Advanced Novell Nsure® Identity Manager 2 Tools and Tricks

Glen Knutti

Managing Partner, Sr. Consultant

TriVir, LLC

Brent Kynaston

Software Engineer, Consultant

TriVir, LLC

Richard Matheson

Nsure® Engineering

Novell, Inc.

Grow the value of your solution through creative IDM2:

IDM2 Policies Tips and Tricks:

Password sync policy improvements

Date conversions

Useful string manipulations

Email alerting for security concerns

State restoration for failed events (i.e. reset RENAME)

Linking in that Hard-To-Connect Application:

Incorporating Embedded and External Java Code

Leveraging DLLs Shared Libs via Programmatic Interface

Executing Native Code via Direct Command Line

a

b

Policy Tricks and Tips

Password Sync 2.0 policies Reloaded

Insert a line break in a text email

Convert date format

Triggering an action after a match

Sending email on Grace Logins & Intruder Lockout

Put multi-valued attr values into a string

Date and time stamp logging

Block and reset renames

Reset failed renames

Adding and sync'ing NT groups

Password Policies Reloaded

The default Password Sync 2.0 policies:

aren't properly chained

display errors without identifying the user or the error

default password policy

emails are sent to the user

password checker

...

<rule name="Password(Pub)-Default Password Policy" next-transform="Password(Pub)-Check Password GCV.Publisher.NT4.DriverSet.Services.YourOrganization">

<policy>

<description>xlfid(DefaultPwdPolicyDescr)On User add, provide default password of Surname if no password exists</description>

...

and

...

<rule name="Password(Sub)-Transform Distribution Password" next-transform="Password(Sub)-Default Password Policy.Subscriber.NT4.DriverSet.Services.YourOrganization">

<policy>

<description>Transform Distribution Password</description>

...

next-transform should read:

next-transform="Password(Sub)-Default Password Policy.Subscriber.PassSync2.DriverSet.Services.YourOrganization"

Password Policies Reloaded
Not properly chained

Password Policies Reloaded
The error condition

Password Policies Reloaded
A non-password sync error – no association

<nds dtdversion="2.0" ndsversion="8.x">

<source>

<product version="2.0.6.20040917 ">DirXML</product>

<contact>Novell, Inc.</contact>

</source>

<output>

<status event-id="SS-SMC-01#20041209153545#4#11" level="warning">Code(-8017) Operation vetoed by object creation policy.

<application>DirXML</application>

<module>Sec from Prod</module>

<object-dn>\SMC_TREE\SMC\RADIO\R_CIN\jeffdavis</object-dn>

<component>Publisher</component>

<operation-data>

<password-subscribe-status>

<association/>

</password-subscribe-status>

</operation-data>

</status>

</output>

</nds>

Password Policies Reloaded
A non-password sync error – no association

<nds dtdversion="1.1" ndsversion="8.7">

<source>

<product asn1id="" build="20041019_163000" instance="\SS_LAB\SERVICES\DirXML\Driver Set\Active Directory SMC" version="3.0.1.2">AD</product>

<contact>Novell, Inc.</contact>

</source>

<output>

<status event-id="SS-LAB-90#20040427144341#1#5020" level="error" type="driver-general">

<ldap-err ldap-rc="21" ldap-rc-name="LDAP_INVALID_SYNTAX">

<client-err ldap-rc="21" ldap-rc-name="LDAP_INVALID_SYNTAX">Invalid Syntax</client-err>

<server-err>00000057: LdapErr: DSID-0C090A75, comment: Error in attribute conversion operation, data 0, vece</server-err>

<server-err-ex win32-rc="87"/>

</ldap-err>

<operation-data>

<password-subscribe-status>

<association/>

</password-subscribe-status>

</operation-data>

</status>

<status event-id="SS-LAB-90#20040427144341#1#5020" level="warning" type="driver-general">

<ldap-err ldap-rc="32" ldap-rc-name="LDAP_NO_SUCH_OBJECT">

<client-err ldap-rc="32" ldap-rc-name="LDAP_NO_SUCH_OBJECT">No Such Object</client-err>

<server-err>00000525: NameErr: DSID-031A0F7C, problem 2001 (NO_OBJECT), data 0, best match of: ''</server-err>

<server-err-ex win32-rc="1317"/>

</ldap-err>

</status>

</output>

</nds>

Password Policies Reloaded
A password sync error with an additional <status>

<nds dtdversion="1.1" ndsversion="8.7">

<source>

<product asn1id="" build="20041019_163000" instance="\SS_LAB\SERVICES\DirXML\Driver Set\AD Great Plains" version="3.0.1.2">AD</product>

<contact>Novell, Inc.</contact>

</source>

<output>

<status event-id="pwd-subscribe" level="error" type="driver-general">Could not set password via platform call. Err=2245<operation-data>

<password-subscribe-status>

<association>8191ff26b17d3c44aa575ed167dbbaae</association>

</password-subscribe-status>

</operation-data>

</status>

<status event-id="pwd-subscribe" level="error" type="driver-general">

<message>Password set failed.</message>

<ldap-err ldap-rc="53" ldap-rc-name="LDAP_UNWILLING_TO_PERFORM">

<client-err ldap-rc="53" ldap-rc-name="LDAP_UNWILLING_TO_PERFORM">Unwilling To Perform</client-err>

<server-err>00002077: SvcErr: DSID-031D0AAB, problem 5003 (WILL_NOT_PERFORM), data 0</server-err>

<server-err-ex win32-rc="8311"/>

</ldap-err>

<operation-data>

<password-subscribe-status>

<association>8191ff26b17d3c44aa575ed167dbbaae</association>

</password-subscribe-status>

</operation-data>

</status>

</output>

</nds>

Password Policies Reloaded
The new error condition

Password Policies Reloaded
Not foolproof!

<nds dtdversion="2.0" ndsversion="8.x">

<source>

<product version="2.0.6.20040917 ">DirXML</product>

<contact>Novell, Inc.</contact>

</source>

<output>

<status event-id="Active Directory SMC##100b4a6cc41##2" level="error">Code(-9040) &lt;add> operation does not have dest-dn.<operation-data>

<password-publish-status>

<association>e641e205154168429258770df543dc19</association>

</password-publish-status>

</operation-data>

<application>DirXML</application>

<module>Active Directory SMC</module>

<object-dn>CN=xastantucci,CN=Users,DC=domain,DC=com</object-dn>

<component>Publisher</component>

</status>

</output>

</nds>

Password Policies Reloaded
Default Password Policy

Password Policies Reloaded
Default Password Policy

Password Policies Reloaded
Emails are sent to the user

Password Policies Reloaded
Emails are sent to the admin

Password Policies Reloaded
Password checker

Password Policies Reloaded
Password checker – trace file result

[12/13/04 16:34:07.735]: AD Great Plains PT: Applying to modify #2.

[12/13/04 16:34:07.735]: AD Great Plains PT: Evaluating selectioncriteria for rule 'Password Checker'.

[12/13/04 16:34:07.736]: AD Great Plains PT: (if-class-name equal "User") = TRUE.

[12/13/04 16:34:07.736]: AD Great Plains PT: (if-op-attr 'nspmDistributionPassword' available) = TRUE.

[12/13/04 16:34:07.736]: AD Great Plains PT: Rule selected.

[12/13/04 16:34:07.736]: AD Great Plains PT: Applying rule 'Password Checker'.

[12/13/04 16:34:07.736]: AD Great Plains PT: Action: do-set-local-variable("variableName",token-op-attr("nspmDistributionPassword")).

[12/13/04 16:34:07.736]: AD Great Plains PT: arg-string(token-op-attr("nspmDistributionPassword"))

[12/13/04 16:34:07.736]: AD Great Plains PT: token-op-attr("nspmDistributionPassword")

[12/13/04 16:34:07.736]: AD Great Plains PT: Token Value: "turkey".

[12/13/04 16:34:07.736]: AD Great Plains PT: Arg Value: "turkey".

[12/13/04 16:34:07.737]: AD Great Plains PT: Policy returned:

[12/13/04 16:34:07.737]: AD Great Plains PT:

<nds dtdversion="2.2">

<source>

<product version="2.0.6.20040917 ">DirXML</product>

<contact>Novell, Inc.</contact>

</source>

<input>

<modify-password class-name="User" dest-dn="Users\SMC\unovell"

dest-entry-id="37215" src-dn="CN=unovell,CN=Users,DC=SRC,DC=com">

<association>b2078274c4518642b3589c5035c8867f</association>

<password><!-- content suppressed --></password>

</modify-password>

...

Password Policies Reloaded

The new, improved Password Sync 2.0 policies:

are properly chained

do not send emails with no error message

display errors only for associated users

default password policy is disabled

password checker included, but disabled

Password sync failure notification
Send those emails to members of an eDir group

Scenario -

Send the email notifications for password sync to a group of people based on membership in an eDirectory™ group

Solution -

Set a GCV to the DN of the eDirectory group you want to use

Use a for-each action to iterate through the membership of the eDirectory group

Gather each member's email address

Send email

Insert a line break in a text email

Scenario -

You want to format a text email with line breaks to make it more readable

Solution -

Use a java method

<token-xpath expression="jsystem:getProperty('line.separator')"/>

Insert a line break in a text email

Insert a line break in a text email

Convert time stamp format

Scenario -

You've got a date in the format DDMMYY

You need to transform this date into seconds since Jan 1970 so it can be stored in eDirectory

Solution -

Use the java Date class to do the transformation

Convert time stamp format

<policy

xmlns:date="http://www.novell.com/nxsl/java/java.util.Date"

xmlns:format="http://www.novell.com/nxsl/java/java.text.SimpleDateFormat">

<rule>

<description>Convert DDMMYY to seconds since 1970</description>

<conditions/>

<actions>

<do-reformat-op-attr name="SomeAttributeWithDDMMYY">

<arg-value type="string">

<token-xpath expression="round(date:getTime(format:parse(format:new('ddMMyy'), $current-value)) div 1000)"/>

</arg-value>

</do-reformat-op-attr>

</actions>

</rule>

</policy>

Triggering actions after a match

Scenario -

Metadirectory --> Passport

A deleted user in Metadirectory causes the Passport user to be disabled and moved to the Dead container

If the add of Metadirectory user matches a user in the Dead container, we want to move the user from the Dead container

Triggering actions after a match

Solution -

Create a separate rule after the initial matching rule

Use the dest-dn returned as a result of the match

Optional - If moving the destination user

Update the dest-dn accordingly

Insert a pause, if needed, so the move can complete before processing continues

Date and time stamp logging

Scenario -

You want a log of all Exchange mailbox creations

Solution -

Log the matched user information

Veto the event

Date and time stamp logging

Log output:

02/18/2005 18:56:53ExchangeDriver:SUCCESS: Created account for user: [\ENT_DEV\internal\users\TestUser]

02/19/2005 01:53:23ExchangeDriver:SUCCESS: Created account for user: [\ENT_DEV\internal\users\TestUser1]

Put multi-value attr values into a string

Scenario -

A group is deleted in SunOne

We need a notification of this event

We need to recreate the group and add it's members

Solution -

Pull the group members from the sync'd group in the destination

Put members into a string to include in email

Block renames

Scenario -

You don't want renames to flow in one direction

If someone does rename a user, you want to know about it and have the user name set back to the original value

Solution -

Capture the rename event

Send an email

Set the user back to the old value

Veto the rename event

Reset failed renames

Scenario -

Users sync from hierarchical to a larger, flat namespace

Renames in the source might be unique in the destination

Solution -

Check for a rename error

Send an email notification

Reset the source user back to the old name

Reset failed renames

<nds dtdversion="2.0" ndsversion="8.x">

<source>

<product version="2.0.6.20040823 ">DirXML</product>

<contact>Novell, Inc.</contact>

</source>

<output>

<status event-id="SS-LAB-90#20041009011952#1#1" level="error">Code(-9010) An exception occurred: novell.jclient.JCException: modifyRDN -606 ERR_ENTRY_ALREADY_EXISTS<application>DirXML</application>

<module>eDirectory Driver</module>

<object-dn>\SMC_LAB\SMC\Cable\C_CAR\afulton (Users\SMC\afultona)</object-dn>

<component>Publisher</component>

</status>

</output>

</nds>

LDAP app doesn't show pwd expiration

Scenario -

An LDAP application authenticates users with eDirectory, but the application doesn't tell users when their password has expired or when their account is locked

Solution -

Use the Manual Task Driver (or an existing driver)

Look for grace logins decrementing and send an email

Look for grace logins at zero and send an email

Look for intruder lockout and send an email

Assign password policy on title value

Scenario -

When a user's title changes to include or remove the word 'admin', the administrative Universal Password policy should be added to or removed from the user

Solution -

Use regular expressions to find title changes with 'admin' in them

Add the password policy to the user

Add the user to the password policy

Adding and Sync'ing NT groups

Scenario -

You want to sync groups between eDirectory and NT

Solution -

The NT driver does not recognize NT groups

The NT driver does recognize NT group membership

When a new NT group shows up, create a corresponding eDir group

Update eDir group memberships properly when NT group membership changes

After the session break:

Linking in That Hard-To-Connect Application:

Incorporating Embedded and External Java Code

Leveraging DLLs Shared Libs via Programmatic Interface

Executing Native Code via Direct Command Line

Demo

Event Result Logic Triggers

Powerful New Tools and Extensions

Questions and Answers

Session break

Linking in that
“Hard-To-Connect” Application

The

WHAT

WHERE

WHY

HOW

Will I be able to do this?

WHAT?
A Paramount Password Problem

Password management for HR Time card and Benefits Modules only available through manual admin utilities at the helpdesk

No interface for IDM2 to connect to in order to send passwords to the HR system

WHERE?
A Perplexing Plight

No integration points!

No public APIs available for the HR system

Proprietary Admin Tools

IDM2-the-Rescue!

WHY?

IDM2 tools exist to solve any problem:

XML

XSLT

Java

Native

HOW?

Researched HR admin tool binaries (EXE/DLL)

Built interfaces for IDM2 to access those binaries

Leveraged these interfaces from the IDM2 driver for direct real-time linking of eDirectory to the HR system

We'll review the necessary steps to accomplish this and learn by example:

Identify the required native symbols used to interact with the target system

Wrapping the Natives with Java

Invoking Java Native Interface Wrapper from IDM2 Policy

Dealing with exceptional behavior

Alternate approaches

Building an Artificial Interface to Your “Hard-to-Connect” Application

Building an Artificial Interface to Your “Hard-to-Connect” Application

IDM2

App

PswdUtil.class

PswdUtilJNI.dll

HRClient.exe

ClientUtil.dll

Embedded Java – When XML/XSLT Won't Cut It (As Simply)

Embedded Java – When XML/XSLT Won't Cut It (As Simply)

Leveraging an External Java Utility: Logging Tool

Leveraging an External Java Utility: Logging Tool

Leveraging an External Java Utility: Logging Tool

Leveraging an External Java Utility: Logging Tool

Writing the Password Encryption JNI Wrapper

IDM2

App

PswdUtil.class

PswdUtilJNI.dll

HRClient.exe

ClientUtil.dll

Wrap It Up For Freshness - Step I of II

Wrap It Up For Freshness - Step I of II

IDM2

App

PswdUtil.class

PswdUtilJNI.dll

HRClient.exe

ClientUtil.dll

Wrap It Up For Freshness - Step II of II

IDM2

App

PswdUtil.class

PswdUtilJNI.dll

HRClient.exe

ClientUtil.dll

Wrap It Up For Freshness - Step II of II

Make the Call

Make the Call

Failing Successfully

Exception Handling, Logging, Notification/Auditing

Code is not good code unless it “fails well”

What happens if there is an exception thrown at any layer of the solution?

What is logged and returned to the next layer?

How do we protect the host JVM, and NDS process (including DirXML®)

Remote loader consideration

Formal exception handling in the native and Java code

Defined behavior for exceptional behavior

Adequate logging and alerting

A Simple Alternative

Command Line Execution

Process currentProc = Runtime.getRuntime().exec("dir /w");

DataInputStream in = new DataInputStream( currentProc.getInputStream());

DataOutputStream out = new DataOutputStream( currentProc.getOutputStream());

RSA Driver Example

Seeing is Believing: Demo

Event Result Logic Triggers-
"For Every Action, There Is an Equal and Opposite Reaction."

Leveraging <operation-data> element

Log when User ADD Success

Email on User ADD Failure

Powerful New Tools and Extensions

Designer for Nsure Identity Manager

·	Enterprise Modeling

·	Configuration

·	Project Versioning and Staging

·	Policy Management

·	Integrated XML/XSLT Editor

·	Data Analysis and Scrubbing

·	Debugging, Data Simulation

·	Project Documentation

Powerful New Tools and Extensions

Valuable Third-party Extensions to the IDM2 Designer: Automated Test Suite for Nsure Identity Manager

·	Define automated test criteria for driver functional requirements

·	Auto-generate tests based on driver configurations represented in the project

·	Quickly test inter-driver dependencies and relationships

·	Test often throughout development, staging and release

·	Automate driver certification

·	Enables test-driven development of future driver logic

·	Control identity management solution scope and embrace change more readily without the risk of unknowingly breaking existing functionality

·	Provides a platform for developing and executing periodic “Active Tests” for constant validation of drivers in the production environment

Powerful New Tools and Extensions

Nsure Enterprise Provisioning Module (EPM)

Enhanced Provisioning Module for Nsure Identity Manager is a consulting toolkit that delivers the following advanced provisioning capabilities:

Approval workflows

Delegated administration

Configurable white pages and organizational chart

Summary

XML, XSLT and IDM2 Policies

Incorporating Embedded and External Java Code

Leveraging Native Code via Programmatic Interface Executing Native Code via Direct Command Line

Triggering on Event Status

Unleash the Power of eDirectory By Building Those Long-Awaited Links!!!

Powerful New Tools for the Expert IDM2 Engineer

Q/A

Resources:

IDM2 Designer BETA available from: http://www.novell.com/coolsolutions/dirxml/designer.html

See Brainshare® sessions: RTD 15 and TUT 349 for more information and training on IDM2/DirXML Designer

Automated Test Suite Plug-in for IDM2 Designer:	http://www.trivir.com/automation/idm2.html

Learn more about the Enterprise Provisioning Module at:http://www.novell.com/products/nsureidentitymanager/enhancedprovisioning/overview.html

See Brainshare® sessions: RTD 08, TUT 147 and TUT 354 for more information and training the EPM

Java Native Interface (JNI) Tutorial:	http://java.sun.com/docs/books/tutorial/native1.1/TOC.html#stepbystep

Dependency walker (freeware):	http://www.dependencywalker.com/

The Password Sync 2.0 policies that come with the download of IdM 2.0.1 contain these characteristics.

Here's a veto on a create that has come back from the destination eDirectory. This triggers an email notification that describes the error, but since there is no association value, there is no user information to tell us who had the problem.

Here's a syntax error that was returned from Active Directory. We have two status elements, but only the first one will trigger an email because the second status element is missing the <password-subscribe-status> element.

The first status element triggers an email that contains no error message and no user information. This is not terribly helpful.

Here's a valid password sync error returned from Active Directory. The password sent to Active Directory was too short resulting in the 2245 error.

However, we have to status elements and both of the meet the conditions of the default password policies. We'll end up with two emails. The first email will be valid and will contain the error message and the user information. The second, that of the LDAP error, will contain no error message, but will have the user information. Since the second email is incomplete and really a duplicate of the same error it is unnecessary.

Here we've added to the original error condition to require an error message and some kind of association so that email notifications will contain relevant information.

Even with the new error condition some non-password sync errors can slip through.

One option is to identify these errors and add a condition that sends these particular errors to the admin or at least don't send them to the user.

We've disabled the default password policy rule because we usually don't use it.

Sometimes we'll replace the default password policy rule with an email notification so we know who doesn't yet have a Universal Password set and therefore doesn't have a password flowing into the target system.

By default, the email notifications are sent to the user in question.

We typically like to review the password sync email notifications in development and in production initially before sending the emails directly to the users.

So we start out with a variable so the “To” portion of the email can be updated for all three of the default email notifications rules at once.

Later on we'll go back and send the emails to the user only or sometimes add an additional “To” variable so the emails continue to go to the admin and also to the user.

This policy, when enabled, will show the Universal Password that is being sent or received. This is often helpful in troubleshooting password sync problems, but due to the security implications this rule should be used wisely.

We built this rule such that we try to hide the clear text password in the trace file rather than having it stand out in hopes that someone who isn't looking for it won't see it.

Manual Task Driver – Input Transformation Policy Set

Passport from Metadirectory – Publisher Matching Policy Set – Moved matched users from Passport – Send email action

A line break within a token-text noun would be stripped out by the policy UI so a java method is the next best thing.

Make sure to add the namespace and reference the namespace correctly in the XPath noun.

Manual Task Driver – Publisher Event Policy Set

- There are no conditions on this sample rule.

- The namespaces must be entered.

Passport from Metadirectory – Publisher Matching Policy Set

We don't want to add another action after the 'find matching object' action because at that point we may have made the match, but we're still working with the original XML document that we started with.

Instead, use a separate rule so that the results of the 'find matching object' action are written as the dest-dn (assuming a successful match) of what is now the modify event.

Although the dest-dn hasn't yet been written in the trace file, we can test the dest-dn itself or use the dest-dn to query for information about the destination object that was successfully matched.

Once we move the user to a new container, the trace file will still show the old location as the dest-dn, but everything works and any modifies to the user are successfully written to the user in it's new container. However, to make the process more understandable, it's wise to set the dest-dn to the new location as one of your actions.

If the move requires a little time to complete (different replica, maybe) then insert a pause as an action in the move rule before continuing.

Manual Task Driver – Output Transformation Policy Set – Logging Policy

SunOne Driver – Publisher Event Policy Set

Passport from Metadirectory – Subscriber Event Policy Set – Block Renames

Security from Production – Output Policy Set

First we check for an error that is specific to a rename that didn't work.

From the object-dn element of the status doc, we can get both the old name and the new name.

We send an email to the admin, pause for 5 seconds so the original rename in the source eDirectory has time to complete, and we rename the source user back to the old name.

Note that since we are triggering off of a status doc that is flowing back to the source eDirectory, the source user is now the destination object for the rename reset.

Manual Task Driver – Subscriber Event Policy Set

Make sure that Login Grace Remaining is in the subscriber filter.

We could do this the easy way and make one of the conditions that the Login Grace Remaining are not changing to 6, supposing that 6 is our limit. Instead, we'll set the Login Grace Limit value for the user into a variable and compare that value to the Login Grace Remaining value. Now we can handle users with different Login Grace Limits and user's who Limit might be changed.

If the Remaining equals the Limit, the value is being reset after a password change and we don't want to send an email. If the Remaining value is zero we'll send a different email message since the account is now locked.

Manual Task Driver – Publisher Command Policy Set

Use regular expressions to catch variations of admin in the title attr value .

NT Domain Driver – Input Policy Set – Group Create

All UserGlobalGroups are checked (except Domain Users) every time that they pass through to make sure the NT group exists in eDir. If the group doesn't exist, it is created and the association value is added.

NT Domain Driver – Publisher Event Policy Set

When group membership in NT change, NT only sends the current group memberships along with a remove-all-values. That's fine if we're only sync'ing NT group membership, but if eDir users also have eDir group memberships, this will strip those memberships and won't add them back in.

So when group membership changes in NT, we get rid of the remove-value-values for Group Membership, read all of the group memberships of the eDir user and put only those that are NT groups memberships (defined by containment in this case) into a variable and then remove only the NT group memberships from the eDir user. The group membership change from NT is then allowed to process and the current NT group memberships are added back to the user.

Almost every company has that application or database that contains valuable data, but no easy-to-use interface for linking into the identity management solution.

In order to interface such applications, the IDM2 implementor must add some additional advanced tools to their toolkit. We'll discuss some of these tools and their incorporation into the solution step by step in order to lay the path towards the integration of that “Hard-to-connect” application.

In this portion of the session, we'll look at a real-world situation where a company wanted to synchronize passwords via IDM2 to their HR system where no programmatic interface was available.

We'll see the steps taken, and learn by example

Large percentage of helpdesk calls were password related

Password self-service for eDirectory and connected applications was only part of the solution

Password reset requests for the HR benefits module and timecard had to be forwarded from the IT helpdesk to the HR Helpdesk, causing frustration for users and administrative personnel

The only way to reset a password in the HR system was through an admin client used by the HR helpdesk staff

Where could integration with the HR application be performed?

No web service, queue, or Application Programming Interface for IDM2 to interface

Only “Custom Integration” was available through the HR system's consulting services at a premium, and their staff didn't have knowledge of rest of the system's connected parts.

The only way to reset a user's password in the system was through a proprietary admin client, which required manual intervention

Needed to eliminate manual intervention for true cost savings

WHY IDM2? The client had previously identified IDM2 as the flexible solution that could be expanded to serve their evolving needs as they built their account provisioning system.

IDM2 keeps the simple things simple, and makes complex things possible

XML Policies for simple logic

XSLT for advanced transformation

Java for leveraging other useful objects or utilities, expanding connector functionality

Native wrappers for leveraging existing platform specific libraries and utilities (win32: DLLs, Solaris: Shared libraries)

In order for IDM2 to interact programmatically with an external application/database, the application must have an accessible Application Programming Interface (API).

If an API exists, you can actually implement a custom driver to make use of these APIs. This is how many of the standard connectors were implemented (i.e. Notes, PeopleSoft, Exchange, NT, and many more).

For many enterprise applications and databases, there are existing drivers provided through Novell or Novell Partners. However, there is often times that one useful application or database in your environment that everyone would like to link into the IDM solution, but there is no existing driver, or clean public API.

For these applications, a creative use of IDM2 can still bridge the divide between your directory and the stubborn application.

In this case, we researched the HR admin client to find the binaries that actually performed the password resets in the back-end database

Using the win32 Dependency Walker (see resource page for link) we were able to locate all DLLs used by the admin client, and view their functions and symbols.

Once we identified the DLL used to reset passwords, JNI wrapper to leverage this library from our driver

We'll discuss the details of how this was done here. These steps may be used to integrate other stubborn applications and databases.

We studied the HR application database back-end and found the tables used to store user identity information. We found that with the SQL Server driver, we could synchronize almost everything we needed to update the password-related user identity information (i.e. Password expiration date, change date, changed_by, etc.).

The only thing we couldn't actually synchronize was the password. We could get the new password during password change events through Universal Password, but we couldn't encrypt the password like the HR client because it was using a non-disclosed proprietary encryption algorithm.

We then ran a dependency walker utility on the HR client application executable, and then on it's related DLLs. We found the function symbol that looked as if it was related to password encryption.

Communication with the vendor sometimes helps to speed this process.

Note: Dependency Walker is included with many C++ development IDEs and is available for free download (see resources slide for link)

The HR Client was the only way to encrypt a password for a user in the HR database, so we decided to leverage the client directly from IDM2.

In order to leverage this HR client feature, we would have to build an artificial API, or programming interface that IDM2 could use to encrypt passwords before sending to the database.

Note that many older applications and databases that do not expose a public API are implemented with Native code. Using this approach, you can build your own API! If the code exists, IDM2 can make use of it!

Description of diagram: (The Link from IDM2 to the Application via JNI)

The IDM2 driver calls a password encryption class (which we're about to create) to encrypt a given password value

The password utility class wraps the native function required to perform this encryption

The wrapped native function is the same one called by the HR Client executable

DirXML sends data directly to the application back-end database

Note that more information and a tutorial can be found on how to use JNI (the Java Native Interface) – see the resource slide for the link

Before we can write the Java utility that will wrap this native encryption function, let's look at how to leverage Java from IDM2 policies...

IDM2 is designed to keep simple things simple, and make complex things possible.

TIP: It is a best practice while implementing an IDM2 driver to abstract each logical rule into the location that will make it easiest to maintain by the DirXML Admin.

Exception: Sometimes the location choice for a rule will depend on company policy or preference

Exception: Occasionally the implementors knowledge and experience will limit choice

IDM2 allows for the embedding of Java for these more challenging situations (like calling this HR password reset code)

TIP: Favor less layers --> It is better to embed Java directly into the IDM2 policy than embedding it inside of XPATH, which is then embedded inside of XSLT. This will reduce the amount of code/complexity that must be maintained.

Discuss Password Generator Example (not part of the HR application, but a useful example of embedded Java code that is reusable anywhere you need to generate a password in IDM2)

Required namespace values

There are times when embedding the Java code can become unwieldy if there are a number of things being done in the code. At this point, the value of having the code exposed in the policy is lost because the ease-of-maintenance factor is lost.

Let's look at how this same policy would look if this code were implemented in an external Java utility called directly from the policy.

Required namespace values for the large body of embedded code (Logger tool)

Here is the same policy with the Java code implemented as an external utility which is called from the policy.

This approach continues to yield an easy-to-maintain solution for the DirXML Admin.

TIP: Anything that might change (i.e. Date formats, log locations, etc.) should be abstracted to the place where maintenance would be easiest. For example, most settings should be stored as GCVs (Global Configuration Values). We want to avoid requiring a rebuild of the Java utility every time they want to change the log path for example.

Note that logging is being accomplished AFTER the event has been processed either successfully or unsuccessfully – not before the event! We'll review how to trigger off of event status at the end of this presentation.

Required namespace value for the simplified Java External Utility invoker

Now that we know how to leverage embedded Java and external Java utilities from within our IDM2 driver, we're ready to write the external Java utility that will wrap the native password encryption function.

These wrapper creation steps are outlined in the JNI tutorial included on the resources slide of this presentation. This is not meant to replace the tutorial, this is an overview. Please refer to the tutorial for more details and examples.

Let's create the PswdUtil.class

This simple class provides a static method to take a string, and return its value encrypted.

It calls the actual native wrapper code which in turn calls the HR Client library to perform the encryption.

IDM2 will actually call the public encrypt() method, passing in the string to be encrypted.

The first function (encryptPassword) actually loads the HR Client library to perform the encryption

The second function (encryptionImpl) provides an implementation of the native method defined in our Java wrapper class.

Note that the NativeAPIWrapper.h header file was auto generated by a JDK utility called javah.exe, based on the native function signature in PswdUtil.class. The header file is listed on the next slide.

This header file is generated automatically by the javah.exe utility included in the JDK.

This header file provides a C function signature for the implementation of the native method

Now that all of the work as been completed and encapsulated, providing HR Client password encryption on passwords being sent to the HR database is as simple as a few lines of policy code...

Required namespace value for the external Java Utility being called

IDM2 Policy should either receive a success or failure (boolean) from the Java utility, and know how to handle either return value

Nsure Audit instrumentation

An alternate approach to wrapping the native libraries and calling them from IDM2 would be to wrap a command line utility that performs tasks in the connected application.

RSA/ACE Bulk Admin Wrapper for IDM2

<operation-data> is used to allow policies to inject an additional custom data payload to be carried along with any event or command. It is stripped off of the event or command before it is submitted to the application shim and then reassociated with any corresponding response elements (as determined by matching event-id) after they are returned to the DirXML (ie. an application shim shouldn't ever have to deal with it.)

The content of the <operation-data> can be any well formed XML but it is recommended that any elements and attributes used be placed in a custom namespace to avoid having them confused with standard DirXML operations.

The typical use for <operation-data> is to be able to create a policy that supplies additional context on an operation that may be needed by the policy that handles the results of that operation.

Note that for operations whose content is normally PCDATA there should only be at most one <operation-data> and it should be after any character data. This is contrary to the content rule specified by the DTD because DTD's for mixed content do not allow more precise specification. Example :

<operation-data xmlns:mystuff="http://mystuff.operation.data">

<mystuff:notify>admin@fred.com</mystuff:notify>

</operation-data>

Source: DirXML NDK Documentation

Please refer to the resources page for a link

Please refer to the resources page for a link

Please refer to the resources page for a link

TIP: Take pride in your code. An hour of careful consideration and additional care may save countless man-hours after your solution will go into production.

TIP: Test-first implementation

TIP: Automated tests for all driver features, and system-level inter-driver functional requirements (either with the IDM2 Designer plug-in or with any other functionality test tool that can spark events and read results on the connected systems)

DL 256

2003-12-08T12:43:39