Novell IDENTITY MANAGER 3.6.1 - UNDERSTANDING POLICIES... Bedienungsanleitung

Novell®

www.novell.com

novdocx (en) 13 May 2009

AUTHORIZED DOCUMENTATION

Understanding Policies for Identity Manager 3.6

Identity Manager

3.6.1

June 05, 2009

Understanding Policies

novdocx (en) 13 May 2009

Legal Notices

Novell, Inc. makes no representations or warranties with respect to the contents or use of this documentation, and

specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose.

Further, Novell, Inc. reserves the right to revise this publication and to make changes to its content, at any time,

without obligation to notify any person or entity of such revisions or changes.

Further, Novell, Inc. makes no representations or warranties with respect to any software, and specifically disclaims

any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc.

reserves the right to make changes to any and all parts of Novell software, at any time, without any obligation to

notify any person or entity of such changes.

Any products or technical information provided under this Agreement may be subject to U.S. export controls and the

trade laws of other countries. You agree to comply with all export control regulations and to obtain any required

licenses or classification to export, re-export or import deliverables. You agree not to export or re-export to entities on

the current U.S. export exclusion lists or to any embargoed or terrorist countries as specified in the U.S. export laws.

You agree to not use deliverables for prohibited nuclear, missile, or chemical biological weaponry end uses. See the

Novell International Trade Services Web page (http://www.novell.com/info/exports/) for more information on

exporting Novell software. Novell assumes no responsibility for your failure to obtain any necessary export

approvals.

stored on a retrieval system, or transmitted without the express written consent of the publisher.

Novell, Inc. has intellectual property rights relating to technology embodied in the product that is described in this

document. In particular, and without limitation, these intellectual property rights may include one or more of the U.S.

patents listed on the Novell Legal Patents Web page (http://www.novell.com/company/legal/patents/) and one or

more additional patents or pending patent applications in the U.S. and in other countries.

Novell, Inc.

404 Wyman Street, Suite 500

Waltham, MA 02451

U.S.A.

www.novell.com

Online Documentation: To access the latest online documentation for this and other Novell products, see

the Novell Documentation Web page (http://www.novell.com/documentation).

novdocx (en) 13 May 2009

Novell Trademarks

For Novell trademarks, see the Novell Trademark and Service Mark list (http://www.novell.com/company/legal/

trademarks/tmlist.html).

Third-Party Materials

All third-party trademarks are the property of their respective owners.

4Understanding Policies for Identity Manager 3.6

novdocx (en) 13 May 2009

Contents 5

Contents

novdocx (en) 13 May 2009

About This Guide 7

1Overview 9

1.1 What Are Policies?. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

2 Upgrading Identity Manager Policies 11

2.1 Methods for Upgrading the Driver Configuration File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

2.1.1 Installing a New Driver and Moving the Existing Policies from the Old Driver . . . . . . 11

2.1.2 Overlay the New Driver Configuration File Over an Existing Driver. . . . . . . . . . . . . . 11

2.2 Recommended Driver Configuration Upgrade Procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

2.2.1 Upgrading the Driver Configuration in Designer . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

2.2.2 Upgrading the Driver Configuration in iManager . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

3 Understanding Types of Policies 17

3.1 Identity Manager Architecture in Relation to Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

3.2 Using Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

3.3 How Policies Function . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

3.3.1 Detecting Changes and Sending Them to the Identity Vault . . . . . . . . . . . . . . . . . . . 19

3.3.2 Filtering Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

3.3.3 Using Policies to Apply Changes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

3.4 Policy Types. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

3.4.1 Event Transformation Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

3.4.2 Matching Policies. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

3.4.3 Creation Policy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

3.4.4 Placement Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

3.4.5 Command Transformation Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

3.4.6 Schema Mapping Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

3.4.7 Output Transformation Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

3.4.8 Input Transformation Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

3.5 Defining Policies. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40

3.5.1 Policy Builder and DirXML Script. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40

4 Understanding Policy Components 41

4.1 DirXML Script . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

4.2 Naming Conventions for Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

4.2.1 Naming Convention for Driver Policy Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

4.2.2 Naming Convention for Policy Objects in Libraries . . . . . . . . . . . . . . . . . . . . . . . . . . 42

4.3 Variables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

4.4 Variable Expansion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

4.5 Date/Time Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

4.6 Regular Expressions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45

4.7 XPath 1.0 Expressions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46

4.8 Nested Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

6Understanding Policies for Identity Manager 3.6

novdocx (en) 13 May 2009

5 Downloading Identity Manager Policies 49

6 Defining Policies by Using XSLT Style Sheets 51

6.1 Managing XSLT Style Sheets in Designer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51

6.1.1 Adding an XSLT Style Sheet in Designer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51

6.1.2 Modifying an XSLT Style Sheet in Designer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53

6.1.3 Deleting an XSLT Style Sheet in Designer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53

6.2 Managing XSLT Style Sheets in iManager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53

6.2.1 Adding an XSLT Policy in iManager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53

6.2.2 Modifying an XSLT Style Sheet in iManager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54

6.2.3 Deleting an XSLT Style Sheet in iManager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54

6.3 Prepopulated Information in the XSLT Style Sheet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54

6.4 Using the Parameters that Identity Manager Passes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55

6.5 Using Extension Functions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57

6.6 Creating a Password: Example Creation Policy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58

6.7 Creating an eDirectory User: Example Creation Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59

About This Guide 7

novdocx (en) 13 May 2009

About This Guide

Novell®Identity Manager 3.6.1 is a data sharing and synchronization service that enables

applications, directories, and databases to share information. It links scattered information and

enables you to establish policies that govern automatic updates to designated systems when identity

changes occur.

Identity Manager provides the foundation for account provisioning, security, single sign-on, user

self-service, authentication, authorization, automated workflows, and Web services. It allows you to

integrate, manage, and control your distributed identity information so you can securely deliver the

right resources to the right people.

This guide provides detailed explanation of policies and their components.

Chapter 1, “Overview,” on page 9

Chapter 2, “Upgrading Identity Manager Policies,” on page 11

Chapter 3, “Understanding Types of Policies,” on page 17

Chapter 4, “Understanding Policy Components,” on page 41

Chapter 5, “Downloading Identity Manager Policies,” on page 49

Chapter 6, “Defining Policies by Using XSLT Style Sheets,” on page 51

To see information about administering the policies, see Policies in Designer 3.0 or Policies in

iManager for Identity Manager 3.6.1.

Audience

This guide is intended for Identity Manager administrators.

Feedback

We want to hear your comments and suggestions about this manual and the other documentation

included with this product. Please use the User Comments feature at the bottom of each page of the

online documentation, or go to www.novell.com/documentation/feedback.html and enter your

comments there.

Documentation Updates

For the most recent version of this document, see the Identity Manager Documentation Web site

(http://www.novell.com/documentation/idm35).

Additional Documentation

For documentation on using the Identity Manager drivers, see the Identity Manager Driver

Documentation Web site (http://www.novell.com/documentation/idm36drivers/index.html).

For documentation on using Designer 3.0, see the Designer 3.0 for Identity Manager 3.6.1

Documentation Web site (http://www.novell.com/documentation/designer30/).

For a detailed discussion of the document type definitions (DTD) that Identity Manager uses, see the

Identity Manager 3.6 DTD Reference.

8Understanding Policies for Identity Manager 3.6

novdocx (en) 13 May 2009

Documentation Conventions

In this documentation, a greater-than symbol (>) is used to separate actions within a step and items

within a cross-reference path.

A trademark symbol (®, TM, etc.) denotes a Novell trademark. An asterisk (*) denotes a third-party

trademark.

Overview

novdocx (en) 13 May 2009

Overview

Policies are what Identity Manager uses to synchronize data to the different systems. They are the

foundation of Identity Manager. Understanding policies and how they work is important to

successfully working with Identity Manager.

Section 1.1, “What Are Policies?,” on page 9

For administration information about policies, see

Policies in Designer 3.0

Policies in iManager for Identity Manager 3.6.1

Novell Credential Provisioning for Identity Manager 3.6

Identity Manager 3.6 DTD Reference

1.1 What Are Policies?

At a high level, a policy is the set of rules that enables you to manage the way Identity Manager

sends and receives updates. The driver sends changes from the connected system to the Identity

Vault, where policies are used to manipulate the data to achieve the desired results.

As part of understanding how policies work, it is important to understand the components of

policies.

Policies are made up of rules.

A rule is a set of conditions, see “Conditions” that must be met before a defined action, see

“Actions” occurs.

Actions can have dynamic arguments that derive from tokens that are expanded at run time.

Tokens are broken up into two classifications: nouns and verbs.

Noun tokens, see “Noun Tokens” expand to values that are derived from the current

operation, the source or destination data stores, or some external source.

Verb tokens, see “Ver b To k e n s ” modify the concatenated results of other tokens that are

subordinate to them.

Regular expressions (see Section 4.6, “Regular Expressions,” on page 45) and XPath 1.0

expressions (see Section 4.7, “XPath 1.0 Expressions,” on page 46) are commonly used in the

rules to create the desired results for the policies.

A policy operates on an XDS document and its primary purpose is to examine and modify that

document.

An operation is any element in the XDS document that is a child of the input element and the

output element. The elements are part of the Novell®

nds.dtd

; for more information, see

Identity Manager 3.6 DTD Reference in the Identity Manager DTD Reference.

An operation usually represents an event, a command, or a status.

10 Understanding Policies for Identity Manager 3.6

novdocx (en) 13 May 2009

The policy is applied separately to each operation. As the policy is applied to each operation in

turn, that operation becomes the current operation. Each rule is applied sequentially to the

current operation. All of the rules are applied to the current operation unless an action is

executed by a prior rule that causes subsequent rules to no longer be applied.

A policy can also get additional context from outside of the document and cause side effects

that are not reflected in the result document.

For detailed information, see the following sections in this guide:

Chapter 2, “Upgrading Identity Manager Policies,” on page 11

Chapter 3, “Understanding Types of Policies,” on page 17

Chapter 4, “Understanding Policy Components,” on page 41

Chapter 5, “Downloading Identity Manager Policies,” on page 49

Chapter 6, “Defining Policies by Using XSLT Style Sheets,” on page 51

Andere Handbücher für IDENTITY MANAGER 3.6.1 - UNDERSTANDING POLICIES...

Dieses Handbuch passt für folgende Modelle

Inhaltsverzeichnis

Andere Novell Software Handbücher

Novell

Novell IMANAGER - INSTALLATION V2.7 Bedienungsanleitung

Novell

Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - COMMAND LINE UTILITIES REFERENCE 10.3... Bedienungsanleitung

Novell

Novell IDENTITY MANAGER 3.6.1 - NULL SERVICE AND LOOPBACK SERVICE... Bedienungsanleitung

Novell

Novell ACCESS MANAGER 3.1 SP2 - README 2010 Bedienungsanleitung

Novell

Novell GROUPWISE 8 - LINUX-MAC CLIENT Bedienungsanleitung

Novell

Novell GROUPWISE 8 - POST OFFICE AGENT Bedienungsanleitung

Novell

Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - COMMAND LINE UTILITIES REFERENCE 10.3... Bedienungsanleitung

Novell

Novell IFOLDER 3.7 - SECURITY ADMINISTRATION Bedienungsanleitung

Novell

Novell GROUPWISE 8 - WEBACCESS Bedienungsanleitung

Novell

Novell LINUX ENTERPRISE SERVER STARTER SYSTEM Bedienungsanleitung

Novell

Novell GROUPWISE 7 ASYNC GATEWAY - INSTALLATION AND... Bedienungsanleitung

Novell

Novell PRODUCT NAME 10.3 - DEPLOYING ZENWORKS ON CITRIX SERVER BEST PRACTICES GUIDE... Bedienungsanleitung

Novell

Novell OPEN ENTERPRISE SERVER 2 SP2 - LAB GUIDE... Bedienungsanleitung

Novell

Novell GROUPWISE 8 - RESOURCES Bedienungsanleitung

Novell

Novell IFOLDER 3.X - SECURITY ADMINISTRATOR GUIDE... Service-Handbuch

Novell

Novell GROUPWISE 7 - SECURITY POLICIES Bedienungsanleitung

Novell

Novell LINUX ENTERPRISE SERVER 11 - STORAGE ADMINISTRATION GUIDE... Bedienungsanleitung

Novell

Novell POLICIES IN IMANAGER 3.6.1 - 06-05-2009 Bedienungsanleitung

Novell

Novell POLICY IN DESIGNER 3.5 - 09-18-2009 Bedienungsanleitung

Novell

Novell IDENTITY MANAGER ENTITLEMENTS SERVICE DRIVER 3.6.1 -... Bedienungsanleitung

Novell

Novell BUSINESS CONTINUITY CLUSTERING 1.1 SP1 Bedienungsanleitung

Novell

Novell ADMINSTUDIO 9.5 Bedienungsanleitung

Novell

Novell OPEN ENTERPRISE SERVER 2 SP2 - PLANING AND IMPLEMENTATION GUIDE... Bedienungsanleitung

Novell

Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - COMMAND LINE UTILITIES REFERENCE 10.3... Technisches Handbuch

Beliebte Software Handbücher anderer Marken

COMPRO

COMPRO COMPROFM Bedienungsanleitung

Muratec

Muratec OFFICEBRIDGE ONLINE Bedienungsanleitung

Oracle

Oracle Contact Center Anywhere 8.1 Bedienungsanleitung

Adobe

Adobe 65007312 - Photoshop Lightroom Handbuch

Avaya

Avaya NULL One-X for RIM Blackberry Bedienungsanleitung

HP ProLiant BL420c Bedienungsanleitung

PS Audio

PS Audio PowerPlay Betriebsanleitung

Brady

Brady LOCKOUT PRO 3.0 Service-Handbuch

Avaya

Avaya Interaction Center Bedienungsanleitung

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Handbuch

Oracle

Oracle Application 9i Bedienungsanleitung

Acer

Acer RDM Bedienungsanleitung

Canon

Canon Vixia HF21 Bedienungsanleitung

Canon

Canon ZR950 Bedienungsanleitung

Samsung

Samsung Auto Backup Bedienungsanleitung

Polycom

Polycom Vortex EF2201 Montage- und Bedienungsanleitung

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Bedienungsanleitung

Lexmark

Lexmark Apps Service-Handbuch