Understanding the Architecture of Novell Nsure® Identity Manager

Dave Horne

Engineering Manager for:

Identity Manager

Nsure Audit

Novell, Inc.

Novell Nsure Identity Manager is a key component of Novell Nsure secure identity management solutions, which enable enterprises to efficiently and securely deliver the right resources to the right people - anytime, anywhere.

IDM2 is a integrated identity management solution offering combining identity management, provisioning, self-service, password management and auditing capabilities.

Identity Manager 2.0 was formerly known as Novell DirXML®.

Released to public January 2004.

Rollup version, 2.0.1, released in September 2004.

Rollup version, 2.02, released with OES in March 2005.

What is Novell Nsure Identity Manager 2

Features

Nsure Identity Manager offers you the following capabilities:

User provisioning

Defining Policies

Modeling and Deployment

Tools & Utilities

Password management

Password synchronization

Reporting & Auditing

Approval Workflows

Benefits

With Nsure Identity Manager, you can:

Increase operational efficiency

Support compliance with industry regulations

Reduce administration and helpdesk costs

Reduce security risks

Empower users

Build productive business relationships

User Provisioning

Islands of isolated data

HR

ERP

PBX

Directory

Mail

Operating
System

Database

Sharing data through an identity vault

HR

ERP

PBX

Directory

Mail

Operating
System

Database

Identity Vault

Authoritative Data Source

Organizations must be given the ability to control the flow of data between applications.

Data integrity and security must be maintained!

IDM2 provides a robust solution to customers through the combination of policies, filters and secure connections for controlling and securing data.

With IDM2 customers can define what applications own what data and to what application that data can be shared.

Authoritative Data Sources

Address

bdoe@ab.com

Dept

Birthdate

2/15/65

Sales

E-mail

HR

CN

EmpId

Assoc.

Assoc.

Department

E-mail

Date of birth

Bobby

003456

bdoe@ab.com

2/15/1965

bdoe@ab.com

003456

Subscriber only

Publisher only

Sales

E-mail

Marketing

EmpId

003456

Dept

DOB

15.2.1965

Sales

HR

Dept

Dept

Marketing

Marketing

Architectural Overview

DirXML

Engine

Identity Manager Server

Identity

Vault

DirXML

Driver App

Shim

Policies

Subscriber Channel

Publisher Channel

Policies

Identity Manager Web Server

Admin UI

Password

Manage-ment

Self Service

DirXML

Engine

DirXML

Driver App

Shim

Policies

Subscriber Channel

Publisher Channel

Policies

Architectural Overview
Single Server Instance

Identity Manager Server

Identity

Vault

Application

Architectural Overview
Remote Access

Identity Manager Server

Application Server

DirXML

Engine

DirXML

Driver App

Shim

Identity

Vault

Policies

Subscriber Channel

Publisher Channel

Policies

Application

Architectural Overview
Multi Server Remote

Identity Manager Server

Application Server

DirXML

Engine

DirXML

Driver App

Shim

Identity

Vault

Policies

Subscriber Channel

Publisher Channel

Policies

Application

Architectural Overview
Multi Server Remote

Identity Manager Server

Application Server

DirXML

Engine

DirXML

Driver App

Shim

Identity

Vault

Application

DirXML

Remote

Service

DirXML

Driver

Remote

Shim

Policies

Subscriber Channel

Publisher Channel

Policies

Identity Vault

eDirectory™

Hosts the meta data

Where policy definitions are stored for a particular driver

Maintains relationships between users and their respective applications

Where password policies are defined

Where events are generated and propagated to subscribing applications

Identity

Vault

DirXML Engine

Interface to the identity vault

Supports the loading of multiple DirXML driver shims

Guaranteed delivery of events within the identity vault

Event loop-back detection

Join engine

Handles data transformations

Processes based on filtering

Policy and XSLT processor

DirXML

Engine

DirXML Driver Shim

XML Interface

Issues and receives XML documents

Document Object Model

Application’s native interface

Does not require application to change

Can be accessed by the engine either locally or remotely

DirXML

Driver App

Shim

Remote Loader

Remote Loader Service

Does not have to be running on the same machine as Identity Manager

Allows for remote communication between the DirXML Engine and Driver Shim

Engine and Driver Shim may run on different platforms

Remote Loader Console

Tool for configuring and maintaining the Remote Loader Service

DirXML

Remote

Service

DirXML

Driver

Remote

Shim

Publication and Subscription Channels

Identity Manager is a publish and subscribe technology

Publication and Subscription Channels are viewed from the application perspective:

The application publishes data to the identity vault

The application subscribes to data from the identity vault

Policies

Subscriber Channel

Publisher Channel

DEMO

Defining Policies

Policy Order

The order in which the engine applies policies is pre-defined. An understanding of the order is critical in ensuring that business logic is implemented appropriately.

The policy order can be viewed by opening the driver overview in iManager.

Identity Manager Policies

The term policy is replacing the term rule that was formerly used in DirXML 1.x. The following terms are used in conjunction with policies in Novell Nsure Identity Manager 2:

A policy set is a collection of policies with one control point

i.e. placement policy

A policy consists of an ordered set of rules

A rule consists of:

a set of conditions to be tested and

an ordered set of actions to be performed when the conditions are met

Policy Sets

Transformation Policies

Input

Output

Event

Command

Schema Mapping

Matching

Creation

Placement

DirXML Script

Primary method used to implement policies in IDM 2.0

Replaces the Matching, Create, and Placement Rules found within DirXML 1.x

Existing non-XSLT rules are converted to DirXML Script at the time the driver is imported

Can be used instead of the schema mapping table

May be used anywhere that an XSLT transformation can be performed

DirXML Script Cont…

Reduces dependence on XSLT style sheets

As an example, DirXML Script can be used to create the following policies:

Creation

Default naming

Placement

Initial password

Schema mapping

Event Transformation

Etc.

Policy Builder

Policy Builder is a graphical interface for administering DirXML Script (accessed through an iManager task)

DirXML Script syntax was designed for use primarily with Policy Builder rather than a traditional XML editor

Policy Builder enforces valid DirXML scripting, reducing policy/syntax errors

Policies are created from the items you choose in drop-down menus -- presenting only valid options for each circumstance

Policy Builder

DEMO

Associations

Associations

Associations are used to link an object from a connected system to an object in the identity vault.

The connected system provides a Unique Object Identification scheme which is stored on the object within the identity vault. This is referred to as an association.

The identity vault then becomes the hub that links the object to one or many connected systems.

Associations eliminate the need for a unique id across multiple systems.

Objects can be associated/mapped regardless of their naming or hierarchical placement.

Building Associations

Finding an existing object that matches

Is there an object that matches my criteria?

Creating a new object

Do I have all of the required info to create the new object?

Placing a new object

Where should I place the new object?

Building Associations
Subscriber

One

Write

association

Apply

matching

rule:

Query

App

Merge

attributes

Mark

association

pending

Apply

placement

rule

Zero

NO

YES

Create

App Object

Modify

App object

Multiple

YES

NO

Desired

eDirectory

event

occurs

Apply

create

rule

Query

eDirectory

Modify

App Object

Modify

eDirectory

object

Does this object have an association?

Number of

matches

Error

Do we

have all required

attributes?

One

Write

association

Apply

matching

rule:

Query

eDirectory

Merge

attributes

Apply

placement

rule

Zero

NO

YES

Create

eDirectory

Object

Modify

eDirectory

object

Multiple

YES

NO

Desired

eDirectory

event

occurs

Apply

create

rule

Modify

App Object

Modify

eDirectory

object

Does this object have an association?

Number of

matches

Error

Do we

have all required

attributes?

Query

eDirectory

Query App

Query

App

Building Associations Publisher

Filter

The filter is used to define and control the object classes and attributes to be synchronized between an application and the identity vault.

In DirXML 1.x the filter was represented in a binary format and was stored separately for each channel. It was only capable of representing an on/off state for each class and attribute.

Updates to Filter in 2.0

Changed from a binary format to XML

Filter is linked to the driver object

Eliminates the need for a filter on both the publication and subscription channels

Notify capability

Driver is notified of attribute but does not synchronize the attribute in the identity vault

Allows driver to utilize an attribute in policies up to the command transformation policy where the attribute is then filtered out

Resync

Updates to Filter in 2.0 Cont…

Elimination of the For All Classes in Filter pseudo-class

Additional controls for:

Automatic home directory creation

Tracking of template members

Attribute merge

Optimize Modify

Modeling & Deployment

Identity Manager Designer

Design

Deploy

Document

Built on Eclispe

Fat Client

Retrieve existing configurations

Modeler View

Hierarchy View

Identity Manager Designer

DEMO

Tools & Utilities

Fail Over

Run Multiple Driver Instances on different servers

Configure Clustering Linux Servers

High Availability Cluster on SUSE LINUX

TID10093317

Configure Fail Over for NetWare

Partner Solution - CaminoSoft

Policy Usage

Use Driver Overlays

Use a Shared Driver Policy Library

Include Shared Policies within a Rule

DEMO

Command Utility

DXCMD

Execute command via a batch job

Start and Stop Drivers

View and Delete Cached Transactions

DEMO

Global Configuration Values (GCV)

Provide a method for adding parameters to a driver

Can be defined at a driver or driver set level

Driver inherits driver set GCV’s if none are defined at the driver level

Used with password synchronization, heart beat, Role Based Entitlements, etc.

Some default GCV’s are delivered with driver configurations

Created, customized and maintained in one location

Resync & Notify

IDM2 introduces new resynchronization functions:

Suppression automatic resync when re-enabling a disabled driver

Specification of a starting time for the search window for a manual resync

Setting Resync on a channel per attribute

IDM2 has a Notify Function

Use to notify a channel that a change has occur

Does not sync to target system

Enhanced Tracing

Per-driver tracing

level can individually be set

trace to separate file if desired

short nicknames

if no driver level trace set, driver set trace level used

Each message is prefixed with an identifier

EV: Event Caching System Message

ET: Non-driver Specific Engine Message

ST: Driver-Specific Subscriber Thread Message

PT: Driver-Specific Publisher Thread Message

DEMO

Password Management

Password Management

Using IDM’s Password Management

Users can have a common password securely distributed to all of the supported systems in your enterprise

This common password will conform to enterprise policies for a “well-formed” password

Users have a way to recover from forgotten passwords without having to call the help desk

Password Management involves the following tasks

Password Policy: Establishing password policies for your enterprise

Password Self-service: Enabling password self-service so users can recover from forgotten passwords

Password Distribution: Specify which connected systems will receive the common password

Password Publication to Apollo: Identify ways the common password can be set.

Password Management
Password Policies

Administrators specify the properties of a well-formed password… i.e. the password policy.

Examples of password properties include:

Minimum number of characters

Maximum number of characters

Required number of lower case characters

Required number of upper case characters

Required number of numerals

May not be a password that was used previously by this user

May not be a word found in the password exclusion list

& etc.

Conformance to the set of properties is checked before setting the password in the Identity Vault.

Password Management
Password Self-Service

Administrators configure self-service policies for each user through an iManager task

Challenge/Response mode

Administrator may turn it on or off

Administrator chooses challenge questions and related settings

Possible Actions: (the first two require Challenge/Response)

Allow the user to change their password

Email the password to the user

Email the hint to the user

Display the hint on the page

Users configure their own password hint and responses to the challenge questions using Password Self-service

The hint is not allowed to contain the password

Password Management
User Interface

DEMO

IDM Server with associated Identity Vault

IDM Web Server

1- Self-service portlet is used to enter a new password.

3- Password is set on user object in the Identity Vault

2- Password is checked for conformance to defined policies

4- Password is distributed to associated user objects on connected systems that support subscription to the password attribute

Password Synchronization

Password Synchronization - Password Distribution

Connected Systems

eDirectory

Legacy NDS

Active Directory / Exchange 2000

Windows NT Domains

SAP User Management

Network Information Service (NIS)

Linux

Solaris

other UNIX

GroupWise

Lotus Notes

SunOne

Relational databases

Oracle

DB2

Sybase

IDM Server with associated Identity Vault

IDM Web Server

1- Self-service portlet is used to enter a new password.

3- Password is set on user object in the Identity Vault

2- Password is checked for conformance to defined policies

4- Password is distributed to associated user objects on connected systems that support subscription to the password attribute

Password Sychronization
Password Publication to IDM

User sets password on a participating system

Password is distributed to associated user objects on connected systems that support subscription to the password attribute

No

Yes

Reset password on participating system to last “good” password

Participating Systems

Active Directory

NT Domains

NIS (Unix)

eDirectory

DEMO

Failure notice sent via email

Password is set on the user object in the Identity Vault.

Password is captured, and sent securely to the Identity Manager Server.

Conforms to the policy?

Reporting & Auditing

Reporting, Logging and Notification

IDM2 includes the ability to send events to Nsure Audit

Within Identity Manager and through the use of Nsure Audit you can do the following:

Notification

Setup Conditions

Specify notification channel (SMPT, flatfile, & etc.)

Reporting

Filters may be defined to report on specific events

Integrates with Crystal Reports

Export data to Microsoft Excel, or text file

Logging

You can configure which DIRXML events are logged:

Engine events – Start/stop driver, engine errors, engine warnings

Status events – Success, error, retry, warning, …

Operational events – Search, Add, Modify, Remove, & etc.

Transformation events – Initial doc, placement, create, & etc.

Events stored in flat file, Syslog, MySQL, & etc.

Monitoring

Within Identity Manager:

Graphics display status of each driver

Is the Driver Running?

Is the Driver Configured to Auto Start?

Is the Driver Disabled?

Monitoring

Within Nsure Audit:

Display to show connected systems

Display to show connected applications

Which events have been processed to Nsure Audit

Show the detail of events sent to Nsure Audit

Monitoring

Within Nsure Audit:

Display to show connected systems

Display to show connected applications

Which events have been processed to Nsure Audit

Show the detail of events sent to Nsure Audit

Monitoring

Within Nsure Audit:

Display to show connected systems

Display to show connected applications

Which events have been processed to Nsure Audit

Show the detail of events sent to Nsure Audit

Monitoring

Within Nsure Audit:

Display to show connected systems

Display to show connected applications

Which events have been processed to Nsure Audit

Show the detail of events sent to Nsure Audit

DEMO

Reporting

Within Nsure Audit:

Using Query Builder

Using Crystal Reports

DEMO

Approval Workflows

Approval Workflows

Enhanced Provisioning Module

A Novell consulting toolkit which leverages Novell exteNd technology to deliver advanced provisioning capabilities such as approval workflows, delegated administration, advanced white pages, and advanced organizational charts.

Single or Multi-Step approvals - Require single or multiple approvals from authorized personnel before provisioning access to a given system.

Workflow Delegation – Ability for a given approver to delegate a provisioning approval request to another person

Serial/Parallel Processes – Workflow tasks can be defined serially – one task must be completed before the next, or in parallel – workflow tasks can be completed at the same time.

Group or Individual Approvers – Approvals can be assigned to an individual approver or a group (pool) of approvers. Anyone in the group of approvers can make the approval.

Visual Design Environment - The workflow capabilities of the Enhanced Provisioning Module are configured through a visual, drag-and-drop editor. For example, an adminstrator quickly changes the steps in a workflow to route approvals to a different approver. These changes are immediately reflected the next time this workflow is executed.

Enhanced Provisioning Module

Module will be delivered in the future as part of the core Nsure Identity Manager product, ready-to-use, with minimal configuration.

Contains Visual Workflow Design Environment

Identity Manager Connected to the
Enhanced Provisioning Module

Identity Vault

HR

eMail

System

Enhanced

Provisioning

Module

Trigger through the

Identity Manager

Composer Driver

Approval Flow

Activities Update

Identity Vault to

Approve eMail

Account

eMail Account

Created

New Employee

Hired

Enhanced Provisioning Module

Identity Manager Composer Driver:

Used to connect to Composer to initiate Approval Workflows

Approval Workflow:

Activies update attributes on the User Object in the Identity Vault to trigger additional Identity Driver Processing

DEMO

For more information…

Visit the following technology demonstrations in the Solutions Lab:

Nsure Identity Manager – User Lifecycle Management

Nsure Identity Manager – Password Management

NEW - Powerful, visual tools for deploying Identity Manager – Designer for Identity Manager

NEW - Approval Workflow for Identity Manager with the Enhance Provisioing Module

NEW - Identity Manager Integration for Linux, Unix, Mainframe, and Midrange system

NEW - Identity Manager Integration for the Remedy ARS Help Desk

Directory Synchronization – Identity Manager

Novell Nsure Identity Manager: Connected Systems

Nsure Identity Manager Bundle Edition

Nsure Audit

Or Attend These Other IDM Sessions…

Identity Manager Sessions:

DHO 345	Identity Manager Hands-On Developer Lab

DL 147	Configuring Identity Manager 2 for HTTP/SOAP

DL 256	Advanced Identity Manager 2 Tools and Tricks

TUT 147	Implementing approval-based workflow with the Enhanced Provisioning	Module for	Nsure Identity Manager

TUT 245	Comprehensive Password Management: From Policy Definition to	Deployment

TUT 256	Fail-Over techniques for Identity Manager Clustering and More

TUT 257	Nsure Identity Manager in a Linux World

TUT 259	Troubleshooting Identity Manager 2

TUT 260	Extending Identity Management inside the enterprise with ZENworks &	IDM

TUT 264	Password Synchronization Across Connected Systems with Nsure Identity	Manager 2

TUT 349	Design, Deploy, and Document Identity Manager solutions with the new	Designer for Nsure Identity Manager

TUT 350	Implementing Identity Manager 2 Policies

Or Attend These Other IDM Sessions…

Identity Manager Connecter Sessions:

DHO 247	Building Identity manager Drivers with Extend Composer

DL 257	Identity Manager 2 Driver Development Overview and Best	Practices

TUT 252	Configuring Identity Manager 2 for GroupWise

TUT 253	Advanced Configuration for Active Directory Using Identity	Manager 2

TUT 254	Configuring Novell Identity Manager 2 for JDBC

TUT 255	Configuring Identity Manager 2 for Enterprise Applications

TUT 258	Installing and Configuring the Novell Identity Manager Mainframe	and IBM AS/400 Drivers

TUT 351	Migrating from Novell Account Management (NAM) to Identity	Manager 2

TUT 352	Identity Manager Driver for Lotus Notes Advanced Configuration

2003-12-08T12:43:39