Novell iManager
Advanced Configuration

Wayne Long	Kevin Fenn

Software Engineer	Worldwide Support Engineer

Novell, Inc.	Novell, Inc.

Dave Nash

Software Engineer

Novell, Inc.

Overview

Session Overview

Role Based Services (RBS)

NPM Configuration

iManager Server Configuration

Preferences

Tips and Tricks

Q & A

Role Based Services

Role Based Services (RBS)

RBS Overview

What is Role Based Services

Best Practices

Configuration

Modules

Role Administration

Role Discovery

Reporting

What is Role Based Services

RBS gives you the ability to assign specific tasks to users which presents the user with only the UI and tools necessary to perform those sets of tasks

RBS gives you a way to focus the user on a specified set of tasks and objects as determined by their roles

When a user accesses Novell iManager they will only see the roles and tasks that have been assigned to them

Allows you to customize your system to your needs

Create custom tasks, books, pages, roles and categories

RBS Objects

RBS Object Hierarchy in eDirectory™

Book

Collection

Module

Role

Scope

Task

Category

Category Selector

The category selector is new in iManager 2.5

Provides groups of roles and tasks specific to a particular function

The 'All Categories' selection displays all available roles and tasks

14 default categories are shipped with iManager 2.5

All Novell based content is assigned to a particular category that is outlined by Human Factors

You may create new categories and assign roles and tasks to them as needed

Best practices

Collection Object

Container for all other RBS objects

You can have multiple collections per tree

Users can be assigned as an owner of a collection to allow management of RBS

Multiple owners are allowed per collection

Owners are granted supervisor rights to the collection

A collection can be contained by an Organization, an Organizational Unit, a Country, a Locality and a domain

Collection - Best Practices

One size doesn't fit all

There is not a single best way to implement RBS in a tree

Novell iManager 2.5 doesn't cache information related to RBS

The data is always pulled from the directory

We will cover three most popular scenario's

Collection - Best Practices

If your tree is using a geographical structure

Create a collection in every geographical location

Use one or more iManager servers per location

Benefits

Faster login time

Less tree walking

Each geographical admin can manage their own collection

North America

Tree root

Europe

North America
iManager collection

Europe
iManager collection

...

...

Collection - Best Practices

If your tree is using an organizational structure

Create one collection at the same
level as the organizations

Use one or more iManager servers

Benefits

Less collections to manage

Sales

Tree root

Marketing

1 iManager collection

Collection - Best Practices

If your tree is using a flat structure

Create one collection below the Organization object

Use one or more iManager servers

Organization

Tree root

1 iManager collection

...

Configuration

RBS Configuration

Default Behavior

By default, RBS is not initially configured in the tree

When you first login to iManager, you are not forced to configure RBS

Until RBS is configured, all users will see “All Roles and Tasks”

Your existing rights in the tree will determine if you can do any of the operations

RBS Configuration

You will need to run the “iManager Configuration Wizard” to configure RBS

Select the Configure icon

Select the Role Based Services role

Select the RBS Configuration task

Select the Configure iManager link at the top of the page

RBS Configuration

There are three necessary steps to configure RBS

RBS schema extensions

They may have already been installed by the OS or eDirectory™ install

Create a collection object

Specify a collection name

Select a container where it will be created

Select and install the necessary modules

The wizard will take a few moments to create all of the objects and make the necessary associations

RBS Configuration UI Update

In iManager 2.5 we have moved from a task based UI to a category based UI

The category approach focuses on objects and categories of objects

Allows the user to view and manage the objects in his system showing the status of each and its relationship to other objects

This approach lets the user perform a variety of actions on single or multiple objects

This new UI allowed us to consolidate 6 Roles and 28 tasks to one role with three tasks

Only displays the collections that the logged in user owns

Modules

RBS Module Status

Available Modules

Read from the current iManager server

Installed Modules

The modules currently install

Out-Of-Date Modules

The modules that have a newer version on the server

Not-Installed Modules

The modules that are not installed

RBS Available Modules

The available module list is read from the current iManager server

Provides status and version information for each module

You can install, uninstall or update a module from this page

All columns are sortable

The number of available modules may differ on each iManager server, this depends on which NPM's have been installed

RBS Available Modules

RBS Installed Modules

The installed module list shows which available modules are installed for the selected collection

Provides version information for each module

You can reinstall or uninstall a module from this page

All columns are sortable

Reinstalling a module creates or updates the objects that have been changed since it was last installed

RBS Installed Modules

RBS Out-Of-Date Modules

The out-of-date module list shows which modules have a newer version available

Provides version information for each module

You can update or uninstall a module from this page

All columns are sortable

RBS Out-Of-Date Modules

RBS Not-Installed Modules

The not-installed module list shows the available modules that have not been installed into the selected collection

Provides version information for each module

You can install a module from this page

All columns are sortable

Role Administration

RBS Role Administration

For each role you will need to create an association:

Member

A member can be a user, a group, a dynamic group, an organization, an organizational unit, an organizational role or any object that has been extended with the dynamic group auxiliary class

Scope

Container object in the tree where the role applies for the associated member

You have the option to assign the rights to the member

You have the option to make the rights inheritable

Rights to just the container object or rights to the entire sub-directory

© February 1, 2005 Novell Inc, Confidential & Proprietary

1

Rights explained for a user

User: Bob

Help Desk Role

OU=Provo

ACL Trustee: Scope

rbsMember: Bob

rbsTrusteeOf: Provo

Equivalent To Me: Bob

Member: Bob

rbsContext: Provo

Scope

rbsAssignedRoles: Help Desk Role
Security Equals To: Scope
Group Membership: Scope

Role Discovery

Role Discovery

iManager search sequence to discover roles at login

User object

Groups objects that you are a member of

Container objects

Any Organization or Organizational Unit in the path up to the root

Organizational role objects that you are a role occupant

Dynamic group objects

Dynamic group auxiliary class objects

Role Discovery Settings

Container role discovery

Parent container (default), first partition, root of the tree

Dynamic Group search

Enabled by default, can be disabled

Dynamic Group discovery

Parent container (default), first partition, root of the tree

Dynamic Group search type

Dynamic group objects only (default)

Dynamic group objects and dynamic group auxiliary class objects

Reporting

RBS Reporting

Novell iManager 2.5 includes 12 RBS Reports

Reports will be instantaneous snapshots of your RBS configuration

Report content can be sorted ascending/descending by any column

Reports will be available in printer-friendly format

Reports can be exported in three different file formats

XML

Text

CSV (Comma Separated Value)

Role Rights Assignment – iPrint Role

Novell Plug-in Modules

Novell Plug-in Modules

NPM files are special ZIP files containing the plug-ins library, jsp, and control files

The MANIFEST.MF from the NPM is compared against the MANIFEST.MF in /nps/WEB-INF/modules/<plug-in dir>/META-INF directory to determine if this plug-in module needs to be installed or updated.

Installed Plug-in Modules can be easily uninstalled.

You must restart tomcat after installing new plug-in modules.

You must be a iManager Authorized User to install plug-in modules

If you are an iManager Authorized User and new plug-in modules exist in the packages directory, you will be informed that new iManager modules are available to install on the iManager homepage.

Novell Plug-in Modules

iManager Server Configuration

iManager Server Configuration

Affects all users of this iManager server

Settings are only for this installation of iManager and are not automatically updated between iManager servers

Stored on filesystem of the iManager Server in config.xml or configiman.properties

Some settings may require re-login in to take affect.

iManager Server Configuration

Access iManager, then select the Configure View

Choose iManager Server > Configure iManager from the left hand frame

Security

You can either save as you go to each tab or click Save once after you have made all your changes on the various tabbed pages.

Using a non-secure browser
connection

Enable NSure® Audit

An eDirectory server (Linux, NetWare®, Solaris, Windows) with Nsure Audit 1.03

Nsure Audit Platform Agent installed on the iManager Web server or Mobile iManager desktop and configured to point to the NSure Audit secure logging server.

NSure Audit must be configured with the IMAN_EN.LSC file from TOMCAT_HOME/webapps/nps/support/audit via the NSure Audit plugin.

Enable NSure Audit

The following events will be logged

iManager System Startup

iManager System Shutdown

User Login

User Logout

User Login Failure

iManager Module Installation

Auto import tree certificate

Default behavior of certificates

Imports the CA's certificate from eDirectory

Used for Trusted Root for LDAP server certificates

Works for all LDAP servers in the tree

To further tighten security, do not allow AutoUpdate and use Java's system keystore. If you do this, you must manually import the certificates that you want using the tools that come with Java.

Authorized Users

Authorized users are users who can run various administrative tasks such as Configure iManager Server and Module (NPM) Installation

must be the full DN including the tree name

saved in TOMCAT_HOME/webapps/nps/WEB-INF/configiman.properties

The installing administrators name is added by default

To designate all users as authorized users, type AllUsers (default setting with Mobile iManager)

Look and Feel Example

Logging Events

Logging Level Options

No logging, Errors, Errors and Warnings or

Errors Warnings and Debug Information

this replaces the former High, Medium, Low options

Logging Output Options

Standard Error, Standard Out, or Debug.html file

View the log file location and view the log file

Clear the log file contents

With Debug logging turned on, the iManager log file will continue to grow fairly rapidly. It needs to be manually cleared.

Authentication

Authentication configuration affects the iManager login Page

Remember Login credentials

if checked remembers the Username and Tree name. These fields can still be changed at login time.

Does not remember the password

This is not the same as the browser form history

Use Secure LDAP when auto connect

How iManager, which is acting as an LDAP client, tries to connect to the eDirectory LDAP Server

some plugins require LDAP connections

dynamic group, simple password, NMAS

Authentication

Allow Tree selection on Login Page

Determines if the Tree field will appear on the Login page

If not checked, the Default Tree Name field must be filled in.

Default Tree Name

Initial value for the tree name field on the login page. Can still be changed at login time.

Authentication – Contextless Login

Contextless Login allows users to login with only the simple username and password. They do not need to know their entire user object context.

Enable checkbox

These settings are unique per tree.

Tree name

Containers to Search

Public User name – for search credentials if set

Public User Password - for search credentials if set

The default behavior is to search from the root of the tree using “Public” access.

RBS

Misc

Enable “[This]”:

You should be able to ignore this setting

Used for internal teams modifying their own objects

If Enabled, all servers in the tree must be 8.6.2 or later

eGuide URL:

Specifies the full URL to eGuide

Used in the eGuide management tasks

“EMFRAME_SERVER” causes to look on the same server as iManager.

Object Creation List

Object Creation List

Contains the list of object classes available to create from the eDirectory Administration > Create Object task in iManager

Stored in various XML files on the file system of the Web server

If a new Class definition is added to eDirectory, it must be added to this list in order to be available from the Create Object task in iManager

You may also delete Class names from this list.

Object Creation List

To Add Object Classes to the list

Access iManager, then select the Configure View

Object Creation List > Add Object Class To Creation List

Select an object class from the Available object class list

Choose Next

Add Object Class To Creation List

Object Creation List

To Delete Object Classes from the List

Access iManager, then select the Configure View

Object Creation List > Delete Object Class From Creation List

Select an object class from the Available object classes for creation list

Choose Delete

There is no confirm for delete

There is not a way to reset the list to default values.

Preferences

Preferences

User specific for the current logged in iManager user

Unique per login DN and tree

Configuration is through the Preferences view

Stored on the file system of the iManager Web Server

Preferences are only for this installation of iManager and are not automatically updated between iManager servers

Some preferences may require re-login in to take affect.

Preferences

Manage Favorites

Select and the tasks you perform most frequently to appear on the Favorites View.

shows all tasks according to what you have been assigned in RBS

You can manual sort the order the tasks will appear

You can choose to make Favorites your initial view after login.

Object Selector

Set your Object Selector preferences for the following features:

Window Size (Window width, Window height, and left column width measured in pixels)

User-Specified Defaults

Startup Mode (Browse or Search)

Results per Page (Single and Multiple-select Modes)

Starting Context (Last used or specific)

Search on Startup (Apply button or Automatic)

These are default values when no specific values are specified by the plug-in

Object View

Set your Object View preferences for the following features:

Column Width (Measured in pixels)

Startup Mode (Browse or Search)

Selection Mode (Single or Multiple)

Results per Page (Single-select and Multiple Select Modes)

Starting Context (Last used context or specific context)

Search on Startup (Apply button or Automatic)

Set Initial View

The view that you select determines what will appear after you log in to iManager.

This is the Preference that is set from the Manage Favorites > Make favorites my initial view option

Only one Initial View.

The default is the Roles and Tasks view

Language

Select the display language you want for the iManager text.

German	∙ Japanese

English	∙ Portuguese

Spanish	∙ Russian

French	∙ Polish

Italian

This affects the current iManager browser session only. It is not saved anywhere or across any session

Tips and Tricks

General iManager Tips

Plug-ins do not synchronize between iManager instances. Plug-ins must be installed separately on all iManager installations.
Installing NPM’s in iManager may not give you visual indication that the NPM is installing. Please wait for the confirmation summary.
Browser Pop-ups must be allowed for full iManager functionality.
On all platforms except NetWare, if iManager installed Apache, Apache uses a temporary self-signed cert that expires in one year. Be sure to replace the temporary certificate with a valid certificate generated by a trusted Certificate Authority
Watch for 2.0.2 vs 2.5 versions of a plug-in (i.e. Password Management).

Plug-in Downloads

Each product group is responsible for releasing their plug-ins on the download page.
http://download.novell.com/index.jsp?search=Search&keywords=imanager&families=2611

Also watch for
Plug-in Updates

Known URL Functionality

Used for automating iManager tasks
Hides the authentication page and jumps you straight to the specified iManager task
Very helpful with common tasks such as Set Password

Known URL Functionality

1. Locate the URL for the task in question

2. Locate the taskID in the URL (base.SetPassword in this case)

3. Add the taskID into the URL example below
https://127.0.0.1/nps/servlet/imanagerservice?taskId=base.SetPassword
4. Add credentials to the end of the URL

&username=<user>&password=<pwd>&tree=<ipaddress>

Sample URL to set user password:

https://192.168.79.9/nps/servlet/imanagerservice?taskId=base.SetPassword&username=admin&password=novell&tree=192.168.79.9

Known URL Functionality

forceMaster switch

Like ConsoleOne®, modifications to eDirectory objects through iManager can happen on any writeable replica.
In order to force iManager to write to the Master replica, enable the Authenticate.forceMaster option in the $TOMCAT_HOME\webapps\nps\WEB-INF\config.xml file. Restart Tomcat for changes to take effect.

If you don't want to enable the ForceMaster option for all users, simply add the &forceMaster=true parameter to the end of URL, reload the login page and then login to iManager.
NOTE: This setting only affects NDAP connections using the NDSNameSpace

-<setting>

-<name>

<![CDATA[ Authenticate.forceMaster ]]>

</name>

-<value>

<![CDATA[ true ]]>

<value>

</setting>

Forcing Unrestricted Mode

See TID #10095953
With iManager 2.0.2, you could switch between Collection Owner and Unrestricted Mode without deleting the RBS collection by deleting the bhCollectionList attribute on the PCO object.
In iManager 2.5, the setting is now in the config.xml file.
At the very bottom of the file BEFORE the </config> ending tag, enter the following:

<setting>

<name><![CDATA[RBS.forceUnrestricted]]></name>

<value><![CDATA[true]]></value>
</setting>

Logging with Mobile iManager

Log file is located at imanager/bin/iManager.log

This is considered the Standard Output device in Mobile iManager
Increasing logging level will increase the information generated in this log file

Every time you launch Mobile iManager, this log file is cleared.

Deleting a Collection

With iManager 2.0.2, deleting a collection would automatically return you to Unrestricted Mode. With iManager 2.5, there is one extra step.
After deleting a 2.x collection, if you log into iManager, no roles or tasks will be displayed and the authentication mode will be “Assigned Access”.
You must also remove the tree name from the RBS Tree List, log out and then log in again.

Select the “-”
button to remove
the tree name

Uninstalling a Plug-in Module

The iManager plug-in uninstall uses InstallAnywhere. There are three steps you need to follow to successfully remove a plug-in

1. Remove the RBS module and tasks associated with the plug-in

2. Uninstall the plug-in through the Installed Novell Plug-in Modules task. When you uninstall an NPM, the file is moved to the
/nps/packages/deleted directory.

3. Restart Tomcat
IMPORTANT: Do not delete the RBS module for the given plug-in if there are still other iManager servers in the tree using that collection object.

Manually removing a Plug-in Module

If any of the files on disk have been manually removed or the uninstall registry has become corrupted, the uninstall may fail.
To manually uninstall a plug-in, you must remove all files laid down by the plug-in installer. Open the NPM file in a zip utility and look at the directory structure.
InstallAnywhere uses symbolic links for directory structures:
currentwebapp = TOMCAT_HOME\webapps
compiledjsps = TOMCAT_HOME\work\Standalone\localhost
MANIFEST.MF file is stored in \webapps\nps\WEB-INF\modules\<plug-in dir>\META-INF directory

Note: You may need to delete the files under the \webapps\nps\UninstallerData<plug-in dir> directory as well for the given plug-in

Co-existence of iManager 2.0.2 and 2.5 in the same tree

Please read the Upgrading from iManager 2.0.x section in the Installation Guide.
If you use iManager 2.5 to access a tree that has an RBS Collection from iManager 2.0.2, you might not see all of the roles and tasks that should display. The reason is that the RBS modules that contain the tasks need to be updated to 2.5. You do this in Configure > Role Based Services > RBS Configuration.
The main table of the RBS Configuration task shows modules that are Out-Of-Date. These can then be updated by selecting the link in the Out-Of-Date column.

IMPORTANT: If you use both iManager 2.0.2 and 2.5 in the same eDirectory tree, we recommend that you update all collections to iManager 2.5. Then plug-ins will be visible in both iManager 2.0.2 and 2.5.

Migration tool for 1.x content

The migration utility can be download by going to http://support.novell.com/servlet/filedownload/uns/nsd/imanmig25.tgz

Upgrading from 2.0.2 to 2.5

If installing iManager 2.5 on a 2.0.2 server

The nps directory is backed up to TOMCAT_HOME

All custom content is backed up

Plug-ins from old 2.0.2 directory are compared to those in the 2.5 directory and are copied into 2.5 directory if newer or don’t exist

Most 2.0.2 plug-ins are fully compatible with iManager 2.5 except for IDM plug-ins (DirXML® management and Universal Password), NSS Management and Nsure Audit plug-ins.

Upgraded 2.5 server may have more modules than a freshly installed 2.5 server.

Miscellaneous settings - TOMCAT_HOME\webapps\nps\WEB-INF\web.xml

Tomcat timeout for iManager (uncomment the section):

Require SSL setting – SSL redirect turned on by default (comment this entire section to disable) – Only affects browser https communication to the iManager server

NOTE: Any modifications to this file requires a TOMCAT reset

<session-config>

<session-timeout>10</session-timeout>

</session-config>

<security-constraint>

-<web-resource-collection>

<web-resource-name>SSL-requiring Area</web-resource-name>

<url-pattern>/servlet/*</url-pattern>

</web-resource-collection>

-<user-data-constraint>

<transport-guarantee>CONFIDENTIAL</transport-guarantee>

-<user-data-constraint>

</security-constraint>

More information

For more information about iManager please visit the following sessions or the iManager booth in the lab.

TUT 246: iManager Overview and Configuration Basics

DHO 246: Novell iManager Custom Tasks

Q & A

A user object is linked to a role through the rbsAssignedRoles attribute. It is linked to the scope through the Security Equals To and the Group Membership attributes. Role objects hold a list of all users assigned to the role through the rbsMember attribute. rbsScope objects keep a list of all members through the Member attribute. The ACL list on the container object hold all the information needed to perform the given role as seen in the upcoming slides.

TUT347 - Novell iManager Advanced Configuration

2003-12-08T12:43:39