"Must Know" Tips and Tricks
for Novell Nsure® Identity Manager 2 Deployments

Gary J Porter

Worldwide Training — IDM2/eDirectory™

Novell, Inc.

Mark Forsey

Worldwide Training — IDM2/iChain®/Bordermanager/ZENworks®

Novell, Inc.

Agenda

Theory Review

Avoiding Installation problems

Policy Builder tips and tricks

Tracing

Policy Processing Order
Subscriber

Convert

Event

to

XML

Event

Transformation

Schema

Mapping

Output

Transformation

Matching

Rule

Create

Rule

Placement

Rule

Subscriber Add Processor

Subscriber

Filter

Event

Cache

NO

YES

The DirXML® Engine

Command

Transformation

Does an

association

exist?

Policy Processing Order
Publisher

Convert

Event

to

eDirectory

Command

Transformation

Schema

Mapping

Input

Transformation

Matching

Rule

Create

Rule

Placement

Rule

Publisher Add Processor

NO

YES

The DirXML Engine

Event

Transformation

Does an

association

exist?

Publisher

Filter

Installation Tips and Tricks

Windows:

Runs on Windows 2003 or Windows 2000 SP2 or later

Support for:	Active Directory (native and compatibility modes)

Exchange 2000 and Exchange 2003

NIS:

Runs on:	Solaris Sparc 2.7 or 2.8

Red Hat Linux AS 2.1

SUSE® Linux 8.1

IBM AIX 5.2

HP-UX 11i

Installation Tips and Tricks

LDAP:

Runs on:	Netscape Directory Server 4.x or 6

iPlanet Directory Server 5.0 or greater

IBM SecureWay 3.2, 4.1.1, or 5.1

Critical Path InJoin 3.1 or greater

Oracle Internet Directory 2.1.1 or greater

SunONE 5.2

LDAP Version 3 compliant directories

Escaping

Your AD systems admin prefers the format of the display name in Active Directory to be “Surname, Given Name” Prepare a policy so that the Active Directory driver will allow a comma containing Full name

Escaping Demo

eDirectory Problem

With two tree connected by the eDirectory™ driver, there is an error indicating that the GUID is missing. The only attribute being passed is the CN even though there are many attributes in the initial event.

Source time is out of sync. Either fix the time issues or strip the time-stamp from the document.

Stripping Elements Demo

Pushback

Challenge: A system administrator with rights in the iPlanet environment continues to change email addresses of users without proper change control. Produce a policy whereby the default email address is re-written back to the iPlanet system.

Pushback Demo

Cross-population

The ability to query the destination database on an add operation for a specific attribute of an existing object and populate an attribute of the new object is a powerful tool.

Challenge: Create a policy to query one user in AD for the value of an attribute, then populate the attribute on the new user being added.

Populating an attribute with the value from another object Demo

Notify

Sometimes a schema extension on a disparate system isn't necessary (or sometimes isn't even possible) so the ability to populate an existing attribute with the contents of another attribute (or even a series of attributes) is very handy.

Create an Auxiliary class in eDirectory to hold the birthdate attribute generated in PeopleSoft and then populate the Description field in Active Directory with Given Name, Surname and Birthdate.

Notify Demo

Unique Name

Object naming can sometimes be a problem especially if a hierarchical directory is writing to a flat datastore.

Create a policy where new objects are given a unique name by using the first character of an object's given name and the first 6-characters of the object's surname—adding a number (starting with 1) if there is a name collision.

Unique Name Demo

Tracing Tips and Tricks

One of the most valuable skills with Identity Management is the ability to trace an event and troubleshoot any unwanted anomaly

Reading an IDM trace is just like reading an eDirectory trace

Tracing Tips and Tricks

A trace follows an XML document as it travels through policies and rules from the input until the final XML document is applied to the datastore

We will trace Homer Simpson as the object is added to the vault from PeopleSoft

We will also trace Homer Simpson as he is ((Doh!)) disabled and moved to the Inactive container

Convert

Event

to

eDirectory

Command

Transformation

Schema

Mapping

Input

Transformation

Matching

Rule

Create

Rule

Placement

Rule

Publisher Add Processor

NO

YES

The DirXML Engine

Event

Transformation

Does an

association

exist?

Publisher

Filter

Convert

Event

to

eDirectory

Command

Transformation

Schema

Mapping

Input

Transformation

Matching

Rule

Create

Rule

Placement

Rule

Publisher Add Processor

NO

YES

The DirXML Engine

Event

Transformation

Does an

association

exist?

Publisher

Filter

Add Homer

Simpson

Convert

Event

to

eDirectory

Command

Transformation

Schema

Mapping

Input

Transformation

Matching

Rule

Create

Rule

Placement

Rule

Publisher Add Processor

NO

YES

The DirXML Engine

Event

Transformation

Does an

association

exist?

Publisher

Filter

Add Homer

Simpson

Convert

Event

to

eDirectory

Command

Transformation

Schema

Mapping

Input

Transformation

Matching

Rule

Create

Rule

Placement

Rule

Publisher Add Processor

NO

YES

The DirXML Engine

Event

Transformation

Does an

association

exist?

Publisher

Filter

Add Homer

Simpson

Convert

Event

to

eDirectory

Command

Transformation

Schema

Mapping

Input

Transformation

Matching

Rule

Create

Rule

Placement

Rule

Publisher Add Processor

NO

YES

The DirXML Engine

Event

Transformation

Does an

association

exist?

Publisher

Filter

Add Homer

Simpson

Convert

Event

to

eDirectory

Command

Transformation

Schema

Mapping

Input

Transformation

Matching

Rule

Create

Rule

Placement

Rule

Publisher Add Processor

NO

YES

The DirXML Engine

Event

Transformation

Does an

association

exist?

Publisher

Filter

Add Homer

Simpson

Convert

Event

to

eDirectory

Command

Transformation

Schema

Mapping

Input

Transformation

Matching

Rule

Create

Rule

Placement

Rule

Publisher Add Processor

NO

YES

The DirXML Engine

Event

Transformation

Does an

association

exist?

Publisher

Filter

Add Homer

Simpson

Convert

Event

to

eDirectory

Command

Transformation

Schema

Mapping

Input

Transformation

Matching

Rule

Create

Rule

Placement

Rule

Publisher Add Processor

NO

YES

The DirXML Engine

Event

Transformation

Does an

association

exist?

Publisher

Filter

Add Homer

Simpson

Convert

Event

to

eDirectory

Command

Transformation

Schema

Mapping

Input

Transformation

Matching

Rule

Create

Rule

Placement

Rule

Publisher Add Processor

NO

YES

The DirXML Engine

Event

Transformation

Does an

association

exist?

Publisher

Filter

Add Homer

Simpson

Still working on the “flowing” XML document

Convert

Event

to

eDirectory

Command

Transformation

Schema

Mapping

Input

Transformation

Matching

Rule

Create

Rule

Placement

Rule

Publisher Add Processor

NO

YES

The DirXML Engine

Event

Transformation

Does an

association

exist?

Publisher

Filter

Add Homer

Simpson

Modify eDirectory to eDirectory

Modify eDirectory to eDirectory

Convert

Event

to

eDirectory

Command

Transformation

Schema

Mapping

Input

Transformation

Matching

Rule

Create

Rule

Placement

Rule

Publisher Add Processor

NO

YES

The DirXML Engine

Event

Transformation

Does an

association

exist?

Publisher

Filter

Modify Homer

Simpson

Convert

Event

to

eDirectory

Command

Transformation

Schema

Mapping

Input

Transformation

Matching

Rule

Create

Rule

Placement

Rule

Publisher Add Processor

NO

YES

The DirXML Engine

Event

Transformation

Does an

association

exist?

Publisher

Filter

Modify Homer

Simpson

Convert

Event

to

eDirectory

Command

Transformation

Schema

Mapping

Input

Transformation

Matching

Rule

Create

Rule

Placement

Rule

Publisher Add Processor

NO

YES

The DirXML Engine

Event

Transformation

Does an

association

exist?

Publisher

Filter

Modify Homer

Simpson

Convert

Event

to

eDirectory

Command

Transformation

Schema

Mapping

Input

Transformation

Matching

Rule

Create

Rule

Placement

Rule

Publisher Add Processor

NO

YES

The DirXML Engine

Event

Transformation

Does an

association

exist?

Publisher

Filter

Modify Homer

Simpson

Convert

Event

to

eDirectory

Command

Transformation

Schema

Mapping

Input

Transformation

Matching

Rule

Create

Rule

Placement

Rule

Publisher Add Processor

NO

YES

The DirXML Engine

Event

Transformation

Does an

association

exist?

Publisher

Filter

Modify Homer

Simpson

Convert

Event

to

eDirectory

Command

Transformation

Schema

Mapping

Input

Transformation

Matching

Rule

Create

Rule

Placement

Rule

Publisher Add Processor

NO

YES

The DirXML Engine

Event

Transformation

Does an

association

exist?

Publisher

Filter

Modify Homer

Simpson

Convert

Event

to

eDirectory

Command

Transformation

Schema

Mapping

Input

Transformation

Matching

Rule

Create

Rule

Placement

Rule

Publisher Add Processor

NO

YES

The DirXML Engine

Event

Transformation

Does an

association

exist?

Publisher

Filter

Modify Homer

Simpson

Tracing Demo

For further information

Don't miss:

TUT159 Troubleshooting Identity Manager

TUT280 Deploying Novell eDirectory on Linux

TUT257 Nsure Identity Manager in a Linux World

TUT355 XPath and Policies Workshop

TUT350 Implementing Identity Manager 2 Policies

Gary Porter

2005-01-29T10:53:13