Configuring Identity Manager 2 for GroupWise®

Art Purcell

GroupWise Engineering apurcell@novell.com

David Holbrook

IDM Engineering

dwholbrook@novell.com

Novell Nsure® Identity Manager 2

Automated provisioning and administration

External users

Global address book

Meta-directory

Demonstration

System Requirements

Frequently asked questions

Topics covered

Novell Nsure Identity Manager 2

Novell Nsure Identity Manager 2

Two-way synchronization technology for eDirectory™ based on events

Directory and applications

Directory and directory

For more details, go to an Identity Manager session

www.novell.com....

What do we mean by
automated provisioning and administration?

Based on a change in eDirectory

Automated account creation

Automated account maintenance

Automated account termination

Before

Employee starts job, no email account

Calls help desk

Contacts IS&T tech

Creates new account with some user information

User information is not complete

New Employee is hired

After

Employee is created in HR system

GroupWise account is created automatically

Employee is given account information at hire time

Automated account creation

Before

Employee called HR

Employee called IS&T

IS Help desk modified user information in
ConsoleOne® with GroupWise snap-ins

Automated account maintenance

Employee’s information is modified

After

Employee modifies information in eGuide

eDirectory account is updated

GroupWise address book is automatically updated

Before

HR notified IS&T (sometimes weeks or months later, sometimes never)

IS&T terminated account access (sometimes improperly, sometimes the wrong account)

Meanwhile mail forwarding was ongoing

Automated account termination

Employee leaves the company

After

HR sets employee status to inactive

IDM disables eDirectory account

IDM disables, expires or deletes GroupWise account

GroupWise account is automatically removed from distribution lists

IDM Driver for GroupWise

Account management

Attribute management

Internet address administration

Distribution list administration

Query GroupWise domain

External object administration

Maintain global address book

Contribute to a meta-directory

What can the GroupWise
Identity Manager driver do?

Account management

Account creation

Account placement

Account maintenance

Account expiration

Account disablement

Account deletion

Attribute management

Default attribute synchronization

Configured attributes are automatically synchronized

Custom attribute mapping

20 reserved GroupWise attributes for custom data

Map an eDirectory attribute to a reserved GroupWise attribute

Internet address administration

Through customization the driver can

Set Internet domain

Set address format

Set address to any value

GroupWise 6.5 or later

Define gateway aliases automatically

Create GroupWise nicknames

On user move or rename

GroupWise 6.5.1 or later

Distribution list administration

Through customization the driver can

Synchronize eDirectory groups to GroupWise distribution lists

Add user to a distribution list

Remove user from a distribution list

Remove user from all distribution lists

Query for distribution list information

By user

By distribution list

Query GroupWise domain

Query GroupWise objects for attributes

Query for proposed email addresses

Query can be used to populate a meta-directory

External object administration

External object administration

External post office

External user

The driver can create, modify, and delete

External post offices and users

Required policy changes

Filter – add Organizational Unit class and attributes

Mapping Rule – Provide mapping of eDirectory class and attribute names to GW names

Create Rule – controls creation of external post offices in GroupWise

Placement Rule – determines the external domain where external post offices are created

External post offices

Characteristics of external post offices

Associated with eDirectory Organizational Units

(Not associated with user OU attribute)

GroupWise does not manage Organizational Units associated external post offices

External Foreign Domain must already exist

External users

Characteristics of external users

External users are from other email systems

Users created in eDirectory Organizational Units associated with GroupWise external post offices are created as external users in GroupWise

GroupWise does not manage eDirectory users associated with external users

GroupWise global address book

GroupWise global address book
definition

GroupWise and non-GroupWise email addresses can be viewed in the address book

GroupWise users already in address book

Place non-GroupWise email addresses in address book

Creating a global address book
in GroupWise

Two basic configurations

1. GroupWise users and external users in the same eDirectory tree.

One driver

GroupWise users in GroupWise eDirectory tree and external users in a separate eDirectory tree.

Two drivers

External users in GroupWise address book

GroupWise Driver

GroupWise Domain with external PO

Exchange Driver

GroupWise eDirectory

with Exchange users

Place external users in external post office

Place GroupWise users in post office

External users in GroupWise address book

Meta-Directory

with Notes users

GroupWise Driver

Notes Driver

GroupWise Domain

GroupWise Driver

GroupWise eDirectory

Place external users in external post office

Place GroupWise users in post office

Meta-directory

Automated administration
of a meta-directory

Meta-directory contains all users' information

Synchronize user data into a central eDirectory tree regardless of origin

Data from GroupWise

Data from other email systems

Data from individual applications

Synchronize data into individual applications as needed

Meta-directory

eDirectory as a meta-directory

Exchange

GroupWise

Notes

NetMail

= IDM drivers

Creating a meta-directory

Two basic configurations

1. GroupWise users and non-GroupWise users in the same meta-directory

One driver

GroupWise users in GroupWise eDirectory and non-GroupWise users in a meta-directory

Two drivers

Use eDirectory driver to sync GroupWise users into the meta-directory

GroupWise and meta-directory tree

Exchange Driver

GroupWise eDirectory

with Exchange users

GroupWise Driver

GroupWise Domain

GroupWise and Exchange data in same tree

Meta-Directory

Meta-directory from GroupWise

Meta-Directory

with Notes users

and GroupWise users

GroupWise Driver

eDirectory Driver

GroupWise Domain

Notes Driver

GroupWise eDirectory

GroupWise and Notes data in same tree

How does the GroupWise
Identity Manager driver work?

Components

GroupWise Domain

Identity Manager and the GroupWise driver

One, two, or three servers

Single server

1

Configurations where the GroupWise Driver and the GroupWise Domain are on the same server

Identity Manager and GW Domain

Netware

Linux

Windows

Two servers

Configurations where the GroupWise driver and the GroupWise domain are on separate servers

Identity Manager	GW Domain

Netware	NetWare

Linux	Linux, NetWare, Windows

Windows	NetWare, Linux, Windows

Identity Manager	Remote Loader	GroupWise Domain

Netware	Windows, Linux	Linux, Windows

Soliars	Windows, Linux	NetWare, Linux, Windows

AIX	Windows, Linux	NetWare, Linux, Windows

Three servers

Configurations that require the remote loader because the GroupWise driver can not directly access the GroupWise Domain or the driver is not supported on Solaris and AIX.

Configuring the GroupWise driver

When the driver and domain are on separate servers, need to specify in the driver:

GroupWise primary domain server

Primary domain path on server

Remote server authentication name and password

When the driver is on Windows the same username and password must be configured on the local Windows system

The eDirectory context is required when the GroupWise Domain Database is on a remote NetWare server.

Searching for Gateway Alias

From a policy verify a proposed Gateway Alias or Preferred Internet eMail Address is unique

<query event-id="query-groupwise" scope="subtree">

<search-class class-name="User"/>

<search-attr attr-name="Internet EMail Address">

<value>helloworld@mydomain.com</value>

</search-attr>

<!-- Domain Name of Object -->

<read-attr attr-name="50035"/>

<!-- Post Office Name of Object -->

<read-attr attr-name="50062"/>

<!-- Object Name of Object -->

<read-attr attr-name="50073"/>

</query>

Password management

Initial password

Limited use password

Policy generated from existing attributes

Stored in clear text

Password set

When password changes in eDirectory it is synchronized with GroupWise

Password must replicate through GroupWise system before it is available

LDAP authentication

Authentication to LDAP server

Passwords in GroupWise are not used

Demo time

Demo time

Import driver configuration

Show configuration options

Create some users

Move users between post offices

Transform a delete event to disable account

Remove from distribution lists

Create external post offices and users

GroupWise driver releases

IDM Driver 2.1.1 for GroupWise

GroupWise 5.5, 6.0, 6.5

eDirectory

Novell eDirectory 8.6.2 or 8.7.3 with the latest Support Pack

Identity Manager

Novell Nsure Identity Manager 2 or higher

Current Release

IDM Driver 2.2 for GroupWise

GroupWise Sequoia – available summer 2005

eDirectory

Novell® eDirectory™ 8.7 or 8.8 with the latest Support Pack

Identity Manager

Novell Nsure™ Identity Manager 2.0.1 or higher

Future Release

GW Driver 2.2 Updates

New functionality

Added support for participation attribute, allowing users on distribution lists as carbon copy or blind copy members

Supports GroupWise Sequoia

Reported defects fixed

Frequently asked questions

Internet address configuration

GroupWise attributes that control the Internet address

See documentation for details

Driver startup on NetWare

Configuring the autoexec.ncf file

Search path

Specifies NetWare directory where the GroupWise nlm files are located

Needs to execute before Java loads

Place it right after the Java search path statements

SEARCH ADD SYS:\SYSTEM\GWDRIVER

Load GroupWise Agents in protected memory

add "protect" to the line that starts the agents

protect sys:grpwise\agents\GRPWISE.NCF

GroupWise Domain on a cluster

When the domain database is on a NetWare cluster,

specify the cluster-server-name and cluster-vol-name

Example:

Cluster server name

TST-CLUSTER_TSTVOL_SERVER

Note that the shared volume name (TSTVOL) is embedded in the server name

Cluster volume name

TSTVOL:\domain-path

Automatic retries

IDM retries are sometimes necessary

GroupWise may lock a user account while a move or rename is replicating throughout GroupWise

Events for locked user accounts are retried every 30 seconds

Other events are held until the current event is processed

Retries also occur when connection to remote domain is lost

ConsoleOne administration

Impact of GroupWise driver on ConsoleOne administration

Use current GroupWise Snap-ins

Have a process and follow it

Operations that are performed by the driver

Operations that are performed manually through ConsoleOne

Let the driver do its work

Rename GroupWise accounts with driver or ConsoleOne but not both

ConsoleOne administration (cont)

Impact of GroupWise driver on ConsoleOne administration

Admin-defined attributes

Map attributes in driver

Configure attributes in ConsoleOne

Manual association of GroupWise and eDirectory objects

See cautions in GroupWise documentation before doing this

Questions & answers

This session will describe the functionality of the GroupWise IDM driver in detail. It will explain how it can be used to automate provisioning and administration of GroupWise systems. It will also cover meta-directories and will include a demo installation of a basic system. Speakers will include the GroupWise developer who wrote the GroupWise IDM driver, and Novell IS&T administrators who implemented and maintain the GroupWise IDM driver at Novell.

How does the employee get password.

Insert graphic here.

Configuring Identity Manager 2 for GroupWise

2003-12-08T12:43:39

David Holbrook