When configuring the identity applications, this tab defines the values that the applications use when communicating with the Identity Vault. Some settings are required for completing the installation process.
By default, the tab displays the basic options. To see all settings, click . This tab includes the following groups of settings:
Identity Vault Settings
This section defines the settings that enable the identity applications to access the user identities and roles in the Identity Vault. Some settings are required for completing the installation process.
- Identity Vault Server
-
Required
Specifies the hostname or IP address for your LDAP server. For example: myLDAPhost.
- LDAP port
-
Specifies the port on which the Identity Vault listens for LDAP requests in clear text. The default value is 389.
- LDAP secure port
-
Specifies the port on which the Identity Vault listens for LDAP requests using Secure Sockets Layer (SSL) protocol. The default value is 636.
If a service already loaded on the server (before you install eDirectory) uses the default port, you must specify a different port.
- Identity Vault Administrator
-
Required
Specifies the credentials for the LDAP Administrator. For example, cn=admin. This user must already exist in the Identity Vault.
The identity applications use this account to make an administrative connection to the Identity Vault. This value is encrypted, based on the master key.
- Identity Vault Administrator Password
-
Required
Specifies the password associated the LDAP Administrator. This password is encrypted, based on the master key.
- Use Public Anonymous Account
-
Specifies whether users who are not logged in can access the LDAP Public Anonymous Account.
- Secure Administrator Connection
-
Specifies whether RBPM uses SSL protocol for all communication related to the admin account. This setting allows other operations that do not require SSL to operate without SSL.
NOTE:This option might have adverse performance implications.
- Secure User Connection
-
Specifies whether RBPM uses TLS/SSL protocol for all communication related to the logged-in user's account. This setting allows other operations that do not require TLS/SSL to operate without the protocol.
NOTE:This option might have adverse performance implications.
Identity Vault DNs
This section defines the distinguished names for containers and user accounts that enable communication between the identity applications and other Identity Manager components. Some settings are required for completing the installation process.
- Root Container DN
-
Required
Specifies the LDAP distinguished name of the root container. This is used as the default entity definition search root when no search root is specified in the directory abstraction layer. For example, o=mycompany.
- User Container DN
-
Required
When showing the advanced options, the utility displays this parameter under Identity Vault User Identity.
Specifies the LDAP distinguished name (DN) or fully qualified LDAP name of the user container. The following considerations apply to this setting:
-
Users in this container (and below) are allowed to log in to the identity applications.
-
If you have started Tomcat hosting the identity applications, you cannot change this setting with the configupdate.bat file.
-
This container must include the User Application Administrator that you specified as you set up the User Application driver. Otherwise, the specified account cannot execute workflows.
- Group Container DN
-
Required
When showing the advanced options, the utility displays this parameter under Identity Vault User Groups.
Specifies the LDAP distinguished name (DN) or fully qualified LDAP name of the group container. The following considerations apply to this setting:
-
Entity definitions within the directory abstraction layer use this DN.
-
If you have started Tomcat hosting the identity applications, you cannot change this setting with the configupdate.bat file.
- User Application Driver
-
Required
Specifies the distinguished name of the User Application driver.
For example, if your driver is UserApplicationDriver and your driver set is called myDriverSet, and the driver set is in a context of o=myCompany, specify cn=UserApplicationDriver,cn=myDriverSet,o=myCompany.
- User Application Administrator
-
Required
Specifies an existing user account in the Identity Vault that has the rights to perform administrative tasks for the specified user container for User Application. The following considerations apply to this setting:
-
If you have started Tomcat hosting the User Application, you cannot change this setting with the configupdate.bat file.
-
To change this assignment after you deploy the User Application, use the pages in the User Application.
-
This user account has the right to use the tab of the User Application to administer the portal.
-
If the User Application Administrator participates in workflow administration tasks exposed in iManager, Designer, or the User Application ( tab), you must grant this administrator appropriate trustee rights to object instances contained in the User Application driver. For more information, see the User Application Administration Guide for details.
- Provisioning Administrator
-
Specifies an existing user account in the Identity Vault that will manage Provisioning Workflow functions available throughout the User Application.
To change this assignment after you deploy the User Application, use the page in the User Application.
- Compliance Administrator
-
Specifies an existing account in the Identity Vault that performs a system role to allow members to perform all functions on the tab. The following considerations apply to this setting:
-
To change this assignment after you deploy the identity applications, use the page in the User Application.
-
During a configuration update, changes to this value take effect only if you do not have a valid Compliance Administrator assigned. If a valid Compliance Administrator exists, then your changes are not saved.
- Roles Administrator
-
Specifies the role that allows members to create, remove, or modify all roles, and grant or revoke any role assignment to any user, group, or container. It also allows its role members to run any report for any user. The following considerations apply to this setting:
-
By default, the User Application Admin is assigned this role.
-
To change this assignment after you deploy the identity applications, use the page in the User Application.
-
During a configuration update, changes to this value take effect only if you do not have a valid Roles Administrator assigned. If a valid Roles Administrator exists, then your changes are not saved.
- Security Administrator
-
Specifies the role that gives members the full range of capabilities within the Security domain. The following considerations apply to this setting:
-
The Security Administrator can perform all possible actions for all objects within the Security domain. The Security domain allows the Security Administrator to configure access permissions for all objects in all domains within RBPM. The Security Administrator can configure teams, and also assign domain administrators, delegated administrators, and other Security Administrators.
-
To change this assignment after you deploy the identity applications, use the page in the User Application.
- Resources Administrator
-
Specifies the role that gives members the full range of capabilities within the Resource domain. The following considerations apply to this setting:
-
The Resources Administrator can perform all possible actions for all objects within the Resource domain.
-
To change this assignment after you deploy the identity applications, use the page in the User Application.
- RBPM Configuration Administrator
-
Specifies the role that gives members the full range of capabilities within the Configuration domain. The following considerations apply to this setting:
-
The RBPM Configuration Administrator can perform all possible actions on all objects within the Configuration domain. The RBPM Configuration Administrator controls access to navigation items within RBPM. In addition, the RBPM Configuration Administrator configures the delegation and proxy service, the provisioning user interface, and the workflow engine.
-
To change this assignment after you deploy the identity applications, use the page in the User Application.
- RBPM Reporting Administrator
-
Specifies the Reporting Administrator. By default, the installation program lists this value as the same user as the other security fields.
Identity Vault User Identity
This section defines the values that enable the identity applications to communicate with a user container in the Identity Vault. Some settings are required for completing the installation process.
The utility displays these settings only when you select .
- User Container DN
-
Required
When not showing the advanced options, the utility displays this parameter under Identity Vault DNs.
Specifies the LDAP distinguished name (DN) or fully qualified LDAP name of the user container. The following considerations apply to this setting:
-
Users in this container (and below) are allowed to log in to the identity applications.
-
If you have started Tomcat hosting the identity applications, you cannot change this setting with the configupdate.bat file.
-
This container must include the User Application Administrator that you specified as you set up the User Application driver. Otherwise, the specified account cannot execute workflows.
- User Search Scope
-
Specifies the depth of scope that Identity Vault users can search the container.
- User Object Class
-
Specifies the object class of the LDAP user. Usually the class is inetOrgPerson.
- Login Attribute
-
Specifies the LDAP attribute that represents the user’s login name. For example, cn.
- Naming Attribute
-
Specifies the LDAP attribute used as the identifier when looking up users or groups. This is not the same as the login attribute, which is used only during login. For example, cn.
- User Membership Attribute
-
(Optional) Specifies the LDAP attribute that represents the user’s group membership. Do not use spaces when specifying the name.
Identity Vault User Groups
This section defines the values that enable the identity applications to communicate with a group container in the Identity Vault. Some settings are required for completing the installation process.
The utility displays these settings only when you select .
- Group Container DN
-
Required
When not showing the advanced options, the utility displays this parameter under Identity Vault DNs.
Specifies the LDAP distinguished name (DN) or fully qualified LDAP name of the group container. The following considerations apply to this setting:
-
Entity definitions within the directory abstraction layer use this DN.
-
If you have started Tomcat hosting the identity applications, you cannot change this setting with the configupdate.bat file.
- Group Container Scope
-
Specifies the depth of scope that Identity Vault users can search for the group container.
- Group Object Class
-
Specifies the object class of the LDAP group. Usually the class is groupofNames.
- Group Membership Attribute
-
(Optional) Specifies the user’s group membership. Do not use spaces in this name.
- Use Dynamic Groups
-
Specifies whether you want to use dynamic groups.
You must also specify a value for .
- Dynamic Group Object Class
-
Applies only when you select .
Specifies the object class of the LDAP dynamic group. Usually the class is dynamicGroup.
Identity Vault Certificates
This section defines the path and password for the JRE keystore. Some settings are required for completing the installation process.
- Keystore Path
-
Required
Specifies the full path to your keystore (cacerts) file of the JRE that Tomcat uses to run. You can manually enter the path or browse to the cacerts file. The following considerations apply to this setting:
-
In environments, you must specify the installation directory of RBPM. The default value is set to the correct location.
-
The installation program for the identity applications modifies the keystore file. On Linux, the user must have permission to write to this file.
- Keystore Password
-
Required
Specifies the password for the keystore file. The default is changeit.
Email Server Configuration
This section defines the values that enable email notifications, which you can use for email-based approvals. For more information, see the NetIQ Identity Manager - Administrator’s Guide to the Identity Applications.
- Notification Template Host
-
Specifies the name or IP address of Tomcat that hosts the identity applications. For example, myapplication serverServer.
This value replaces the $HOST$ token in e-mail templates. The installation program uses this information to create a URL to provisioning request tasks and approval notifications.
- Notification Template Port
-
Specifies the port number of Tomcat that hosts the identity applications.
This values replaces the $PORT$ token in e-mail templates that are used in provisioning request tasks and approval notifications.
- Notification Template Secure Port
-
Specifies the secure port number of Tomcat that hosts the identity applications.
This value replaces the $SECURE_PORT$ token in e-mail templates used in provisioning request tasks and approval notifications.
- Notification Template Protocol
-
Specifies a non-secure protocol included in the URL when sending user email. For example, http.
This value replaces the $PROTOCOL$ token in e-mail templates used in provisioning request tasks and approval notifications.
- Notification Template Secure Protocol
-
Specifies the secure protocol included in the URL when sending user email. For example, https.
This value replaces the $SECURE_PROTOCOL$ token in e-mail templates used in provisioning request tasks and approval notifications.
- Notification SMTP Email From
-
Specifies the email account that the identity applications use to send email notifications.
- SMTP Server Name
-
Specifies the IP address or DNS name of the SMTP email host that the identity applications use for provisioning emails. Do not use localhost.
- Server requires authentication
-
Specifies whether you want the server to require authentication.
You must also specify the credentials for the email server.
- User name
-
Applies only when you enable .
Specifies the name of a login account for the email server.
- Password
-
Applies only when you enable .
Specifies the password of an login account for the mail server.
- Use SMTP TLS
-
Specifies whether you want to secure the contents of email messages during transmission between the mail servers.
- Email Notification Image Location
-
Specifies the path to the image that you want to include in email notifications. For example, http://localhost:8080/IDMProv/images.
- Sign email
-
Specifies whether you want to add a digital signature to outgoing messages.
If you enable this option, you must also specify settings for the keystore and signature key.
- Keystore Path
-
Applies only when you enable .
Specifies the full path to the keystore (cacerts) file that you want to use for digitally signing an email. You can manually enter the path or browse to the cacerts file.
For example, C:\NetIQ\idm\apps\jre\lib\security\cacerts.
- Keystore Password
-
Applies only when you enable .
Specifies the password for the keystore file. For example, changeit.
- Alias of signature key
-
Applies only when you enable .
Specifies the alias of the signing key in the keystore. For example, idmapptest.
- Signature key password
-
Applies only when you enable .
Specifies the password that protects the file containing the signature key. For example, changeit.
Trusted Key Store
This section defines the values for the trusted keystore for the identity applications. The utility displays these settings only when you select .
- Trusted Store Path
-
Specifies the path to the Trusted Key Store that contains all trusted signers’ certificates. If this path is empty, the identity applications get the path from System property javax.net.ssl.trustStore. If the System property cannot provide the path, the installation program defaults to jre\lib\security\cacerts.
- Trusted Store Password
-
Specifies the password for the Trusted Key Store. If you leave this field is empty, the identity applications gets the password from System property javax.net.ssl.trustStorePassword. If the System property cannot provide the path, the installation program defaults to changeit.
This password is encrypted, based on the master key.
- Trusted Store Type
-
Specifies whether the trusted store path uses a Java keystore (JKS) or PKCS12 for digital signing.
NetIQ Sentinel Digital Signature Certificate & Key
This section defines the values that allows Identity Manager to communicate with Sentinel for auditing events. The utility displays these settings only when you select .
- Sentinel Digital Signature Certificate
-
Lists the custom public key certificate that you want the OAuth server to use to authenticate audit messages sent to Sentinel.
- Sentinel Digital Signature Private Key
-
Specifies the path to the custom private key file that you want the OAuth server to use to authenticate audit messages sent to Sentinel.
Miscellaneous
The utility displays these settings only when you select .
- OCSP URI
-
Specifies the Uniform Resource Identifier (URI) to use when the client installation uses the On-Line Certificate Status Protocol (OCSP). For example, http://host:port/ocspLocal.
The OCSP URI updates the status of trusted certificates online.
- Authorization Config Path
-
Specifies the fully qualified name of the authorization configuration file.
- Identity Vault Indexes
-
During installation, specifies whether you want the installation program to create indexes on the manager, ismanager, and srvprvUUID attributes. After installation, you can modify the settings to point to a new location of the indexes. The following considerations apply to this setting:
-
Without indexes on these attributes, identity applications users can experience impeded performance of the identity applications.
-
You can create these indexes manually by using iManager after you install the identity applications.
-
For best performance, you should create the index during installation.
-
The indexes must be in Online mode before you make the identity applications available to users.
-
To create or delete an index, you must also specify a value for .
- Server DN
-
Applies only when you want to create or delete an Identity Vault index.
Specifies the eDirectory server where you want the indexes to be created or removed.
You can specify only one server at a time. To configure indexes on multiple eDirectory servers, you must run the RBPM Configuration utility multiple times.
- Reinitialize RBPM Security
-
Specifies whether you want to reset RBPM security when the installation process completes. You must also redeploy the identity applications.
- IDMReport URL
-
Specifies the URL of the Identity Manager Reporting Module. For example, http://hostname:port/IDMRPT.
- Custom Themes Context Name
-
Specifies the name of the customized theme that you want to use for displaying the identity applications in the browser.
- Log Message Identifier Prefix
-
Specifies the value that you want to use in the layout pattern for the CONSOLE and FILE appenders in the idmuserapp_logging.xml file. The default value is RBPM.
- Change RBPM Context Name
-
Specifies whether you want to change the context name for RBPM.
You must also specify the new name and DN of the Roles and Resource driver.
- RBPM Context Name
-
Applies only when you select .
Specifies the new context name for RBPM.
- Role Driver DN
-
Applies only when you select .
Specifies the DN of the Roles and Resource driver.
Container Object
These parameters apply only during installation.
This section helps you to define the values for container objects or create new container objects.
- Selected
-
Specifies the Container Object Types that you want to use.
- Container Object Type
-
Specifies the container: locality, country, organizationalUnit, organization, or domain.
You can also define your own containers in iManager and add them under .
- Container Attribute Name
-
Specifies the name of the Attribute Type associated with the specified Container Object Type.
- Add a New Container Object: Container Object Type
-
Specifies the LDAP name of an object class from the Identity Vault that can serve as a new container.
- Add a New Container Object: Container Attribute Name
-
Specifies the name of the Attribute Type associated with the new Container Object Type.
