Implementing Novell Nsure® Identity Manager 2.0.1

William Schneider

The University of Texas Health Science Center at Houston

Kevin Granhold

The University of Texas Health Science Center at Houston

Robert Price

Novell, Inc.

Rick Wagner

Novell, Inc.

Session Overview

What is Nsure Identity Manager?

General Features

Possible Sources and Destinations

Challenges we faced

Distributed Directory

Multiple Affiliations

Shared Administration

Why did we implement it over other tools?

Other products considered

Problems it solved for us

Session Overview Cont'd....

How did we implement it?

Overview of connected systems

Benefits gained

Additional Rules to Consider

Multivalued Attributes

Account Status

Custom Object Class

Exchange Provisioning

How can we expand for the future?

Additional Data Sources

Session Overview Cont'd....

Demonstration – An Account Life Cycle

Account Creation

Account Modification

Password Synchronization

Account Deactivation

Account Deletion

Question and Answer

Nsure Identity Manager Overview

What is Nsure Identity Manager?

Nsure Identity Manager is a data synchronization and integration platform that can be extended to any legacy or new application, database or directory.

Nsure Identity Manager allows you to manage all aspects of a persons digital identity and seamlessly distribute that identity to disparate systems.

How does Identity Manager work?

Uses drivers to connect to systems

Uses XML rule sets in the drivers to aggregate data

Configured via iManager

Connected Systems

Applications

Peoplesoft

SAP

Databases

IBM DB2

Informix

Microsoft SQL Server

MySQL

Oracle

Sybase

JDBC

Connected Systems Cont'd...

Directories

Critical Path InJoin Directory

IBM Directory Server (Secureway)

iPlanet Directory Server

Microsoft Active Directory

Netscape Directory Server

NIS

Novell eDirectory

Oracle Internet Directory

Sun ONE Directory Server

LDAP

Connected Systems Cont'd...

Email Systems

Microsoft Exchange 2000 \ 2003

Microsoft Exchange 5.5

Novell Groupwise®

Lotus Notes

Other

Delimited Text

Java Messaging Services (JMS) and IBM Websphere MQ

Remedy (for Help Desk)

Schools Interoperability Framework (SIF)

Connected Systems Cont'd...

Operating Systems

IBM AIX

Redhat Linux

Microsoft NT Domain

Solaris

UNIX Files - /etc/passwd

Mainframe

RACF

Driver Overview

Driver Overview

Challenges we faced

Distributed Administration

Medical School, Dental School, School of Nursing, School of Public Health, Graduate School of Biomedical Sciences, Institute of Molecular Medicine, Harris County Psyciatric Center, School of Health Information Sciences

Multiple Affiliations

Active Directory Forest with 6 child domains

High rate of change

Why we chose Nsure Identity Manager

Other Products Considered

Microsoft Identity Integration Server

Custom “home grown” application

Benefits

Easily configured and granular rule sets

Ability to connect to many different systems

Password synchronization across many systems

Self Service Password Resets

Very little actual “code”

Supportability

Event based as opposed to state based

Why we chose Nsure Identity Manager

Problems Solved

Placement into multiple OUs

Movement of account for affiliation change

Bi-directional password syncronization

Automatic provisioning of Exchange accounts

Ability to create “uniform” accounts

All data maintained and updated from source systems

iPlanet

x500 Model

Legacy

Active Directory

iPlanet Domain Component Model

Identity Vault

eDirectory

UTHOUSTON

Active Directory

File and Print Sharing eDirectory

INDIS

Person

Registry

Peoplesoft

SIS

GMEIS

Guests

Identity Manager Actions

Custom “Home grown” code

Benefits Gained

Account Creation

Helpdesk no longer creates accounts

Attributes are uniform and correct

User is provisioned without requests from manager

Objects are created in correct context

Modifications

Telephone and other attributes updated

Name Changes handled automatically

Passwords are reduced

Account Deletion

Accounts are disabled and deleted accurately

Custom Object Classes

uthDirXML

Auxiliary Class

Holds Status Level

Useful for migrations

Working variables

uthOrgPerson

Affiliation Information

Institution Specific

Account Status

uthOrgPerson - uthDataSource

Values are names of source systems

Changes to Inactive when no longer found in source

Inactive causes disable event

http://www.novell.com/coolsolutions/tip/11624.html

Login Enabled

Login Disabled

Multivalued Attributes

Review Each Syncronized Attribute

Common Name

Given Name

Surname

Title

Two Ways to Handle

Exchange Provisioning

Break into two policies

Rules for Modify

Rules for Adds

Group common queries into a single break rule

More efficient to test all values at once

Place a break as last action in each rule

Processing additional rules could create undesired results and wastes processing time

Additional rules make troubleshooting more difficult

http://www.novell.com/coolsolutions/tip/11621.html

Exchange Rules

Exchange Rules

Exchange Rules

Active Directory

Exchange

eDirectory

mailforwardingaddress is added

1

mailforwardingaddress

uthExchUser attribute is set to “Provisioned” in eDirectory

5

uthExchUser

If mailforwardingaddress is equal to *@uthouston.edu then add homeMDB attribute

2

homeMDB

RUS on Exchange adds proxyAddresses attribute

3

proxyAddresses

Because uthExchUser is set to “Provisioned” operation is vetoed

proxyaddresses change is again picked up by the publisher channel

6

X

Publisher Channel removes proxyaddresses, then adds it back in correct format with both values

4

proxyAddresses

X

William Schneider

2005-01-10T16:09:01