NetIQ eDirectory is a list of objects that represent network resources, such as network users, servers, printers, print queues, and applications. You can enable password check-out feature to access the eDirectory server.
To enable the credential checkout feature for eDirectory, you can add the rules by using the eDirectory policy template.
Follow the procedure, after importing the vault:
In the General tab, enter the name, example: DOM-APP_LDAP. Click Next.
In the Connection tab, specify the following details:
Application Type: Enter the application type as LDAP.
Host Name/IP Address: Enter either the host name or the IP address of the E-Directory.
Port: Enter the port number. If you enable SSL, the port number is 636, else the port number is 389.
SSL: Enable or disable by moving the button to the left or to the right.
Password Change on Check in:
Based on the following selection the password of the application will be changed automatically every time a credential is checked in.
Never
You can use this option if you do not want to change the password after every credential check-in.
Delegate to Identity Manager
If you want to delegate the password check-in process to Identity Manager, select Delegate to Identity manager. Once a resource is created in Identity Manager, it gets synced to Privileged Access Manager. Resource permission is created in Privileged Access Manager but during check in and checkout password is rotated and handled by Identity Manager Driver Implementation guide on the PAM documentation page.
NOTE:Although the latest IDM driver version is 4.8.x, ensure that you use 4.5.x version of the IDM driver package, as 4.5.x version is currently supported with Privileged Access Manager.
NOTE:Before you delegate password check-in to Identity Manager ensure that both the Privileged Access Manager IDM driver and database driver are operational.
By Script
Enter the E-Directory script in the text box provided.
Select the appropriate Password Policy that must be used when Privileged Access Manager generates a new password. By default Default Password Policy is selected. You can either modify the default password policy or create a new password policy.
User DN
Password
NOTE:Ensure not to use '%', percentage character in the special characters list of the password policy.
NOTE:Enter the user DN and password in the Credentials fly out.
Reconcile Account: Select based on the account.
Script Arguments: Select any relevant script argument.
In the Extended Attributes tab, click +Define and select the relevant attributes from the list. Click Finish