Novell Identity Baseline Solution for the NHS

Transcription

1 Driver Guide Active Directory Driver prepared for Novell Identity Baseline Solution for the NHS Published: May, 2010 Version 1.1

2 Disclaimer Novell, Inc. makes no representations or warranties with respect to the contents or use of this document, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Trademarks Novell is a registered trademark of Novell, Inc. in the United States and other countries. * All third-party trademarks are property of their respective owner. Copyright 2010 Novell, Inc. All rights reserved. No part of this publication may be reproduced, photocopied, stored on a retrieval system, or transmitted without the express written consent of Novell, Inc. Novell, Inc. 404 Wyman Street Waltham Massachusetts USA Novell UK Ltd 1 Arlington Square Bracknell Berkshire RG12 1WA UK Prepared By Mark Nijdam Active Directory Driver Driver Guide May, 2010 Consultants: Mark Nijdam, Eduardo Helering, Tommy Stigsson, Ross Lloyd, Michael Sims, Luiza Dagair

3 Revision History Version Date Editor Revisions /05/2010 Mark Nijdam First Draft 1 14/05/2010 Mark Nijdam Incorporated comments from review. Changed to v1 for release /06/2010 Mark Nijdam Added Remote Loader instructions. Reviewer Record Version Date Reviewers Name Reviewers Role (Peer/ Team Leader / Project Manager) /05/2010 Eduardo Helering ISM Solutions Architect /05/2010 Hayley Holmes Services Executive Final Approval Version Date Reviewers Name Reviewers Role (Peer/ Team Leader / Project Manager) 1 14/05/2010 Eduardo Helering ISM Solutions Architect

4 Contents Executive Summary Introduction Configuring the driver Driver Parameters GCVs Rights Remote Loader Customising the driver Customising the Schema Mapping Default policies AD account requirements Technical details Filter Policies Troubleshooting...9 Appendix A: Remote Loader Installation Installing the Remote Loader Software Exporting an SSL certificate for the Remote Loader Creating the Remote Loader Instance Configuring Active Directory Password Synchronisation Filters...19 Tables Table 1: Active Directory Driver - Baseline GCV...3 Figures Figure 1: Driver Filter...8 i

5 Executive Summary Executive Summary This document describes the Active Directory Driver for the Novell Identity Baseline Solution for the NHS. The Active Directory Driver is responsible for connecting the corporate and existing Active Directory to the ID Vault provided with the Novell Identity Baseline Solution. The Active Directory Driver is a highly customizable driver as the corporate Active Directory for NHS organisations does not have a standard schema or structure. This document is written for the following NHS personnel and Accredited Partners: Technical Design Team. Identity Manager Driver development team. Project Management Teams It is also intended for any other personnel who will be involved in deploying, configuring and maintaining the NHS Identity Management infrastructure. Basic technical knowledge of the Novell Identity Baseline is recommended (see the Solution Overview document for more information). Chapter 1 is gives a short overview of the functionality provided by the Active Directory Driver. It provides a starting point for anyone interested in the workings of this driver. Chapters 2 and 3 provide guidance on how to configure and customise the Active Directory Driver for a deployment at a specific NHS organisation. Chapters 4and 5 discuss technical details and troubleshooting and can be used to gain more indepth knowledge of how the Active Directory Driver works. Active Directory Driver - Driver Guide 1 Revision: Version 1.1

6 Introduction 1 Introduction The Active Directory Driver is a Novell Identity Manager Driver of type Active Directory. An AD Driver is typically used to synchronise user accounts between the ID Vault and an Active Directory domain. The Active Directory Driver for the Novell Identity Baseline Solution for the NHS is an optional driver. The driver should only be installed, configured and customised when the NHS organisation deploying the Novell Identity Baseline Solution has a corporate Active Directory domain that has to be connected with the ID Vault. Other types of corporate directories can be connected using other drivers, e.g. the edirectory Driver as explained in Driver Guide - edirectory. The Active Directory Driver for the Novell Identity Baseline Solution is not a completely configured driver like the other drivers provided with the Novell Identity Baseline Solution; it mainly provides a shell that can be used to successfully synchronise user accounts from the ID Vault to an Active Directory domain. Assumptions about the Active Directory schema or structure can not be made and the customisation step therefore is the most important step after installing and configuring the AD Driver. The Active Directory Driver for the Novell Identity Baseline Solution consists of the default AD Driver (provided with the Novell Identity Manager product) with a few modifications to the filter and two additional Baseline policies. The Driver Filter and the Baseline policies are discussed in more detail in chapter 4. 2 Novell/Novell Identity Baseline Solution for the NHS

7 Configuring the driver 2 Configuring the driver To start the Active Directory Driver successfully a couple of configuration steps are required: 1. Enable the Driver (See the Installation Guide, Post-Installation Tasks) 2. [Optionally] Set up tracing (See the Installation Guide, Post-Installation Tasks) 3. Set the Driver Set Global Configuration Values (GCVs) (See the Installation Guide, Post- Installation Tasks). 4. Set the Driver Global Configuration Values (GCVs). 5. Set the edirectory rights (Trustees) for the Driver object. 6. [Optionally] Install the Remote Loader. The Installation Guide explains how to set and enable the Driver, how to set up tracing and explains the Driver Set GCVs. The following paragraphs describe the final configuration steps in more detail. 2.1 Driver Parameters Driver Parameters (divided into Driver Options, Subscriber Options and Publisher Options) are variables that are specific to the Driver Shim implementation and are mandatory unless otherwise stated. The Driver Parameters for the Active Directory Driver provided with the Novell Identity Baseline Solution are the default AD Driver Parameters. They will have to be adjusted in such a way that they suit the Active Directory domain of the NHS organisation. The default AD Driver Parameters are explained in more detail in the Novell Documentation: 2.2 GCVs Global Configuration Values are variables that are specific to the Driver logic, i.e. the implemented policies. GCVs are mandatory unless otherwise stated. The Novell Identity Baseline Solution provides one additional GCV on top of the default AD Driver GCVs. The default GCVs will have to be adjusted in such a way that they suit the Active Directory domain of the NHS organisation. These default AD Driver GCVs are explained in more detail in the Novell Documentation: The following table lists the additional Active Directory Driver Novell Identity Baseline GCV. Table 1: Active Directory Driver - Baseline GCV Name Description Example Allow Move operations to synchronise to AD By setting the GCV to true, move operations are not vetoed by the driver. If the GCV is set to false, move operations will be vetoed. true Active Directory Driver - Driver Guide 3 Revision: Version 1.1

8 Configuring the driver 2.3 Rights Name Description Example Move operations in the ID Vault occur when a user is enabled or disabled. Synchronisation to AD means that user accounts that are moved in the ID Vault will also move in the Active Directory. When the Active Directory Driver is fully configured, it is now necessary to deploy the driver to the ID Vault if you use Designer. This is not necessary in imanager; all changes are 'live' if you use imanager. When deploying the driver, you will be asked to enter the driver rights (Security Equivalences). It is a best practice to create an Organisational Role object in edirectory, assign the required rights to this Organisational Role object and then assigning this Organisation Role object to the driver. The Active Directory Driver requires the following edirectory rights: Read/Write with inheritance: The User base container, its default being /trustiv/user/ Read with inheritance: The Driver Set object. 2.4 Remote Loader The Active Directory Driver has to run on either the Active Directory domain controller or a member server. This is typically not the same physical server as the server running the ID Vault, and therefore a Remote Loader is required. The Remote Loader allows Novell Identity Manager Drivers to be run on remote servers and communicates with the Identity Manager engine. Appendix A describes the installation and configuration of the Remote Loader for the Active Directory Driver. 4 Novell/Novell Identity Baseline Solution for the NHS

9 Customising the driver 3 Customising the driver The Novell Identity Baseline Solution for the NHS does not always provide all of the functionality required by a specific deployment. It is therefore sometimes necessary to customise the drivers. Please make sure that the guidelines specified in the Customisation Guide document included in the Novell Identity Baseline Documentation are followed. The Active Directory Driver policies that are provided as part of the Novell Identity Baseline (Baseline policies can be recognised by the base- prefix) strive to provide the most commonly required functionality for all NHS organisations and should therefore not be disabled, modified or deleted. Custom policies should be prefixed by ext-. Another advantage of this approach is that when a new version of the Novell Identity Baseline is released all of the Baseline policies can be safely overwritten without losing custom deployment code. The Active Directory Driver for the Novell Identity Baseline Solution requires significant customisation, because there is no standard schema or directory structure defined for corporate NHS directories. The out-of-the-box the driver provides a basic synchronisation of user accounts. This chapter discusses typical customisation scenarios for the Active Directory Driver. 3.1 Customising the Schema Mapping Scenario: We want to synchronise custom schema attributes from the ID Vault to AD The Driver Filter provided with the Novell Identity Baseline Solution synchronises only the standard edirectory User class attributes. The reason for this is that these attributes are by default mapped onto corresponding attributes in Active Directory. By leaving out custom attributes (from the nhsivuseraux auxiliary class) it is possible to synchronise user accounts from the ID Vault to Active Directory without any adjustments to the Driver Filter (adding the custom attributes requires these to be mapped onto non-default attributes in Active Directory). To make use of all of the custom attributes provided by the Novell Identity Baseline Solution it is necessary to: 1. Specify these attributes as Subscriber Synchronise attributes in the Driver Filter. Publisher Synchronize can also be specified to allow changes in Active Directory user accounts to synchronise back to the ID Vault. 2. Create a valid schema mapping (e.g. ext-idvtoadmapper) to map the custom attributes onto custom or other attributes in Active Directory. The default schema mapping policy (provided with the default installation of the Active Directory Driver) can either be deleted or left unchanged Default policies Scenario: The default AD Driver policies are not valid for our deployment The AD Driver of the Novell Identity Baseline Solution contains all of the default AD Driver policies and Schema Mapping. The Customisation Guide mentions the following on default policies: The default driver policies MUST be accepted as they are, or removed completely. This is necessary to avoid misunderstandings when updating to later versions of the driver and its default policies. Adding comments or disabling rules also counts as a modification to the default driver policy. Active Directory Driver - Driver Guide 5 Revision: Version 1.1

10 Customising the driver 3.3 AD account requirements Scenario: We do not want every ID Vault user to be given an account in Active Directory The AD Driver for the Novell Identity Baseline Solution currently allows the creation of user accounts in Active Directory for any active user account in the ID Vault. It is of course possible that not every one should become an account in AD. A custom policy is required in this case. The Novell Identity Baseline Solution provides a base-requirementschecker policy that only allows the creation of active user accounts. To extend the requirements for AD user account creation create a new policy in the Create Policy Set of the Subscriber channel (e.g. ext- RequirementsChecker) and specify the rules for user account creation. Veto the operation if the requirements are not met. 6 Novell/Novell Identity Baseline Solution for the NHS

11 Technical details 4 Technical details The Active Directory Driver for the Novell Identity Baseline Solution for the NHS comes with several implemented policies and a Driver Filter. These items together strive to provide the commonly required functionality for all NHS organisations and should therefore not be disabled, modified or deleted. Baseline policies can be recognised by the base- prefix. Chapter 3 provides several scenarios for extending the Active Directory Driver for the Novell Identity Baseline to provide for your deployment's needs. This chapter provides a detailed overview of all the implemented Baseline Active Directory Driver policies and the Driver Filter. Most of the policies and the Schema Mapping are default policies, i.e. they are part of the default Active Directory Driver configuration. More information about these can be found in the Novell Documentation: 4.1 Filter Figure 1 shows the Driver Filter for the Active Directory Driver. The figure shows that all of the user attributes that are used by the Novell Identity Baseline are present but not synchronised in the Driver Filter. The Driver Filter only synchronises the default user attributes, as it allows the immediate creation of user accounts in Active Directory without customisation. Through customisation, it is also possible to synchronise other attributes to Active Directory. This is explained in chapter 3. The Login Disabled attribute is synchronised so that disabled user accounts in the ID Vault are also disabled in Active Directory. The nspmdistributionpassword attribute is required for password synchronisation from the ID Vault to Active Directory. Active Directory Driver - Driver Guide 7 Revision: Version 1.1

12 Technical details Figure 1: Driver Filter 4.2 Policies Most of the policies for the Active Directory Driver are default AD Driver policies and are not described here (see the Novell Documentation at There are two Subscriber channel policies provided by the Novell Identity Baseline Solution: base-eventhandler. This policy handles specific actions relating to specific event types coming from the ID Vault. One rule is specified to block all Move operations from the ID Vault. The policy will only block the Move operation when this is requested in the corresponding GCV (see table 1) base-requirementschecker. This policy checks whether the user account in ID Vault meets all the requirements for user account creation in Active Directory. In this case, there is only one requirement: the user account has to be in the Active container (by default trustiv\users\active). If it is, the user account is created in Active Directory. 8 Novell/Novell Identity Baseline Solution for the NHS

13 Troubleshooting 5 Troubleshooting This section provides some basic troubleshooting actions for common problems with the Active Directory Driver. When experiencing problems always turn on driver tracing (level 5) and look for anything unusual. The Novell Documentation provides an extensive Troubleshooting section. It can be found at: Active Directory Driver - Driver Guide 9 Revision: Version 1.1

14 Appendix A: Remote Loader Installation 5.1 Installing the Remote Loader Software The Active Directory Driver typically uses a remote loader installed onto an Active Directory domain controller or member server to manage objects and events coming from or flowing to Active Directory. An Active Directory Driver set up with the remote loader makes sense as it is able to run directly upon an Active Directory domain controller. It is recommended that a domain controller is used to host the remote loader. The following instructions presume that you are installing onto a domain controller and not a member server. For successful installation a user account with appropriate rights to Add, Delete and Modify user accounts in the Active Directory domain is required. The Novell Documentation describes: At a minimum, this account must have Read and Replicating Directory Changes rights at the root of the domain for the Publisher channel to operate. You also need Write privileges to any object modified by the Subscriber channel. Write privileges can be restricted to the containers and attributes that are written by the Subscriber channel. The following steps specify the required steps to install the remote loader. 1. Mount the required.iso file onto the Windows domain controller 2. The installation program should run automatically; however, if auto run is disabled, execute the installation program manually from: windows\setup\idm_install.exe 3. Click OK to start the installation 10 Novell/Novell Identity Baseline Solution for the NHS

15 4. Click Next to acknowledge the introduction 5. Agree to the license 6. Select the Novell Identity Manager Connected System Server installation 7. Make sure that the Novell Identity Manager-based Administration Server option is unchecked. 8. Choose Customize the selected components Active Directory Driver - Driver Guide 11 Revision: Version 1.1

16 9. Click the Next button to continue 10. Select Client Login Extension for Novell Identity Manager 11. Click OK to agree to the Activation Notice 12. Click Next to install to the default location for the remote loader 13. Click Next to install to the default location for the utilities 14. Click Next to accept the shortcuts. It is recommended that the software is installed to the default location and when prompted, that a desktop icon be created for the Identity Manager Remote Loader Console. 15. Review the installation summary screen, it should be as depicted above. 12 Novell/Novell Identity Baseline Solution for the NHS

17 16. Click Install to install the selected components 5.2 Exporting an SSL certificate for the Remote Loader To allow the remote loader to communicate with the Identity Vault via SSL we need to create and export a certificate from the Identity Vault and copy it to the Windows domain controller running the remote loader. From imanager: 1. Login as admin 2. Choose Novell Certificate Access from the options on the left hand side 3. Click Server Certificates 4. Click New to create a new certificate 5. Give the certificate a nickname of IDMADcert 6. Click Next 7. Click Finish Active Directory Driver - Driver Guide 13 Revision: Version 1.1

18 8. Click Novell Certificate Access 9. Click Server Certificates 10. Select DMADcert 11. Click Export 14 Novell/Novell Identity Baseline Solution for the NHS

19 12. Choose IDMADcert from the available certificates 13. Un-tick Export Private Key 14. Choose Base 64 as the export format 15. Click Next 16. Click Save the exported certificate. 17. Save the certificate to a location of your choice. The certificate will then need to be copied to the windows domain controller running the remote loader. This certificate will be used in the next section. Active Directory Driver - Driver Guide 15 Revision: Version 1.1

20 5.3 Creating the Remote Loader Instance The Active Directory Driver solution requires one remote loader instance. Remote loader instances are created through the Identity Manager Remote Loader Console (there should be a shortcut to this on the Desktop or alternatively in c:\novell\remoteloader\rlconsole.exe). The following steps describe how the service should be configured. 1. Double click the desktop shortcut Identity Manager Remote Console 2. Click Add 16 Novell/Novell Identity Baseline Solution for the NHS

21 3. Give the remote loader a description 4. Choose the ADdriver.dll from the drop down menu 5. Enter a remote loader password 6. Enter a Driver Object password 7. Tick Use SSL 8. Browse to the exported root cert (see previous paragraph) 9. Click Establish a Remote Loader service for this driver instance 10. You should be left with a screen similar to the one below. Active Directory Driver - Driver Guide 17 Revision: Version 1.1

22 11. Click Ok 12. Click Start to start the service 18 Novell/Novell Identity Baseline Solution for the NHS

23 5.4 Configuring Active Directory Password Synchronisation Filters To allow for successful capture of password changes from the Active Directory domain, password filters need to be installed on all domain controllers that can handle password changes. This installation can be done automatically via an Identity Manager utility. The following instructions are for auto installation from the domain controller running the remote loader. 1. From the Control Panel, click Identity Manager PassSync Active Directory Driver - Driver Guide 19 Revision: Version 1.1

24 2. Click Yes 3. Click Add and enter the NetBIOS name of the AD domain 20 Novell/Novell Identity Baseline Solution for the NHS

25 Active Directory Driver - Driver Guide 21 Revision: Version 1.1

26 4. Click OK 5. Answer Yes to use the DNS name for the domain 6. The domain name should now appear in the Synchronized domains list 22 Novell/Novell Identity Baseline Solution for the NHS

27 7. Click Filters. You should see a list of available Domain Controllers. Active Directory Driver - Driver Guide 23 Revision: Version 1.1

28 8. Select a domain controller and click Add. This will install the necessary components to the target domain controller. Once you have installed the filter software onto all the domain controllers in the list you will need to restart the domain controllers; the password filters will not activate until a reboot has been performed. The automatic installation tool requires access to the remote registry of the target domain controllers. If this is not acceptable, then it is also possible to install the password filters manually on the domain controllers. After the installation is complete and the domain controller is rebooted, the password filter is loaded automatically whenever the domain controller starts up. Check the status for the password filter again by clicking Control Panel, and doubleclicking the Identity Manager PassSync utility. Confirm that the status says Running. Repeat these steps for each domain controller that you want to participate in Password Synchronization. 24 Novell/Novell Identity Baseline Solution for the NHS

29