Novell IDENTITY MANAGER ENTITLEMENTS SERVICE DRIVER 3.6.1 -... Bedienungsanleitung

Novell®

www.novell.com

novdocx (en) 17 September 2009

AUTHORIZED DOCUMENTATION

Identity Manager 3.6.1 Driver for Role-Based Entitlements: Implementation Guide

Identity Manager Entitlements Service Driver

3.6.1

June 05, 2009

Implementation Guide

novdocx (en) 17 September 2009

Legal Notices

Novell, Inc. makes no representations or warranties with respect to the contents or use of this documentation, and

specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose.

Further, Novell, Inc. reserves the right to revise this publication and to make changes to its content, at any time,

without obligation to notify any person or entity of such revisions or changes.

Further, Novell, Inc. makes no representations or warranties with respect to any software, and specifically disclaims

any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc.

reserves the right to make changes to any and all parts of Novell software, at any time, without any obligation to

notify any person or entity of such changes.

Any products or technical information provided under this Agreement may be subject to U.S. export controls and the

trade laws of other countries. You agree to comply with all export control regulations and to obtain any required

licenses or classification to export, re-export or import deliverables. You agree not to export or re-export to entities

on the current U.S. export exclusion lists or to any embargoed or terrorist countries as specified in the U.S. export

laws. You agree to not use deliverables for prohibited nuclear, missile, or chemical biological weaponry end uses. For

more information on exporting Novell software, see the Novell International Trade Services Web page (http://

www.novell.com/info/exports/). Novell assumes no responsibility for your failure to obtain any necessary export

approvals.

stored on a retrieval system, or transmitted without the express written consent of the publisher.

Novell, Inc. has intellectual property rights relating to technology embodied in the product that is described in this

document. In particular, and without limitation, these intellectual property rights may include one or more of the U.S.

patents listed at Novell Legal Patents (http://www.novell.com/company/legal/patents/) and one or more additional

patents or pending patent applications in the U.S. and in other countries.

Novell, Inc.

404 Wyman Street, Suite 500

Waltham, MA 02451

U.S.A.

www.novell.com

Online Documentation: To access the online documentation for this and other Novell products, and to get

updates, see Novell Documentation (http://www.novell.com/documentation/).

novdocx (en) 17 September 2009

Novell Trademarks

For a list of Novell trademarks, see Trademarks (http://www.novell.com/company/legal/trademarks/tmlist.html).

Third-Party Materials

All third-party trademarks are the property of their respective owners.

4Identity Manager 3.6.1 Driver for Role-Based Entitlements: Implementation Guide

novdocx (en) 17 September 2009

Contents 5

Contents

novdocx (en) 17 September 2009

About This Guide 7

1Overview 9

1.1 How the Entitlements Service Driver Works. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

1.2 Role-Based Entitlements Versus Other Entitlements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

1.3 Multiple Entitlements Service Drivers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

2 Implementation Checklist 13

3 Creating a New Driver 15

3.1 Creating the Driver in Designer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

3.1.1 Importing the Driver Configuration File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

3.1.2 Configuring the Driver Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

3.1.3 Deploying the Driver . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

3.1.4 Starting the Driver . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

3.2 Creating the Driver in iManager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

3.2.1 Importing the Driver Configuration File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

3.2.2 Configuring the Driver Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

3.2.3 Starting the Driver . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

3.3 Activating the Driver . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

4 Upgrading an Existing Driver 21

4.1 Supported Upgrade Paths . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

4.2 What’s New in Version 3.6.1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

4.3 Upgrade Procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

5 Creating Entitlement Policies 23

6 Controlling the Meaning of Granting or Revoking Entitlements 27

7 Managing the Driver 29

8 Troubleshooting Role-Based Entitlements 31

8.1 General Troubleshooting Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

8.2 Conflict Resolution between Entitlement Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

8.2.1 Conflict Overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

8.2.2 Changing the Conflict Resolution Method for an Individual Entitlement . . . . . . . . . . 33

8.2.3 Prioritizing Entitlement Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

A Driver Properties 37

A.1 Driver Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

A.1.1 Driver Module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

A.1.2 Driver Object Password (iManager Only) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

6Identity Manager 3.6.1 Driver for Role-Based Entitlements: Implementation Guide

novdocx (en) 17 September 2009

A.1.3 Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

A.1.4 Startup Option . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

A.1.5 Driver Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

A.1.6 ECMAScript (Designer Only) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

A.2 Global Configuration Values . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

About This Guide 7

novdocx (en) 17 September 2009

About This Guide

This guide explains how to install and configure the Identity Manager Entitlements Service Driver.

Chapter 1, “Overview,” on page 9

Chapter 2, “Implementation Checklist,” on page 13

Chapter 3, “Creating a New Driver,” on page 15

Chapter 4, “Upgrading an Existing Driver,” on page 21

Chapter 5, “Creating Entitlement Policies,” on page 23

Chapter 6, “Controlling the Meaning of Granting or Revoking Entitlements,” on page 27

Chapter 7, “Managing the Driver,” on page 29

Chapter 8, “Troubleshooting Role-Based Entitlements,” on page 31

Appendix A, “Driver Properties,” on page 37

Audience

This guide is for Novell®eDirectoryTM and Identity Manager administrators who are using the

Entitlements Service driver to implement role-based entitlements.

Feedback

We want to hear your comments and suggestions about this manual and the other documentation

included with this product. Use the User Comment feature at the bottom of each page of the online

documentation, or go to www.novell.com/documentation/feedback.html and enter your comments

there.

Documentation Updates

For the most recent version of this document, see the Novell Identity Manager Drivers

Documentation Web site (http://www.novell.com/documentation/idm36drivers/index.html).

Additional Documentation

For information on Identity Manager and other Identity Manager drivers, see the Identity Manager

Documentation Web site (http://www.novell.com/documentation/idm36/index.html).

Documentation Conventions

In this documentation, a greater-than symbol (>) is used to separate actions within a step and items

within a cross-reference path.

A trademark symbol (®, TM, etc.) denotes a Novell trademark. An asterisk (*) denotes a third-party

trademark.

8Identity Manager 3.6.1 Driver for Role-Based Entitlements: Implementation Guide

novdocx (en) 17 September 2009

Overview

novdocx (en) 17 September 2009

Overview

The following overview assumes that you understand entitlements (as explained in the Entitlement

Overview (http://www.novell.com/documentation/idm36/idm_entitlements/?page=/documentation/

idm36/idm_entitlements/data/be4rlrn.html#be4rlrn) in the Identity Manager 3.6.1 Entitlements

Guide (http://www.novell.com/documentation/idm36/idm_entitlements/data/bookinfo.html)) and

have created the entitlements you want managed by the Entitlements Service driver.

The Entitlements Service driver is one of three entitlement agents that you can use to grant

entitlements, or permission slips, to users. The other two entitlement agents are the role-based

provisioning component and workflow-based provisioning component in the User Application.

The following sections provide information to help you understand the Entitlements Service driver:

Section 1.1, “How the Entitlements Service Driver Works,” on page 9

Section 1.2, “Role-Based Entitlements Versus Other Entitlements,” on page 11

Section 1.3, “Multiple Entitlements Service Drivers,” on page 11

1.1 How the Entitlements Service Driver Works

The Entitlements Service driver grants entitlements to and revokes entitlements from users, as

shown in the following diagram.

10 Identity Manager 3.6.1 Driver for Role-Based Entitlements: Implementation Guide

novdocx (en) 17 September 2009

Figure 1-1 Entitlements Service Driver Process

The driver implements entitlements through the use of entitlement policies. An entitlement policy

contains the following:

Membership: The list of users assigned to a policy. A user can be dynamically assigned to a

policy when he or she meets the criteria for the policy, or the user can be statically (manually)

assigned to the policy. In the above example, User A, User B, and User C are all members of

Entitlement Policy 1. User D and User E are members of Entitlement Policy 2.

Entitlements: The list of entitlements associated with the policy. Users assigned to the policy

receive all of the entitlements associated with the policy. If the user is removed from the policy,

he or she loses all entitlements associated with the policy. In the above example, the

Entitlements Service driver has granted the AD User Account entitlement and GroupWise®

Mailbox entitlement to User A, User B, and User C. Likewise, the driver has granted the AD

User Account entitlement and Exchange Mailbox entitlement to User D and User E.

The Entitlements Service driver uses the following basic process to grant entitlements to and revoke

entitlements from users:

1. The driver evaluates the users within its defined scope to see if they meet the criteria

established for membership in a policy. This occurs whenever:

Any criteria attribute used for determining membership in an entitlement policy is

modified.

A user is moved.

Dieses Handbuch passt für folgende Modelle

Inhaltsverzeichnis

Andere Novell Software Handbücher

Novell

Novell PRIVILEGED USER MANAGER 2.2.1 - ADMINISTRATION GUIDE... Bedienungsanleitung

Novell

Novell IFOLDER 3.8 - CROSS-PLATFORM Bedienungsanleitung

Novell

Novell EDIRECTORY 8.8 SP5 Bedienungsanleitung

Novell

Novell LINUX ENTERPRISE SERVER 10 SP2 - ARCHITECTURE-SPECIFIC INFORMATION... Handbuch

Novell

Novell LINUX ENTERPRISE SERVER 10 SP3 - STORAGE ADMINISTRATION GUIDE... Bedienungsanleitung

Novell

Novell GROUPWISE 7 - CROSS-PLATFORM Bedienungsanleitung

Novell

Novell LINUX ENTERPRISE DESKTOP 11 - ADMINISTRATION GUIDE... Benutzerhandbuch

Novell

Novell GROUPWISE 7 - USERS Bedienungsanleitung

Novell

Novell LINUX ENTERPRISE 11 - SUBSCRIPTION MANAGEMENT TOOL GUIDE... Bedienungsanleitung

Novell

Novell SUSE LINUX ENTERPRISE DESKTOP 11 SP1 - 8-18-2010 VIRTUALIZATION WITH... Bedienungsanleitung

Novell

Novell IFOLDER 3.6 - CROSS-PLATFORM Bedienungsanleitung

Novell

Novell PLATESPIN ORCHESTRATE 2.0.2 - ADMINISTRATOR REFERENCE... Service-Handbuch

Novell

Novell OPEN WORKGROUP SUITE SMALL BUSINESS EDITION 2.0 - INSTALLATION AND ADMINISTRATION GUIDE... Bedienungsanleitung

Novell

Novell EDIRECTORY 8.8 SP5 - TUNING GUIDE FOR UNIX... Kurzanleitung

Novell

Novell EDIRECTORY 8.8 SP2 Bedienungsanleitung

Novell

Novell ZENWORKS ENDPOINT SECURITY MANAGEMENT 3.5 Bedienungsanleitung

Novell

Novell ZENWORKS NETWORK ACCESS CONTROL 5.0 - ... Bedienungsanleitung

Novell

Novell GROUPWISE 7 - SECURITY POLICIES Bedienungsanleitung

Novell

Novell GROUPWISE 7 GATEWAY FOR MICROSOFT EXCHANGE - INSTALLATION AND... Bedienungsanleitung

Novell

Novell GROUPWISE 8 - WEBACCESS Bedienungsanleitung

Novell

Novell EDIRECTORY 8.8 SP3 Bedienungsanleitung

Novell

Novell CLIENT FOR LINUX 2.0 SP3 - 11-2009 Bedienungsanleitung

Novell

Novell CLIENT LOGIN EXTENSION 3.7 - ADMINISTRATION Bedienungsanleitung

Novell

Novell ACCESS MANAGER 3.1 SP2 - README 2010 Bedienungsanleitung

Beliebte Software Handbücher anderer Marken

COMPRO

COMPRO COMPROFM Bedienungsanleitung

Muratec

Muratec OFFICEBRIDGE ONLINE Bedienungsanleitung

Oracle

Oracle Contact Center Anywhere 8.1 Bedienungsanleitung

Adobe

Adobe 65007312 - Photoshop Lightroom Handbuch

Avaya

Avaya NULL One-X for RIM Blackberry Bedienungsanleitung

HP ProLiant BL420c Bedienungsanleitung

PS Audio

PS Audio PowerPlay Betriebsanleitung

Brady

Brady LOCKOUT PRO 3.0 Service-Handbuch

Avaya

Avaya Interaction Center Bedienungsanleitung

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Handbuch

Oracle

Oracle Application 9i Bedienungsanleitung

Acer

Acer RDM Bedienungsanleitung

Canon

Canon Vixia HF21 Bedienungsanleitung

Canon

Canon ZR950 Bedienungsanleitung

Samsung

Samsung Auto Backup Bedienungsanleitung

Polycom

Polycom Vortex EF2201 Montage- und Bedienungsanleitung

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Bedienungsanleitung

Lexmark

Lexmark Apps Service-Handbuch