The integration with Identity Manager helps us with the following:
Ease for access request through Entitlements: An Entitlement defines a permission or an access that a user can have on an application. An end user requests for an Entitlement by using the web based user portal called NetIQ RBPM or UserApp. Also, the UserApp has Workflow capability that takes the request through an approval process before granting access to the user.
For PAM, the UserGroup objects are made available as Entitlements in Identity manager through the Driver. The UserGroup object is used in the PAM policy for authorizing privileged access to a server or an application. A user could login to UserApp and request for a PAM Entitlement. When the request is approved, the user gets the privileged access through the UserGroup membership. Hence, the privileged access request becomes automated through UserApp.
Managing multiple PAM Account Domains: The driver for PAM can synchronize PAM’s Credential Vault objects from Identity Manager to PAM. So, the resource and the respective credential object creation and management can be easily done as Identity Manager (eDirectory) objects.
Delegation of Password Checkin to Identity Manager: PAM allows emergency access and credential checkout/check in to any applications. During the password check in process, PAM generates a random password and the script that is set on the resource takes care of resetting the new password on the target application. PAM supports credential checkout for few applications. For every additional application, a perl script needs to be written and set on the corresponding resource object. For more information about credential checkout/ check in process, see Section 17.0, Privileged Access to Applications and Cloud Services.
In a corporate environment where Identity Manager is already used for centralized password policy definitions, management of identities and their passwords on various applications, performs the same function as the password check in process. Hence, the password check in process can be delegated to Identity Manager. The driver for PAM and Identity Manager takes care of random password generation, password policy definition for the applications, syncing the new password to the end application and finally checking in the password to PAM. Also with Identity Manager integration, the number of applications that PAM supports for credential checkout will be as many as that Identity Manager supports, which is very large. For more information about other drivers for Identity Manager, see Drivers for Identity Manager documentation page.
For auditing the password check in event details, the PAM audit report can be used and these events can also be logged in the SIEM system like Sentinel. For more details refer to Section 7.0, Managing Audit Reports.