6.4 Installing Identity Reporting

This section describes the process for installing Identity Reporting if you did not install it when you installed Identity Governance.

6.4.1 Using the Guided Process to Install Identity Reporting

This procedure describes how to install Identity Reporting for Identity Governance using an installation wizard, either in GUI format or from the console. To perform a silent, unattended installation, see Installing Identity Reporting Silently.

To prepare for the installation, review the prerequisites and system requirements listed in Identity Reporting Server System Requirements. Also see the Release Notes accompanying the release.

  1. Log in as root on Linux server or an administrator on Windows server where you want to install Identity Reporting.

    NOTE:Identity Reporting requires you to log in as root on Linux server or an administrator on Windows server to complete the installation successfully.

  2. Stop Tomcat. For examples, see Stopping, Starting, and Restarting Tomcat.

  3. From the directory that contains the installation files, complete one of the following actions:

    NOTE:To execute the file, you might need to use the chmod +x or sh command for Linux or log in to your Windows server as an administrator.

    • Linux: Use the following commands for Linux:

      • Console: Enter ./identity-governance-install-linux.bin -i console

      • GUI: Enter ./identity-governance-install-linux.bin

    • Windows: Use the following commands for Windows:

      • Console: Enter cmd /c "identity-governance-install-win.exe -i console"

      • GUI: Double-click identity-governance-install-win.exe

  4. Accept the License Agreement, and then select Next.

  5. Select the Identity Reporting install set.

  6. To complete the guided process, specify values for the following parameters:

    • Select install location

      Specifies the location for the installation files.

    • Tomcat installation

      Represents the settings for the Tomcat installation that hosts Identity Governance. In a clustered environment, specify runtime values for each node where you install Identity Governance.

      Specify the Tomcat folder

      Specifies the path to the Tomcat installation. The installation process adds or modifies some files for Identity Governance to this folder. For example:

      • Linux: /opt/apache-tomcat-x.x.xx

      • Windows: c:\path\to\tomcat-x.x.xx

      Runtime host name

      Specifies the DNS name or IP address for the Tomcat installation.

      Runtime port

      Specifies the port that Tomcat uses to listen for communication from Identity Governance or the load balancers.

      Runtime identifier

      In a non-clustered environment, you can specify the local server name.

      In clustered environment, specifies the unique name for the current node. For example, node1 or ProdNode1. Do not use the server’s name, which might change according to a DHCP assignment.

    • Tomcat Java Home

      Represents the path to the Oracle Java instance that Tomcat uses. The installation process adds some files for Identity Governance to the Tomcat home folder. For example:

      • Linux: /root/jdk1.x.x_xx

      • Windows: c:\path\to\jdk1.x.x.xx

    • Application address

      Represents the settings of the URL that users need to connect to Identity Reporting on the application server. For example, https://myserver.mycompany.com:8443.

      NOTE:If OSP runs on a different instance of the application server, you must also select Connect to an external authentication server and specify values for the OSP server.

      Protocol

      Specifies whether you want to use http or https. To use SSL for communication, specify https.

      Host name

      Specifies the DNS name or IP address of the application server. Do not use localhost.

      Port

      Specifies the port that you want the application server to use for communication with Identity Governance.

      Connect to an external authentication server

      Specifies whether a different instance of the application server that hosts the authentication server (OSP). The authentication server contains the list of users who can log in to Identity Reporting.

      If you select this setting, also specify values for the authentication server’s Protocol, Host name, and Port.

    • Application address

      Applies only when the Identity Governance server location is unknown.

      Represents the settings of the URL that users need to connect to the Identity Governance. For example, https://myserver.mycompany.com:8443.

      Protocol

      Specifies whether you want to use http or https. To use Secure Sockets Layer (SSL) for communications, specify https.

      Host Name

      Do not use localhost.

      In a non-clustered environment, specifies the DNS name or IP address of the server hosting Identity Governance.

      In a clustered environment, specifies the DNS name of the server that hosts the load balancer that you want to use. For more information about installing in a clustered environment, see Ensuring High Availability for Identity Governance.

      Port

      Specifies the port that you want the server to use for communication with client computers. The default is 8080. To use SSL, the default is 8443.

      When installing in a clustered environment, specify the port for the load balancer.

    • Authentication details

      Represents the requirements for connecting Identity Governance to the LDAP authentication server (for example, OSP) that contains the list of users who can log in to the application. For more information about the authentication server, see Understanding Authentication for Identity Governance.

      NOTE:In a clustered environment where the osp.war file resides behind the load balancer, specify the host and port for the load balancer’s server rather than the authentication server.

      Service password

      Specifies the password that you want to create for Identity Governance to use when connecting to the LDAP authentication server. Also referred to as the client secret.

      Protocol

      Change this only when you choose to connect to an external authentication server.

      Specifies whether you want to use http or https when connecting with the external LDAP authentication server. To use Secure Sockets Layer (SSL) for communications, specify https.

      Host

      Change this only when you choose to connect to an external authentication server.

      Specifies the IP address or DNS host name of the LDAP authentication server or load balancer. Do not use localhost.

      Port

      Change this only when you choose to connect to an external authentication server.

      Specifies the port that you want the LDAP authentication server or load balancer to use for communication with Identity Governance.

    • Database Type

      Specifies the platform you want to use for the Identity Governance and reporting databases.

      For more information about supported versions, see Database Server System Requirements.

    • Database details

      Represents the settings for the Identity Governance and reporting databases. For more information, see Understanding the Identity Governance and Reporting Databases.

      To connect to an existing database instance, you must specify the names of the existing databases to match with the operations, data collection, workflow, and analytics databases.

      In a clustered environment, perform the configuration steps only on the primary node in the cluster. For more information about installing in a clustered environment, see Ensuring High Availability for Identity Governance.

      Configure database now

      Specifies that you want to configure your new or existing databases as part of the installation process.

      NOTE:Ensure that you specified the correct names for the existing databases.

      Generate SQL for later

      Specifies that you want to generate the SQL scripts that the database administrator can run in your database platform to create the databases and other artifacts.

      The installation process stores the scripts in the following directory:

      • Linux: /opt/netiq/idm/apps/idgov/sql

      • Windows: c:\netiq\idm\apps\idgov\sql

      If you are installing Identity Reporting at this time, the installation process stores the scripts in the following directory:

      No database configuration

      Specifies that you do not want to configure a new or existing database.

      Use this setting when you install Identity Governance on a secondary node in the cluster. For more information, see Ensuring High Availability for Identity Governance.

      Host

      Specifies the DNS name or the IP address of the server that hosts the Identity Governance databases.

      Port

      Specifies the port of the server that hosts the Identity Governance databases. The default values are 1433 for MS SQL Server, 1521 for Oracle and 5432 for PostgreSQL.

      Microsoft SQL Server JDBC Jar

      Applies only when using an MS SQL Server database

      Specifies the path to the JAR file for the MS SQL Server JDBC driver. Microsoft provides this file.

      Oracle JDBC Jar

      Applies only when using an Oracle database

      Specifies the path to the JAR file for the Oracle JDBC driver. For example: /.

      • Linux: opt/oracle/ojdbc7.jar

      • Windows: c:\ProgramFiles\Oracle\ojbc7.jar

      Oracle provides the driver JAR file, which represents the Thin Client JAR for the database server.

      Database name

      Applies only when using an Oracle database

      Specifies the name of the database to which you want to add the Identity Governance databases. For example, Orclidentitygovernance.

      User tablespace

      Applies only when using an Oracle database

      Specifies the name of the database storage unit for storing the schema for the Identity Governance databases. The default is USERS.

      Temporary tablespace

      Applies only when using an Oracle database

      Specifies the name of the temporary database storage unit for storing the schema. The default is TEMP.

      Operations

      Specifies the name of the database that stores operations data for Identity Governance. The default value is igops.

      NOTE:If you created a blank database for the operations data, ensure that you specify the exact name of the existing, empty database.

      Data collection

      Specifies the name of the database that stores data collection information for Identity Governance. The default value is igdcs.

      NOTE:If you created a blank database for the data collection information, ensure that you specify the exact name of the existing, empty database.

      Workflow

      Specifies the name of the database that stores workflow information for Identity Governance. The default value is igwf.

      NOTE:If you created a blank database for the workflow data, ensure that you specify the exact name of the existing, empty database.

      Analytics

      Specifies the name of the database that stores analytics information for Identity Governance. The default value is igara.

      NOTE:If you created a blank database for the analytics data, ensure that you specify the exact name of the existing, empty database.

      Password (for database owners)

      Specifies the password for the database account administrator that can create database tables, views, and other artifacts in the Identity Governance databases.

      Reporting user

      Specifies the account for a database user that has rights to the views related to reporting for Identity Governance. The default value is igrptuser.

      The installation process creates this account if you select Configure database now and Update (rather than Use only existing).

      Reporting user password

      Specifies the password for the reporting administrator.

      Administrator user

      Specifies the account for a database administrator that the installation process can use to configure the databases for Identity Governance.

      WARNING:Do not use the default database administrator account (idmadmin) if that account was created when you installed PostgreSQL and Tomcat.

      Administrator password

      Specifies the password for the database administrator.

      Update / Use only existing

      Applies only when you choose to configure the database during the installation.

      Specifies whether you want to have the installation process migrate or create new databases or use existing, empty databases. Select Update if you are installing or upgrading Identity Governance.

      NOTE:To use existing databases, the installation program drops known tables and views within each schema and then adds the needed tables and views that it needs for the current version.

    • Report default language

      Specifies the language that you want to use for Identity Reporting.

      Target locale

      Specifies the locale. Default selection is English.

    • Report email delivery

      Represents the settings for the SMTP server that sends report notifications. To modify these settings after installation, use the configuration utility for Identity Governance.

      Default email address

      Specifies the email address that you want Identity Reporting to use as the origin for email notifications.

      SMTP server

      Specifies the IP address or DNS name of the SMTP email host that Identity Reporting uses for notifications. Do not use localhost.

      SMTP server port

      Specifies the port number for the SMTP server. The default value is 465.

      Use SSL for SMTP

      Specifies whether you want to use SSL protocol for communication with the SMTP server.

      Require server authentication

      Specifies whether you want to use authentication for communication with the SMTP server.

      If you select this setting, also specify the credentials for the email server.

      SMTP user name

      Applies only when you select Requires server authentication.

      Specifies the name of a login account for the SMTP server.

      SMTP password

      Applies only when you select Requires server authentication.

      Specifies the password of a login account for the SMTP server.

    • Report retention details

      Represents the settings for maintaining completed reports.

      Keep finished reports for

      Specifies the amount of time that Identity Reporting will retain completed reports before deleting them. For example, to specify six months, enter 6 and then select Month.

      Location of report definitions

      Specifies a path where you want to store the report definitions. For example:

      • Linux: /opt/netiq/IdentityReporting

      • Windows: c:\netiq\IdentityReporting

    • Identity Audit

      Represents the settings for collecting auditing events that occur in the Identity Governance server. For more information, see Enabling Auditing.

      Enable auditing

      Specifies whether you want to send Identity Governance log events to an auditing server.

      If you select this setting, also specify the audit server details.

      Audit server

      Applies only when you enable identity auditing.

      Specifies the IP address or DNS name of the audit server.

      Audit port

      Applies only when you enable identity auditing.

      Specifies the port to use for sending log events to the audit server.

      Audit cache location

      Applies only when you enable identity auditing.

      Specifies the location of the cache directory on the Identity Governance server that you want to use to store log events. For example:

      • Linux: /opt/netiq/idm/apps/audit

      • Windows: C:\netiq\idm\apps\audit

      Secure layer

      Applies only when you enable identity auditing.

      Specifies whether to use TLS (TCP using SSL). If not selected, events are sent using TCP.

      Trust store location

      Applies only when you want to use TLS for audit events.

      Specifies the path to the keystore file location for trusting the audit server certificate. For example:

      • Linux: /opt/netiq/idm/apps/jre/lib/security/cacerts

      • Windows: C:\netiq\idm\apps\jre\lib\security\cacerts

      Trust store password

      Applies only when you want to use TLS for audit events.

      Specifies the password for the trust store file.

      Test certificate trust

      Applies only when you want to use TLS for audit events.

      Specifies whether to attempt to connect to the audit server and trust the retrieved certificate within a copy of the trust store file. The actual trust occurs during the installation process.

      NOTE:Attempting a TLS connection on a TCP port results in a timeout after 5 seconds. Be sure to specify a secure audit port if you select to use TLS.

  7. Review the information in the Pre-Installation Summary window, and then select Install.

  8. When the installation process completes, continue to Section 7.0, Completing the Installation Process.

6.4.2 Installing Identity Reporting Silently

A silent (non-interactive) installation does not display a user interface or ask the user any questions. Instead, the system uses information from a silent properties file. You can run the silent installation after editing the file to customize the installation process for your environment. To perform a guided installation, see Using the Guided Process to Install Identity Reporting.

To prepare for the installation, review the prerequisites and system requirements listed in Identity Reporting Server System Requirements. Also see the Release Notes accompanying the release.

  1. Log in as root on Linux server or an administrator on Windows server where you want to install Identity Reporting.

  2. (Conditional) To avoid specifying passwords for the installation in the silent properties file for a silent installation, use the export or set command. For example: 

    export install_db_reporting_secret=myPassWord

    The silent installation process reads the passwords from the environment, rather than from the silent properties file.

    Specify the following passwords:

    Database users

    The installation program creates the user idm_rpt_cfg for the reporting schema.

    The following are the default administrators installed with your database:

    • MS SQL Server: sa

    • Oracle: SYSTEM

    • PostgreSQL: postgres

    install_db_admin_secret

    Specify the password for the administrator for the reporting database.

    install_db_reporting_secret

    Specify the password for idm_rtp_cfg which is used internally to support report administration during runtime.

    install_smtp_password_auth_user

    (Conditional) To use authentication for email communications, specify the password for the default SMTP email user.

    install_authserver_client_secret

    Specify the client ID password for authenticating using OSP.

    install_truststore_secret

    (Conditional) Applies only when you are using secure communications.

    Specify the password for the trust store.

  3. To specify the installation parameters, complete the following steps:

    1. Locate the sample identity-governance-install-silent.properties silent properties file, by default in the same directory as the installation scripts for Identity Governance.

    2. In a text editor, open the silent properties file.

    3. Specify the parameter values. For a description of the parameters, see Step 6.

    4. Save and close the file.

  4. Stop the application server, such as Tomcat. For examples, see Stopping, Starting, and Restarting Tomcat.

  5. To launch the installation process, enter the following command:

    • Linux: ./identity-governance-install-linux.bin -i silent -f path_to_silent_properties_file

    • Windows: From a command line enter: identity-governance-install-win.exe -i silent -f path_to_silent_properties_file

    NOTE:If the silent properties file resides in a different directory from the installation script, you must specify the full path to the file. The script unpacks the necessary files to a temporary directory and then launches the silent installation.

  6. When the installation process completes, continue to Section 7.0, Completing the Installation Process.