The credential provisioning policies can be implemented and customized to meet the needs of your environment. The following example explains how to implement the polices for the scenario presented in Figure 5-1, Credential Provisioning with SecretStore.
In the Finance scenario, SecretStore provisioning occurs after a password is successfully set in GroupWise. Most of the necessary parameters are statically configured and available to all policies through the repository and application objects. However, there are non-static data parameters (CN, password, and DirXML-ADContext) that are available only after the GroupWise user <add> or <modify-password> commands complete and the <output> document is returned from the GroupWise driver shim. The <output> document no longer contains any of the Subscriber operation attributes and the User context of the command is lost, thus preventing queries on the object. It is therefore necessary to do the following:
Make sure the GroupWise driver’s Subscriber Create policy enforces the presence of the non-static data parameters.
Cache the non-static parameters required for the provisioning operation prior to issuing the Subscriber command to the GroupWise driver shim.
Retrieve cached data for use in SecretStore provisioning after the command completes successfully.
Sample policies are available in XML format on the Identity Manager media. The filenames are SampleInputTransform.xml, SampleSubCommandTransform.xml, and SampleSubEventTransform.xml. The files are found in the following directory, where platform is Linux or Windows:
platform\setup\utilities\cred_prov
The files are installed to the Identity Manager server, if Credential Provisioning Sample Policies is selected during the installation of the utilities. The sample policies are installed to the following locations, depending upon the platform:
Windows: C:\Novell\NDS\DirXMLUtilities
Linux: /opt/novell/eDirectory/lib/dirxml/rules/credprov
The sample policies provide a starting point to develop a policy that works for your environment.