eDirectory Administrative Role object, that let users perform
certain management tasks without exposing all management functionality. Creating these roles can
go beyond providing access to the DirXML-Access attributes described above and can include
access rights to other attributes, as well as access to other Identity Manager objects. The following
examples demonstrate the flexibility available for creating administrative roles:
Start/Stop Driver Admin: This administrative role lets the assigned user start and stop all drivers
in a given driver set. It requires the following access rights:
Browse rights to the Driver Set object
Read and Write access, with inheritance, to the DirXML-AccessRun attribute of the Driver Set
object
Driver Admin: This administrative role lets the assigned user manage a single Driver object. It
requires the following access rights:
Browse and Create rights to the Driver object
Attribute Description
DirXML-AccessRun Start and stop Identity Manager drivers and jobs
DirXML-AccessMigrate Manage migration operations into the Identity Vault
DirXML-AccessSubmitCommand Manage the driver’s pass-through commands
DirXML-AccessCheckObjectPassword Manage the driver’s check object password
commands
DirXML-AccessConfigure Manage the driver’s configuration and job
configuration
DirXML-AccessManage View and modify the driver’s cache file contents