4.1 Creating the Driver in Designer

Create the PAM driver by installing the driver packages and then modifying the configuration to suit your environment. After you create and configure the driver, you must deploy it to the Identity Vault and start it.

NOTE:Drivers are created with packages, and iManager does not support packages. To create drivers with the current version of Identity Manager, you must use Designer.

4.1.1 Importing the Current Driver Packages

Driver packages can be updated at any time and are stored in the Package Catalog. Packages are initially imported into the Package Catalog when you create a project, import a project, or convert a project. It is important to verify that you have the latest packages imported into the Package Catalog before you install the driver.

To verify that you have the latest packages imported into the Package Catalog:

  1. Open Designer.

  2. In the toolbar click Help > Check for Package Updates.

  3. Click OK if there are no package update

    or

    Click OK to import the package updates. If prompted to restart Designer, click Yes and save your project, then wait until Designer restarts.

  4. In the Outline view, right-click the Package Catalog.

  5. Click Import Package.

  6. Select the PAM packages

    or

    Click Select All to import all of the packages displayed, then click OK.

    By default, only the base packages are displayed. Deselect Show Base Packages Only to display all packages.

    The following PAM packages are available:

    • NOVLPUMENT_x.x.x.xxxxxx.jar

    • NOVLPUMCFG_x.x.x.xxxxxx.jar

    • NOVLPUMBASE_x.x.x.xxxxxx.jar

    • NOVLPUMPWD_x.x.x.xxxxxx.jar

    • NOVLPUMMSINF_x.x.x.xxxxxx.jar

  7. Click OK to import the selected packages, then click OK in the successfully imported packages message.

  8. After the current packages are imported, continue with Section 4.1.2, Installing the Driver Packages.

4.1.2 Installing the Driver Packages

After you have imported the current driver packages into the Package Catalog, you can install the driver packages to create a new driver.

  1. In Designer, open your project.

  2. In the Modeler, right-click the driver set where you want to create the driver, then select New > Driver.

    or

    Click Enterprise from the palette and then drag NetIQ PAM to the Modeler.

  3. Select PAM Base from the list of base packages, then click Next.

  4. Select the optional features to install for the PAM driver. All options are selected by default. The options are:

    • Default Configuration: This package contains the default configuration information for the PAM driver. Always leave this option selected.

    • Entitlements: This package contains policies and GCVs necessary for Entitlement support. Also, it contains GCVs to control the roles and resource mapping. With this Roles/Resources in RBPM can be mapped to the UserGroup Entitlements and end user can be granted membership to UserGroup objects on the PAM Server.

      For general information about entitlements, see the Identity Manager Entitlements Guide.

    • Password Synchronization: This packages contains the policies that enable the PAM driver to synchronize passwords. If you want to synchronize passwords, verify that this option is selected. For more information, see the NetIQ Identity Manager 4.5 Password Management Guide.

    • Data Collection: This package contains the policies that enable the driver to collect data for reports. PAM driver supports Data collection for the detailed reports. If you are using the Identity Reporting Module, verify that this option is selected. For more information refer, Identity Reporting Module Guide.

  5. Click Next.

  6. (Conditional) If there are package dependencies for the packages you selected to install, you must install them to install the selected package. Click OK to install the package dependencies listed.

  7. (Conditional) If more than one type of package dependency must be installed, you are presented with these packages separately. Continue to click OK to install any additional package dependencies.

  8. On the Driver Information page, specify a name for the driver, then click Next.

  9. On the Authentication Parameters page, fill in the following fields to authenticate to PAM and click Next:

    • Authentication ID: Specify a PAM account with administrative privileges to be used by Identity Manager. The form of the name used depends on the selected authentication mechanism.

    • Password: Provide the password for the specified PAM account.

    • Connection Information: Specify the IP address/DNS name of the PAM Server.

  10. On the Remote Loader page, fill in the following fields to configure the driver to connect using the Remote Loader, then click Next:

    • Connect to Remote Loader: By default, the driver is configured to connect using the Remote Loader. If you want to run the driver locally, select no, then click Next. Otherwise, fill in the remaining fields to configure the driver to connect by using the Remote Loader.

    • Host Name: Specify the hostname or IP address of the server where the driver’s Remote Loader service is running.

    • Port: Specify the port number where the Remote Loader is installed and is running for this driver. The default port number is 8090.

    • KMO: Specify the Key Name of the Key Material Object (KMO) that contains the keys and certificate the Remote Loader uses for an SSL connection. This parameter is only used when you use SSL for connections between the Remote Loader and the Identity Manager engine.

    • Other parameters: Specify any other parameters required to connect to the Remote Loader. Any parameters specified must use a key-value pair format, as follows: paraName1=paraValue1 paraName2=paraValue2

    • Remote Password: Specify the Remote Loader’s password as defined on the Remote Loader. The Identity Manager server (or Remote Loader shim) requires this password to authenticate to the Remote Loader

    • Driver Password: Specify the driver object password that is defined in the Remote Loader service. The Remote Loader requires this password to authenticate to the Identity Manager server.

  11. Click Next.

  12. (Conditional) On the General Information page, fill in the following fields to define your PAM system, then click Next:

    • Name: Specify a descriptive name for this PAM system. The name is displayed in reports.

    • Description: Specify a brief description for this PAM system. The description is displayed in reports.

    • Location: Specify the physical location of this PAM system. The location is displayed in reports.

    • Vendor: Leave NetIQ as the vendor of PAM. This information is displayed in reports.

    • Version: Specify the version of this PAM system. The version is displayed in the reports.

    NOTE:This page is only displayed if you installed the Managed System package.

  13. (Conditional) On the System Ownership page, fill in the following fields to define the ownership of the PAM system, then click Next:

    • Classification: Select the classification of the PAM system. This information is displayed in the reports. The available options are:

      • Mission-Critical

      • Vital

      • Not-Critical

      • Other

      If you select Other, you must specify a custom classification for the PAM system.

    • Environment: Select the type of environment the PAM system provides. The available options are:

      • Development

      • Test

      • Staging

      • Production

  14. (Conditional) On the System Classification page, fill in the following fields to define the classification of the PAM system, then click Next:

    • Business Owner: Select a user object in the Identity Vault that is the business owner of the PAM system. This can only be a user object, not a role, group, or container.

    • Application Owner: Select a user object in the Identity Vault that is the application owner of the PAM system. This can only be a user object, not a role, group, or container.

    NOTE:This page is only displayed if you installed the Managed System package.

  15. Review the summary of tasks that will be completed to create the driver, then click Finish.

The driver is now created. You can modify the configuration settings, by continuing with the next section, Section 4.1.3, Configuring the Driver. If you don’t need to configure the driver, continue to Section 4.1.4, Deploying the Driver.

4.1.3 Configuring the Driver

There are some settings that help you customize and optimize the driver. The settings are divided into categories such as Driver Configuration, Engine Control Values, and Global Configuration Values (GCVs). Although it is important for you to understand all the settings, your first priority should be to review the Driver Parameters located on the Driver Configuration page and the Global Configuration Values. These settings must be configured properly for the driver to start and function correctly.

To access the Driver Properties page:

  1. Open your project.

  2. In the Modeler, right-click the driver icon or the driver line, then select Properties.

  3. (Conditional) Click GCVs > Entitlements and review the following settings:

    NOTE:These settings are only displayed if you installed the Entitlements package.

    • UserGroup Entitlement: Ensure the value of this parameter is set to true to enable the driver to manage group memberships using the UserGroup entitlement. By default, the value is set to true.

  4. Click Apply.

  5. Modify any other settings as necessary.

    In addition to the driver settings, you should review the set of default policies and rules provided by the basic driver configuration. Although these policies and rules are suitable for synchronizing with PAM, your synchronization requirements for the driver might differ from the default policies. If this is the case, you need to change them to carry out the policies you want. The default policies and rules are discussed in Section 1.6, Default Driver Configuration.

  6. Click OK when finished.

  7. Continue with Section 4.1.4, Deploying the Driver.

4.1.4 Deploying the Driver

After a driver is created in Designer, it must be deployed into the Identity Vault.

  1. In Designer, open your project.

  2. In the Modeler, right-click the driver icon or the driver line, then select Live > Deploy.

  3. If you are authenticated to the Identity Vault, skip to Step 5; otherwise, specify the following information:

    Host: Specify the IP address or DNS name of the server hosting the Identity Vault.

    Username: Specify the DN of the user object used to authenticate to the Identity Vault.

    Password: Specify the user’s password.

  4. Click OK.

  5. Read through the deployment summary, then click Deploy.

  6. Read the success message, then click OK.

  7. Click Define Security Equivalence to assign rights to the driver.

    The driver requires rights to objects within the Identity Vault. The Admin user object is most often used to supply these rights. However, you might want to create a user account called DriversUser, for example, and assign security equivalence to that user. Whatever rights that the driver needs to have on the server, the DriversUser object must have the same security rights.

    1. Click Add, then browse to and select the object with the correct rights.

    2. Click OK twice.

  8. Click Exclude Administrative Roles to exclude users that should not be synchronized.

    You should exclude any administrative User objects (for example, Admin and DriversUser) from synchronization.

    1. Click Add, then browse to and select the user object you want to exclude.

    2. Click OK.

    3. Repeat Step 8.a and Step 8.b for each object you want to exclude.

    4. Click OK.

  9. Click OK.

4.1.5 Starting the Driver

When a driver is created, it is stopped by default. To make the driver work, you must start the driver and cause events to occur. Identity Manager is an event-driven system, so after the driver is started, it will not do anything until an event occurs.

To start the driver:

  1. In Designer, open your project.

  2. In the Modeler, right-click the driver icon or the driver line, then select Live > Start Driver.