RSA Identity Governance and Lifecycle Collector Data Sheet For IBM Tivoli Directory Server

Transcription

1 RSA Identity Governance and Lifecycle Collector Data Sheet For IBM Tivoli Directory Server Version 1.2 June

2 Contact Information RSA Link at contains a knowledgebase that answers common questions and provides solutions to known problems, product documentation, community discussions, and case management. Trademarks RSA, the RSA Logo, and EMC are either registered trademarks or trademarks of EMC Corporation in the United States and/or other countries. All other trademarks used herein are the property of their respective owners. For a list of RSA trademarks, go to License Agreement This software and the associated documentation are proprietary and confidential to EMC, are furnished under license, and may be used and copied only in accordance with the terms of such license and with the inclusion of the copyright notice below. This software and the documentation, and any copies thereof, may not be provided or otherwise made available to any other person. No title to or ownership of the software or documentation or any intellectual property rights thereto is hereby transferred. Any unauthorized use or reproduction of this software and the documentation may be subject to civil and/or criminal liability. This software is subject to change without notice and should not be construed as a commitment by EMC. Third-Party Licenses This product may include software developed by parties other than RSA. The text of the license agreements applicable to third-party software in this product may be viewed on the product documentation page on RSA SecurCare Online. By using this product, a user of this product agrees to be fully bound by terms of the license agreements. Note on Encryption Technologies This product may contain encryption technology. Many countries prohibit or restrict the use, import, or export of encryption technologies, and current use, import, and export regulations should be followed when using, importing or exporting this product. Distribution Use, copying, and distribution of any EMC software described in this publication requires an applicable software license. EMC believes the information in this publication is accurate as of its publication date. The information is subject to change without notice. THE INFORMATION IN THIS PUBLICATION IS PROVIDED "AS IS." EMC CORPORATION MAKES NO REPRESENTATIONS OR WARRANTIES OF ANY KIND WITH RESPECT TO THE INFORMATION IN THIS PUBLICATION, AND SPECIFICALLY DISCLAIMS IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. 2

3 Contents Revision History... 5 Purpose... 6 Supported Software... 6 Identity Data Collector... 7 Prerequisites... 7 Manage Endpoint Credentials Using Password Vault... 7 Configuration... 7 Collector Description... 7 Connection Configuration... 8 Select types of identity data to collect... 9 Map Collector Attributes to User Attributes... 9 Account Data Collector Prerequisites Configuration Collector Description Connection Configuration Select types of account data to collect Mapping for account and user account attributes Mapping for Group attributes Edit User Resolution Rules Edit Member Account Resolution Rules Edit Sub-Group Resolution Rules Entitlement Data Collector Prerequisites Configuration Collector Description Connection Configuration Select types of entitlement data to collect

4 Case 1: Select Users & Enable Collect Groups as Application Roles Case 2: Select Accounts & Enable Collect Groups as Application Roles Case 3: Select Users and Disable Collect Groups as Application Roles Case 4: Select Accounts and Disable Collect Groups as Application Roles Copyrights Trademarks

5 Revision History Revision Number Version 1.0 Version 1.1 Version 1.2 Description IBM Tivoli Directory Server Added instructions for configuring the password vault with RSA Identity Governance and Lifecycle IBM Tivoli Directory Server Identity Data Collector Added instructions for configuring the password vault with RSA Identity Governance and Lifecycle IBM Tivoli Directory Server Account Data Collector and Entitlement Data Collector 5

6 Purpose This data sheet provides the configuration information required to create a new IBM Tivoli Directory Server Identity Data Collector, Account Data Collector and Entitlement Data Collector. Supported Software RSA Identity Management and Governance and later RSA Via Lifecycle and Governance and later RSA Identity Governance and Lifecycle and later Application: IBM Tivoli Directory Server 6.1 and later 6

7 Identity Data Collector Prerequisites Manage Endpoint Credentials Using Password Vault To use a third-party password vault to manage endpoint credentials, perform the following steps. 1. Configure the password vault according to the third-party provider s instructions. 2. Create a new password vault profile in the RSA Identity Governance and Lifecycle system for retrieving the IBM Tivoli Directory password from the vault. See the RSA Identity Governance and Lifecycle Help for more information about creating a password vault profile. Ensure that an IBM Tivoli Directory account has been created at the configured password vault for storing the password. Note: To use the dynamic password feature, step 1 must be completed. If a third-party password vault is not configured, configure the collector with a static password. Configuration The configuration of the Identity data Collector is completed through a number of screens. This section helps you to fill in the values for each screen. Collector Description The following table lists the parameters on the Collector Description screen, while creating the Collector. Collector Name IBM Tivoli Directory Server Identity Data Collector Description IBM Tivoli Directory Server Identity Data Collector Data Source Type IBM Tivoli Directory Server Agent AveksaAgent 7

8 Directory Directory name under which Data Collector is being created e.g. IBM Tivoli Directory Status Active Copy from N/A Scheduled N/A Connection Configuration The following table lists the parameters on the Configuration Information screen, while creating the Collector. For more information about using static or dynamic passwords during collector creation and in the configuration wizard, refer to Manage Endpoint Credentials Using a Password Vault in the prerequisites section. Host <Host name or IP address of the server> Port <Port number of the server (Default non-ssl port: 389 and SSL port: 636)> Bind DN Static Password Dynamic Password <The DN of the ITDS user needed to bind to the directory (for example, cn=orcladmin)> Select this option to provide the password statically/manually. Enter the password for the IBM Tivoli Directory administrator in the area provided. Select this option to use a configured password vault to manage the endpoint credentials. After you select this option, either select a previously configured password vault profile from the drop-down menu, or click Create Profile to add a new password vault profile to use with this connector. RSA Identity Governance and Lifecycle uses this profile to retrieve the appropriate credentials from the password vault during collector deployment and 8

9 connection tests. Disable Paging <Want to enable paging or not (Default: false)> Page Size <Page Size must not exceed MaxPageSize attribute in IBM Tivoli Directory Server. (Default: 1000)> Use SSL <Whether SSL should be used to connect or not. By default, traffic is transmitted unsecured. You can make traffic confidential and secure by using Secure Sockets Layer (SSL) technology. Before you configure SSL at your end, you must first make sure that LDAP over SSL (also known as LDAPS or LDAP over TLS) is enabled on your LDAP server. LDAP connections are not enabled by default. SSL should be used if you wish to add users with passwords or to change their domain passwords> Skip Certificate Validation <Whether Certificate validation should be skipped or not. (Default: false)> WARNING: NOT RECOMMENDED as it skips certificate chain validation Select Certificate <Lists down the certificates fetched from the server. Selected certificate will be appeared in PEM format in Certificate field> Certificate <Certificate retrieved from IBM Tivoli Directory Server in PEM format> Note: Keep this field blank if one wants to use default truststore of JVM or Server Select types of identity data to collect The following table lists the parameters for the select types of identity data to collect. Users <Enable the check-box to collect user identities. (Default: true)> Map Collector Attributes to User Attributes The following table lists the parameters on the Map Collector Attribute to User Attributes screen, while creating the Collector. 9

10 User Base DN <Base DN of the ITDS user from where user identities are to be collected. (for e.g.: ou=testusers,dc=aveksa,dc=com)> User Search Scope <Define the search scope for collection. (for e.g., sub-tree or one level)> User Search filter <Searches the users based on the provided filter e.g. (objectclass=inetorgperson), (&(objectclass=orcluser)(objectclass=orcluserv2)) etc.> User ID <Any unique value for the users. (Default: cn)> Business Unit Id <Business Unit Id> Backup Supervisor <Backup Supervisor> Address <mail attribute of the user> First Name <givenname attribute of the user> Is Terminated <Is terminated attribute of the user> Last Name <sn attribute of the user> Termination Date <Termination date of the user> Title <title attribute of the user e.g. title, dn etc.> Unique Id <uid attribute of the user> Account Data Collector Prerequisites The following software must be installed on your network before configuring the collector: 10

11 IBM Tivoli Directory Server (ITDS) Configuration The configuration of the Account data Collector is completed through a number of screens. This section helps you to fill in the values for each screen. Collector Description The following table lists the parameters on the Collector Description screen, while creating the Collector. Collector Name IBM Tivoli Directory Server Account Data Collector Description IBM Tivoli Directory Server s Account Data Collector Data Source Type Ldap Agent AveksaAgent Directory Directory name under which Account Data Collector is being created e.g. ITDS, Ldap Directory etc. While creating directory, make sure that radio buttons Allow Account Disabling and Allow Account Locking should be clicked to option Yes Status Active Copy from N/A Scheduled N/A Connection Configuration The following table lists the parameters on the Configuration Information screen, while creating the Collector. For more information about using static or dynamic passwords during collector creation and in the configuration wizard, refer to Manage Endpoint Credentials Using a Password Vault. 11

12 Host <Host name or IP address of the server> Port <Port number of the server (Default non-ssl port: 389 and SSL port: 636)> Bind DN <The DN of the ITDS user needed to bind to the directory (for example, cn=orcladmin)> Static Password Dynamic Password Select this option to provide the password statically/manually. Enter the password for the IBM Tivoli Directory administrator in the area provided. Select this option to use a configured password vault to manage the endpoint credentials. After you select this option, either select a previously configured password vault profile from the drop-down menu, or click Create Profile to add a new password vault profile to use with this connector. RSA Identity Governance and Lifecycle uses this profile to retrieve the appropriate credentials from the password vault during collector deployment and connection tests. Disable Paging <Want to enable paging or not (Default: false)> Page Size <Page Size must not exceed MaxPageSize attribute in IBM Tivoli Directory Server. (Default: 1000)> Use SSL <Whether SSL should be used to connect or not. By default, traffic is transmitted unsecured. You can make traffic confidential and secure by using Secure Sockets Layer (SSL) technology. Before you configure SSL at your end, you must first make sure that LDAP over SSL (also known as LDAPS or LDAP over TLS) is enabled on your LDAP server. LDAP connections are not enabled by default. SSL should be used if you wish to add users with passwords or to change their domain passwords> Skip Certificate <Whether Certificate validation should be skipped or not. (Default: 12

13 Validation false)> WARNING: NOT RECOMMENDED as it skips certificate chain validation Select Certificate <Lists down the certificates fetched from the server. Selected certificate will be appeared in PEM format in Certificate field> Certificate <Certificate retrieved from IBM Tivoli Directory Server in PEM format> Note: Keep this field blank if one wants to use default truststore of JVM or Server Select types of account data to collect The following table lists the parameters for the select types of identity data to collect. Accounts <Enable the check-box to collect accounts. (Default: false)> User Account Mappings <Enable the check-box to collect user account mappings. (Default: false)> Groups <Enable the check-box to collect groups. (Default: false)> Mapping for account and user account attributes The following table lists the parameters on the Mapping for account and user account attributes screen. Account Base DN <Base DN of the ITDS account from where accounts are to be collected. (for e.g.: ou=testusers,dc=aveksa,dc=com)> Account Search Scope <Define the search scope for collection. (for e.g., sub-tree or one level)> 13

14 Account Search filter <Searches the accounts based on the provided filter (for e.g. (objectclass=inetorgperson))> Account ID <Any unique value for the accounts. (Default: cn)> Account Disabled ibm-pwdaccountlocked Account Locked ibm-pwdaccountlocked External id Dn User ID <Any unique value for the users. (Default: dn)> Mapping for Group attributes The following table lists the parameters on the Mapping for group attributes screen. Group Base DN <Base DN for group starting from where groups are to be collected. (for e.g.: ou=testgroups,dc=aveksa,dc=com)> Group Search Scope <Define the search scope for collection. (for e.g., sub-tree or one level)> Group Search filter <Searches the groups based on the provided filter. (Default: (objectclass=groupofnames))> Collect Primary Group Members <enable the check-box if primary group member collection is desired. (Default: false)> Group ID/Name <Any unique value for the groups. (Default: cn)> Member of Group <member attribute for group. (Default: member)> 14

15 External Id distinguishedname Owner <Attribute to map to the group owner> Edit User Resolution Rules The following table lists the parameters on the Edit user resolution rules screen. Target Collector <Any created LDAP IDC. (Default: Users)> User Attribute <Unique attribute for mapping. (Default: User Id)> Edit Member Account Resolution Rules The following table lists the parameters on the Edit member account resolution rules screen. Target Collector <ITDS Account Data Collector> Account Attribute < External id > Edit Sub-Group Resolution Rules The following table lists the parameters on the Edit subgroup resolution rules screen. Target Collector <ITDS Account Data Collector> Group Attribute < External id > 15

16 Entitlement Data Collector Prerequisites The following software must be installed on your network before configuring the collector: IBM Tivoli Directory Server (ITDS) Configuration The configuration of the Entitlement data collector is completed through a number of screens. This section helps you to fill in the values for each screen. Collector Description The following table lists the parameters on the Collector Description screen, while creating the Collector. Collector Name IBM Tivoli Directory Server Entitlement Data Collector Description IBM Tivoli Directory Server s Entitlement Data Collector Data Source Type Ldap Agent AveksaAgent Directory Directory name under which Entitlement Data Collector is being created e.g. ITDS, Ldap Directory etc. While creating directory, make sure that radio buttons Allow Account Disabling and Allow Account Locking should be clicked to option Yes Status Active Copy from N/A Scheduled N/A 16

17 Connection Configuration The following table lists the parameters displayed on the Configuration Information screen during collector creation. For more information about using static or dynamic passwords during collector creation and in the configuration wizard, refer to Manage Endpoint Credentials Using a Password Vault Host <Host name or IP address of the server> Port <Port number of the server (Default non-ssl port: 389 and SSL port: 636)> Bind DN Static Password Dynamic Password <The DN of the ITDS user needed to bind to the directory (for example, cn=orcladmin)> Select this option to provide the password statically/manually. Enter the password for the IBM Tivoli Directory administrator in the area provided. Select this option to use a configured password vault to manage the endpoint credentials. After you select this option, either select a previously configured password vault profile from the drop-down menu, or click Create Profile to add a new password vault profile to use with this connector. RSA Identity Governance and Lifecycle uses this profile to retrieve the appropriate credentials from the password vault during collector deployment and connection tests. Disable Paging <Want to enable paging or not (Default: false)> Page Size <Page Size must not exceed MaxPageSize attribute in IBM Tivoli Directory Server. (Default: 1000)> Use SSL <Whether SSL should be used to connect or not. By default, traffic is transmitted unsecured. You can make traffic confidential and secure by using Secure Sockets Layer (SSL) technology. Before you configure SSL at your end, you must first make sure that LDAP over SSL (also known as 17

18 LDAPS or LDAP over TLS) is enabled on your LDAP server. LDAP connections are not enabled by default. SSL should be used if you wish to add users with passwords or to change their domain passwords> Skip Certificate Validation <Whether Certificate validation should be skipped or not. (Default: false)> WARNING: NOT RECOMMENDED as it skips certificate chain validation Select Certificate <Lists down the certificates fetched from the server. Selected certificate will be appeared in PEM format in Certificate field> Certificate <Certificate retrieved from IBM Tivoli Directory Server in PEM format> Note: Keep this field blank if one wants to use default truststore of JVM or Server Select types of entitlement data to collect Case 1: Select Users & Enable Collect Groups as Application Roles User Data Attribute Modeling Options User Base DN <Base DN of the ITDS user from where users are to be collected. (for e.g.: ou=testusers,dc=aveksa,dc=com)> User Search Scope <Define the search scope for collection. (for e.g., sub-tree or one level)> User Search filter <Searches the users based on the provided filter (for e.g. (objectclass=inetorgperson))> User ID <Any unique value for the users. (Default: cn)> Custom Attributes <The attribute names specified in 'Collect attribute value as resource' and 'Collect attribute value as application role' will be stored as the custom attribute selected> Collect attribute name values as resource-action pairs 18

19 Attributes To Extract <List of attributes to extract> Collect attribute value as resource Attributes To Extract <List of attributes to extract> Collect attribute value as application role Attributes To Extract <List of attributes to extract> Note: At least one of the above listed three MUST be selected. Mapping for group attributes Group Base DN <Base DN for group starting from where groups are to be collected. (for e.g.: ou=testgroups,dc=aveksa,dc=com)> Group Search Scope <Define the search scope for collection. (for e.g., sub-tree or one level)> Group Search filter <Searches the groups based on the provided filter. (Default: (objectclass= groupofnames))> Group ID/Name <Any unique value for the groups. (Default: cn)> Member of Group <member attribute for group. (Default: member)> 19

20 Entitled User Evaluation Associated Identity Collector <Created LDAP Identity Collector> Entitled user value evaluates to <User Id> Case 2: Select Accounts & Enable Collect Groups as Application Roles Account Data Attribute Modeling Options Account Base DN <Base DN of the ITDS account starting from where accounts are to be collected. (for e.g.: ou=testusers,dc=aveksa,dc=com)> Account Search Scope <Define the search scope for collection. (for e.g., sub-tree or one level)> Account Search filter <Searches the accounts based on the provided filter>(for e.g. (objectclass=inetorgperson)) Account ID <Any unique value for the accounts. (Default: cn)> Custom Attributes <The attribute names specified in 'Collect attribute value as resource' and 'Collect attribute value as application role' will be stored as the custom attribute selected> Collect attribute name values as resource-action pairs Attributes To Extract <List of attributes to extract> 20

21 Collect attribute value as resource Attributes To Extract <List of attributes to extract> Collect attribute value as application role Attributes To Extract <List of attributes to extract> Note: At least one of the above listed three MUST be selected. Mapping for group attributes Group Base DN <Base DN for group starting from where groups are to be collected. (for e.g.: ou=testgroups,dc=aveksa,dc=com)> Group Search Scope <Define the search scope for collection. (for e.g., sub-tree or one level)> Group Search filter <Searches the groups based on the provided filter. (Default: (objectclass=groupofnames))> Group ID/Name <Any unique value for the groups. (Default: cn)> Member of Group <member attribute for group. (Default: member)> 21

22 Account Evaluation Associated Account Collector <Created LDAP Account Collector> Account value evaluates to <Account Name> Case 3: Select Users and Disable Collect Groups as Application Roles User Data Attribute Modeling Options User Base DN <Base DN of the ITDS user from where users are to be collected. (for e.g.: ou=testusers,dc=aveksa,dc=com)> User Search Scope <Define the search scope for collection. (for e.g., sub-tree or one level)> User Search filter <Searches the users based on the provided filter>(for e.g. (objectclass=inetorgperson)) User ID <Any unique value for the users. (Default: cn)> Custom Attributes <The attribute names specified in 'Collect attribute value as resource' and 'Collect attribute value as application role' will be stored as the custom attribute selected> Collect attribute name values as resource-action pairs 22

23 Attributes To Extract <List of attributes to extract> Collect attribute value as resource Attributes To Extract <List of attributes to extract> Collect attribute value as application role Attributes To Extract <List of attributes to extract> Note: At least one of the above listed three MUST be selected. Entitled User Evaluation Associated Identity Collector <Created LDAP Identity Collector> Entitled user value evaluates to <User Id> Case 4: Select Accounts and Disable Collect Groups as Application Roles Account Data Attribute Modeling Options 23

24 Account Base DN <Base DN of the ITDS account starting from where accounts are to be collected. (for e.g.: ou=testusers,dc=aveksa,dc=com)> Account Search Scope <Define the search scope for collection. (for e.g., sub-tree or one level)> Account Search filter <Searches the accounts based on the provided filter>(for e.g. (objectclass=inetorgperson)) Account ID <Any unique value for the accounts. (Default: cn)> Custom Attributes <The attribute names specified in 'Collect attribute value as resource' and 'Collect attribute value as application role' will be stored as the custom attribute selected> Collect attribute name values as resource-action pairs Attributes To Extract <List of attributes to extract> Collect attribute value as resource Attributes To Extract <List of attributes to extract> Collect attribute value as application role Attributes To Extract <List of attributes to extract> Note: At least one of the above listed three MUST be selected. 24

25 Account Evaluation Associated Account Collector <Created LDAP Account Collector> Account value evaluates to <Account Name> Copyrights Copyright 2017 EMC Corporation. All Rights Reserved. Published in the USA. Trademarks RSA, the RSA Logo, and EMC are either registered trademarks or trademarks of EMC Corporation in the United States and/or other countries. All other trademarks used herein are the property of their respective owners. For a list of EMC trademarks, go to 25