The integration with Identity Manager helps us with the following:
Ease for access request through Entitlements: An Entitlement defines a permission or an access that a user can have on an application. An end user requests for an Entitlement by using the web based user portal called NetIQ RBPM or UserApp. Also, the UserApp has Workflow capability that takes the request through an approval process before granting access to the user.
For Privileged Account Manager, the UserGroup objects are made available as Entitlements in Identity manager through the Driver. The UserGroup object is used in the Privileged Account Manager policy for authorizing privileged access to a server or an application. A user could login to UserApp and request for a Privileged Account Manager Entitlement. When the request is approved, the user gets the privileged access through the UserGroup membership. Hence, the privileged access request becomes automated through UserApp.
Managing multiple Privileged Account Manager Account Domains: The driver for Privileged Account Manager can synchronize Privileged Account Manager’s Credential Vault objects from Identity Manager to Privileged Account Manager. So, the resource and the respective credential object creation and management can be easily done as Identity Manager (eDirectory) objects.
Delegation of Password Checkin to Identity Manager: Privileged Account Manager allows emergency access and credential checkout/check in to any applications. During the password check in process, Privileged Account Manager generates a random password and the script that is set on the resource takes care of resetting the new password on the target application. Privileged Account Manager supports credential checkout for few applications. For every additional application, a perl script needs to be written and set on the corresponding resource object. For more information about credential checkout/ check in process, see Privileged Access to Applications and Cloud Services.
In a corporate environment where Identity Manager is already used for centralized password policy definitions, management of identities and their passwords on various applications, performs the same function as the password check in process. Hence, the password check in process can be delegated to Identity Manager. The driver for Privileged Account Manager and Identity Manager takes care of random password generation, password policy definition for the applications, syncing the new password to the end application and finally checking in the password to Privileged Account Manager. Also with Identity Manager integration, the number of applications that Privileged Account Manager supports for credential checkout will be as many as that Identity Manager supports, which is very large. For more information about other drivers for Identity Manager, see Drivers for Identity Manager documentation page.