6.9 Setting Up Identity Reporting

After installing Identity Reporting, you can modify many of the installation properties. To make changes, run the configuration update utility.

  • Linux: /opt/netiq/idm/apps/configupdate/configupdate.sh

  • Windows: C:\netiq\idm\apps\configupdate\configupdate.bat

If you change any setting for Identity Reporting with the configuration utility, you must restart the application server that hosts Identity Reporting for the changes to take effect. However, you do not need to restart the server after making changes in the web user interface for Identity Reporting.

For more information about installing this component, see Section 5.0, Installing Identity Reporting.

6.9.1 Manually Generating the Database Schema

You can recreate the database tables after installation without having to reinstall.

  1. Stop the application server, such as Tomcat. For more information, see Stopping, Starting, and Restarting Tomcat.

  2. (Conditional) Delete the existing database.

  3. (Conditional) Create a new database with the same name as the one that you deleted in Step 2.

  4. (Conditional) Clear the database checksums.

    1. Log in to your database as idm_rpt_cfg.

    2. Execute the following command for PostgreSQL:

        DO
$do$
 BEGIN
  IF EXISTS
   (select table_name from information_schema.tables where table_schema = 'public' and table_name = 'databasechangelog')
  THEN
   update databasechangelog set md5sum = null;
  END IF;
END $do$

      or

      Execute the following command for Oracle:

        BEGIN
 FOR i IN
  (select null from ALL_TABLES where OWNER = user and TABLE_NAME = 'DATABASECHANGELOG')
 LOOP
  EXECUTE IMMEDIATE 'update DATABASECHANGELOG set MD5SUM = NULL';
 END LOOP;
END;

      or

      Execute the following command for MSSQL:

      IF EXISTS (SELECT * FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_NAME = 'DATABASECHANGELOG')
UPDATE idm_rpt_cfg.DATABASECHANGELOG
SET MD5SUM = NULL

  5. Define the JAVA_HOME variable. For example:

  6. Re-initialize the database using the installed script:

    • /opt/netiq/idm/apps/idrpt/bin/db-init.sh -password *** 
    • /opt/netiq/idm/apps/idrpt/bin/db-init.sh -password *** -sql >
/opt/netiq/idm/apps/idrpt/sql/output.sql

  7. Start the application server such as Tomcat. For more information, see Stopping, Starting, and Restarting Tomcat.

6.9.2 Preparing Identity Reporting for Use

To access Identity Reporting you must assign the Report Administrator authorization and identify at least one data source. You assign the administrator authorization in Identity Governance. In general, your data source is the Identity Governance database.

To prepare Identity Reporting for daily use, complete the following activities:

You should also update to the latest version of the Identity Governance reports. For more information, see Using the Download Page in NetIQ Identity Governance Identity Reporting Guide.

Starting Identity Reporting

To verify installation and to initialize the Identity Reporting database, you must start the application server.

  1. Log in to the application server that hosts Identity Reporting.

  2. (Conditional) If this is the first time for starting Identity Reporting, complete the following steps:

    1. Delete all files and folders in the following directories for your application server:

      • Linux: Temporary directory, located by default in

        • /opt/netiq/idm/apps/tomcat/temp

        • Catalina directory, located by default in /opt/netiq/idm/apps/tomcat/work/Catalina

      • Windows: Temporary directory, located by default in:

        • C:\netiq\idm\apps\tomcat\temp

        • Catalina directory, located by default in C:\netiq\idm\apps\tomcat\work\Catalina

    2. Delete all log files from the logs directory of your application server, located by default in: .

      • Linux: /opt/netiq/idm/apps/tomcat/logs

      • Windows: C:\netiq\idm\apps\tomcat\logs

  3. Start Tomcat. For examples, see Stopping, Starting, and Restarting Tomcat.

  4. (Conditional) To observe the initialization process in Tomcat, enter the following command:

    tail -f path_to_Tomcat_folder/logs/catalina.out

    When the process completes, the file contains the following message: 

    Server startup in nnnn ms

  5. To log in to Identity Reporting, you need an account with the Report Administrator authorization.

    For more information, see Assigning the Report Administrator Authorization.

Assigning the Report Administrator Authorization

To log in to Identity Reporting, your account must have the Report Administrator authorization in Identity Governance.

  1. Log in to Identity Governance as the Global Administrator.

  2. Select Administration > Authorization Assignments.

  3. Assign users or groups to the Report Administrator authorization.

  4. Save the change.

  5. Select Identity Manager System Connection Information.

  6. For Identity Manager URL, specify the URL for Identity Reporting.

    For example, http://myserver.mydomain.com:8080/IDMRPT.

  7. Save the change, then refresh the browser to see the change.

Testing the Integration with Identity Governance

As a Report Administrator, you can access Identity Reporting from the Identity Governance interface. You can also log in directly from the Identity Reporting URL. Only accounts with the Report Administrator authorization should be able to log in to Identity Reporting.

  1. To verify that you can access Identity Reporting from Identity Governance, complete the following steps:

    1. Log in to Identity Reporting, select Home in the upper right corner.

    2. Select the Reporting module icon near your user name.

    3. Verify that you are redirected to Identity Reporting.

  2. To verify that other authorizations are denied access to Identity Reporting, complete the following steps:

    1. Log in to Identity Governance, as a Global Administrator or Security Officer.

    2. Remove the Report Administrator authorization from the account that successfully logged in to Identity Reporting.

    3. Log in to Identity Reporting with that account, which no longer has the authorization.

      You should attempt the log in from both Identity Governance and the reporting URL.

    4. Verify you cannot access Identity Reporting.

    You can also attempt to log in to Identity Reporting by using a Global Administrator or Security Officer account to verify that accounts with high-level privileges cannot access Identity Reporting without the Report Administrator authorization.

Adding Data Sources to Identity Reporting

Identity Reporting runs reports against your connected data sources. Before you can run reports, you need to add the data sources.

NOTE:You must add the Identity Governance igops database as a data source in Identity Reporting.

  1. Log in to Identity Reporting as the Report Administrator.

  2. Select Data Sources.

  3. Select Add.

  4. Specify whether you want to select from the list of data sources or provide the details for the source.

  5. (Conditional) If you selected Provide database details, specify the values for the data source. For example, database platform, the host name or IP address of the database server, and include the following settings:

    Database

    Specifies the name of the database. For example, to add the Identity Governance database, specify igops for PostgreSQL and orcl or whatever name you gave the Oracle database.

    Username

    Specifies an account that can access the tables and views in the database. For example, when adding the Identity Governance database, specify igrptuser.

  6. (Optional) Test the connection to your data source.

  7. Select Save.

  8. Clean up the Tomcat folders as described in Step 2.

    You might need to restart Tomcat.

  9. Run a test report to verify functionality in Identity Reporting.

    For more information about running reports, see [add xref to correct section in admin guide].

6.9.3 Enabling Auditing for Identity Reporting after Installation

If you did not enable auditing for Identity Reporting during the installation, you must perform additional steps to enable auditing for Identity Reporting.

  1. Stop the application server. For more information, see Stopping, Starting, and Restarting Tomcat.

  2. Launch the configuration update utility:

    1. Navigate to one of the following directories:

      • Linux: /opt/netiq/idm/apps/configupdate/configupdate.sh

      • Windows: C:\netiq\idm\apps\configupdate\configupdate.bat

    2. Launch the configuration update utility:

      • Linux: ./configupdate.sh

      • Windows: configudate.bat

    3. In GUI mode, click CEF Auditing > Auditing Settings, then click Send audit events.

    4. In Console mode:

      1. Enter the number for CEF Auditing. By default it is #4.

      2. Enter the number for the Auditing settings. By default it is #1.

      3. Enter number 1 to enable auditing.

      4. Enter the destination host and port.

      5. Enter the network protocol.

      6. Enter whether to use TLS.

      7. Enter the intermediate event store directory. This file location must exist.

    5. Save and close the configuration update utility.

  3. Edit the corresponding auditing file for Identity Reporting. For more information, see Enabling Auditing after the Installation.

  4. Start the application server. For more information, see Stopping, Starting, and Restarting Tomcat.