CA Identity Governance 12.6.04 Platform Support Matrix Last Updated Date Revision Oct 30, 2015 1.0 1
The following matrix lists the CA Identity Governance 12.6.04 supported platforms as follows: Environments - Platforms that are supported as environments for hosting CA Identity Governance server components. Client Environments - Platforms that are supported as environments for hosting CA Identity Governance Client components. Connectors Platforms that are supported as targets for import and export. Password Management Components - Platforms that are supported for password management. Environments The following section describes the supported environments (such as operating systems, application servers, and RDBMS) for hosting the CA Identity Governance server components. This section contains the following topics: Operating Systems Application s Repositories Additional CA Interoperability Matrix Operating Systems Operating System Release Additional Information Microsoft Windows 2008 (64 bit) 64-bit 2008 R2 (64 bit) Support of Standard Edition and Enterprise Edition 2012 (64 bit) Latest SP assumed 2012 R2 (64 bit) Red Hat Enterprise Linux 6.x, 7.x 64-bit Supported Virtualization Platforms CA Identity Manager supports all virtualization technologies as defined in the CA Virtualization Policy. For details please see: 2
Application s Application Release Java Virtual Machine IBM WebSphere ND (on RHEL only) 7.0 1.6.0 (JDK version is IBM JDK that comes with Web Sphere version) IBM WebSphere ND (on RHEL only) 8.5.5 1.6.0, 1.7.x (JDK version is IBM JDK) JBoss (Windows and RHEL) 5.1 Oracle JDK 1.6.x JBoss EAP (Windows and RHEL) 6.x.x EAP (Support Oracle JDK 1.6.x, 1.7.x, 1.8.x (1.8.x with JBoss 6.3.3 only) till 6.3.3) July 2015 Critical Patch Update or later is required for Oracle JDK 1.8.x WildFly (Windows and RHEL) 8.x (8.2 or later) Oracle JDK 1.7.x, 1.8.x July 2015 Critical Patch Update or later is required for Oracle JDK 1.8.x Repositories This section contains the following topic: Databases The following matrix describes the supported CA Identity Governance databases. The database is a required repository for storing environment configuration information, workflow configuration and status, task history information and optionally (if configured) audit records. Repository Release Additional Information Microsoft SQL 2012, 2014 (Latest SP assumed) Standard & Enterprise Editions Oracle 11g R2, 12c Standard & Enterprise Editions, Oracle RAC Additional CA Interoperability Matrix The following matrix describes CA Identity Governance additional interoperability with other CA products. CA Product Release Additional Information CA Identity Manager r12.5 SP16 and above, r12.6 GA and above 3
CA Product Release Additional Information CA User Activity r12.5 SP4, r12.6 GA Reporting Module (Enterprise Log Manager ) CA Single Sign-On 12.52 and later Including Single Sign-On Multi zones Client Environments The following matrix describes the supported CA Identity Governance client environments. It includes supported web browsers and operating systems for running the CA Identity Governance Client Tools and the workflow designer tool. This section contains the following topics: Supported Operating Systems Supported Web Browsers Supported Operating Systems Operating System Release Additional Information Microsoft Windows 2008 SP2 (32 & 64 bit) 2008 R2 Sp1 (64 bit) Windows 7 SP1 (32 & 64 bit) Windows 8 (64 bit) Windows 2012 R2 (64 bit) Virtualization supported on vsphere 4.1 & 5 Supported Web Browsers Web Browser Release Additional Information Microsoft Internet Explorer 8.0/9.0/10/11 (Native) Standard and compatibility mode Firefox 35.x Chrome 39.x Safari 7.x 4
Reporting CA Identity Governance Media includes a CA Installer for Business Objects reporting server. The table below describes the supported versions of Business Objects: Item Release Version of CA Business Intelligence SAP Business Objects Platforms BOXI 4.1 SP5 CABI 4.1 SP5 Microsoft Windows 2008 R2, 2008 R2 SP1, 2012, 2012 R2 Red Hat Enterprise Linux 5.x, 6.x Support for the following databases: o SQL 2008 SP2+, 2008 R2, 2012, 2014 o Oracle, 11g R1, 11g R2, 12c o SQL Anywhere (provided by the SAP Business Objects installer) 5
Connectors This section contains the following topics: SUPPORTED CONNECTOR SERVERS SUPPORTED CONNECTOR XPRESS PLATFORMS CERTIFIED CONNECTOR EXPRESS ENDPOINT TYPES CERTIFIED CONNECTOR EXPRESS ENDPOINT TYPES Supported s Using Direct Connectivity Supported Connectivity Using CA Identity Manager (Legacy Connectors) Connectivity Integration Examples Using Third-party Identity Management Systems Sample Kettle PDI Data Transforms SUPPORTED CONNECTOR SERVERS The following are software prerequisites for installing the CA IAM Connector (CA IAM CS) and the C++ Connector (CCS). OS Release CA IAM CS CCS Version/Level Microsoft Windows 2008 SP2 Yes Yes 64-bit support only for CA IAM CS 2008 R2, 2008 Standard Edition and Enterprise Edition are R2 SP1, 2012, supported 2012 R2 Support for 32-bit mode on 64-bit machines only for CCS Sun Solaris 9, 10 Yes Yes SPARC 64-bit machines (UltraSPARC IIIi, T1). On Solaris 10 Support for LDOMS and Zones Whole Root and Sparse. Limited connectors are supported on CCS (UNIX ETC, UNIX NIS, Access Control). Redhat Linux 6.x, 7.x Yes No 64-bit support only VMware ESX 4.x,5.x Yes Yes Support for the Windows and Linux platforms as listed in this table. 6
SUPPORTED CONNECTOR XPRESS PLATFORMS The following are software prerequisites for installing Connector Xpress: OS Release Version/Level Microsoft Windows 2008 (64 bit) 64-bit 2008 R2 (64 bit) Support of Standard Edition and Enterprise Edition 2012 (64 bit) 2012 R2 (64 bit) Latest SP assumed CERTIFIED CONNECTOR EXPRESS ENDPOINT TYPES Connector Xpress allows for the creation of dynamic connectors, generated using the Connector Xpress for RDBMS (JDBC) wizard or Connector Xpress for LDAP (JNDI) wizard to manage rows in arbitrary database tables or LDAP repositories. CA Identity Governance Mapping (Deep and Shallow use cases): Deciding on your role modeling strategy affects how you map endpoint objects to CA Identity Governance objects when connecting to endpoint systems. You can use CA Identity Governance to manage your organizational role model in the following two ways: You can analyze your roles based on business roles. This concept allows you to design your role model around the roles in your entire organization. This defines the shallow use case. You can analyze your roles based on application. This concept allows you to design your role model around privileges You want to give to users per application. This defines the deep use case. The endpoint versions certified with Connector Xpress by CA Technologies are listed in the following table: 7
CERTIFIED CONNECTOR EXPRESS ENDPOINT TYPES Release Compliance Identity Governance Identity Governance Mapping (Shallow/Deep/Both) Integrated IDM&Identity Governance Platform CA Directory r12 SPx Yes Shallow Yes CA IAM CS Microsoft ADAM 2008 SP2, 2008 Yes Shallow Yes CA IAM CS R2 SP1 (AD LDS) Sun One 6.3, 7.x Yes Shallow Yes CA IAM CS Directory Novell edirectory 8.8.x Yes Both Yes CA IAM CS Oracle Internet 10g, 11g Yes Both Yes CA IAM CS Directory Microsoft SQL 2012, 2014 Yes Both Yes CA IAM CS (Latest SP assumed) Oracle 10g r2 Yes Both Yes CA IAM CS 11g r2 IBM DB2 9.x Yes Both Yes CA IAM CS IBM DB2 for z/os 9.1, 10.1 Yes Both Yes CA IAM CS IBM DB2 for 6,1, 7.1 Yes Both Yes CA IAM CS iseries/400 Sybase Adaptive v15.01 Yes Both Yes CA IAM CS Enterprise MySQL Enterprise 5.0, 5.5 Yes Both Yes CA IAM CS Informix 11.5 Yes Both Yes CA IAM CS 8
SUPPORTED CONNECTOR ENDPOINT TYPES The following table lists the supported endpoints for which connectors are formally provided. Note: The CCS is accessed via the CA IAM Connector Service. Privileged Identity Management (Unix) CA Privileged Identity Management (Windows) CA Arcot WebFort CA Arcot RegFort CA Data Loss Prevention CA Single Sign-On Release r12.5 SP2 -- > SP5,12.6 r12.5 SP2 -- > SP5,12.6 IG IG Mapping (Shallow/ Deep) IM Integrated IM&IG Platform Agent Less Yes Shallow Yes Yes CCS Yes Yes Shallow Yes Yes CCS Yes 6.2.2 Yes Shallow Yes Yes CA IAM CS 5.8.1 Yes Shallow Yes Yes CA IAM CS Yes r12.5, r14 Yes Shallow Yes Yes CA IAM CS Yes r12.1 No N/A Yes See comments CA-ACF2 14, 15 No Shallow Yes Yes IMPS No Yes Comments Arcot Platform 1.0.8.3 (or higher) is required. RegFort should be configured to share UDS with Webfort CCS Yes See Note 7. Requires CA LDAP for z/os r14.1 or r15 9
CA-ACF2 ACFESAGE CA-Top Secret CA-Top Secret TSSCFILE Release IG IG Mapping (Shallow/ Deep) IM Integrated IM&IG Platform 14, 15 Yes Both No No CA IAM CS 14,15 No Shallow Yes Yes IMPS No 14, 15 Yes Both No No CA IAM CS Google Apps Yes Shallow Yes Yes CA IAM CS Yes Agent Less See comments See comments Comments Requires ACFESAGE utility (contact CA mainframe support) to extract data from mainframe system. Version PTF - R034346 of the ACFESAGE utility has been certified. Requires CA LDAP for z/os r14.1 or r15 Requires TSSCFILE utility (contact CA mainframe support) to extract data from mainframe system. r14 and r15 versions of the TSSCFILE utility have been certified. Integration using the Google Apps Provisioning API Version 2.0. HP- Tru64 5.1B Yes Shallow Yes Yes CCS No See Note 4. HP-UX 11i v3 Yes Shallow Yes Yes CCS No See Note 3. 10
Release IG IG Mapping (Shallow/ Deep) IM Integrated IM&IG Platform Agent Less Comments IBM AIX 6.1, 7.1 Yes Shallow Yes Yes CCS No See Note 5. IBM DB2 UDB 9.5 No N/A Yes No CCS Yes See Note 6. See Note 7. IBM DB2 9.1, 10.1 No N/A Yes No CCS Yes See Note 6. z/os See Note 7. IBM i5/os (AKA OS/400) 6.1 r1, 7.1 No N/A Yes No CA IAM CS Yes See Note 7. IBM Lotus Notes Domino IBM RACF - Security for z/os IBM RACF IRRDBU00 7.x, 8.x.x Yes Shallow Yes Yes CA IAM CS Yes 1.10, 1.11, 1.12, 1.13 No Shallow Yes Yes IMPS No 1.9, 1.10 Yes Both Yes No CA IAM CS See comments Domino supported on Windows, AIX and Linux. Domino supported in 32-bit mode only. Requires CA LDAP for z/os r14.1 or r15 Requires IRDBU00 utility (contact CA mainframe support) to extract data from mainframe system. Version 1.9, 1.10 of the IRRDBU00 utility has been certified. 11
Release IG IG Mapping (Shallow/ Deep) IM Integrated IM&IG Platform Kerberos 5.0 No N/A Yes No CA IAM CS Yes Microsoft Active Directory 2008, 2008 R2 2008 SP2 2008 R2 SP1, 2008 R2 SP2, 2008 R2 SP1 Core Agent Less Yes Shallow Yes Yes CCS Yes Comments Sun Implementation on Solaris 10 only. See Note 7. 32-bit is only supported for 2003 R2 and not 2008 R2. 2008 R2 Datacenter edition is supported. Microsoft Office Communication 2007 R2 and Microsoft Live Communications 2003 are supported 12
Microsoft Exchange Microsoft SQL Microsoft Windows 7 Release 2007 SP3 2010 SP2 2012, 2014 (latest SP assumed) IG IG Mapping (Shallow/ Deep) IM Integrated IM&IG Platform Yes Shallow Yes Yes CCS No Agent Less Comments Remote agent for certain features on 2003 SP2, and most features on 2007 SP3 and 2010. CCR (Cluster Continuous Replication) supported with MS Exchange 2007 SP3 only. Exchange 2003 agent is 32-bit only. Exchange 2007/2010 agent is 64-bit only. Yes Shallow Yes Yes CA IAM CS Yes See Note 6. SP1 Yes Shallow Yes Yes CCS No Support for 32-bit & 64-bit. Enterprise & Ultimate Editions. 13
Microsoft Windows Microsoft Windows Vista Microsoft Windows XP Professional Novell SuSE Linux Enterprise Oracle E- Business Suite Release 2008 SP2, 2008 R2 SP1 IG IG Mapping (Shallow/ Deep) IM Integrated IM&IG Platform Yes Shallow Yes Yes CCS No SP2 Yes Shallow Yes Yes CCS No Agent Less Comments Windows Standard Edition as well as Windows Enterprise Edition are supported. 2008 R2 Datacenter edition is supported Support for 32-bit. Enterprise and Business Edition are supported. SP3 Yes Shallow Yes Yes CCS No Support for 32-bit. 10.1, 11.1 Yes Shallow Yes Yes CCS No See Note 2. 11i, 12.1.x Yes Shallow Yes Yes CCS Yes Oracle 11g r2, 12c Yes Shallow Yes Yes CA IAM CS Yes RAC not supported. Oracle also supported dynamically via Connector Xpress. 14
PeopleSoft HRMS Red Hat Enterprise Linux (AS, ES) RSA SecurID Release IG IG Mapping (Shallow/ Deep) IM Integrated IM&IG Platform 8.9, 9.1 Yes Both Yes Yes CA IAM CS Yes Agent Less Comments PeopleTools v8.48, v8.49, v8.50 PeopleTools v8.52 with PeopleSoft HRMS 9.1 only 5.x, 6.x Yes Shallow Yes Yes CCS No See Note 2. 6.1 7.1 SP4 Yes (for 7.1 SP4 only) Both Yes Yes See comments Salesforce Yes Shallow Yes Yes CA IAM CS Yes See comments Windows 2003 SP2 and Solaris 10 support Red Hat Linux 5.x supported for 7.1 only RSA SecurID 7.1 releases prior to SP3 are no longer supported. Agent and CCS required for RSA SecurID 6.1. Agentless and CA IAM CS for RSA SecurID 7.1 Integration using the Force.com Web Services API Version 17.0 15
SAP R/3 SAP NetWeaver (R/3) SAP UME Release 4.6C (SP50+), 4.7 (EXT 110 - SP51+), 4.7 (EXT 200 - SP51+) 2004 (Kernel 6.40), 7.0 (Kernel 7.0), 7.3 (Kernel 7.20) SAP NetWeaver 2004 (SPS 14+) SAP NetWeaver 7.0 (SPS 05+) IG IG Mapping (Shallow/ Deep) IM Yes Shallow Yes Yes Yes Shallow Yes Yes Yes Shallow Yes Yes Integrated IM&IG Platform CA IAM CS CA IAM CS CA IAM CS Siebel CRM 7.8, 8.1 No N/A Yes No CCS Yes Sun Solaris 10, 11 Yes Shallow Yes Yes CCS No Agent Less Yes Yes Comments SAP 4.6C, minimum Basis Support Package level 50 SAP 4.7 EXT 110 & 200, minimum Basis Support Package level 51 Covers AS ABAP type servers ECC 5.0 (6.40) & ECC 6.0 (7.0) supported Yes Covers AS JAVA type servers Not supported on CCS running on Windows 2008 R2 due the Siebel Client support limitation See Note 1. Solaris 10 Zones (Whole Root and Sparse) are supported. 16
Note Comments ETC, NIS, and NIS+ supported on SPARC and Intel/x86 platforms. The Solaris/SPARC remote agent works on SPARC 1 32-bit and 64-bit processors. The Solaris/Intel remote agent works on Intel x86 32-bit and AMD 64-bit processors. ETC and NIS supported on Intel x86 platforms. The Linux/x86 remote agent works on Intel/AMD x86 32-bit, 64-bit, and 2 Itanium 64-bit processors. The Linux/S390 remote agent works on IBM s390 32-bit and s390x 64-bit processors. ETC, NIS and TCB supported on Itanium 2. Shadow mode is supported. The HP-UX remote agent works on PA-RISC 32-3 bit, 64-bit, and Itanium 64-bit processors. 4 ETC supported on alpha platform. The Tru64 remote agent works on Alpha 64-bit processors. ETC and NIS supported on RS/6000 and Power platforms. The AIX remote agent works on Power PC 32-bit and 64-bit 5 processors. 6 Also available as a dynamic Connector via Connector Xpress. In an Integrated deployment, this Connector supports Provisioning but not Compliance. To request Compliance support 7 for this Connector, please raise an enhancement request via CA Technologies support. Supported s Using Direct Connectivity The following s apply only when CA Identity Governance connects directly to the endpoint (not using an identity management system). CSV Files CSV Mapping LDIF Mapping Additional comments 7 CSV files in CA Identity Governance proprietary format Data mapping from standard CSV file Data mapping from standard LDIF file - only Base32 encoding Supported Connectivity Using CA Identity Manager (Legacy Connectors) Apply when connecting to endpoints using CA Identity Manager. integration is available using the following methods: Legacy Customizable Connector 17
Note: These methods are supported for backward compatibility purpose only, and will be supported for upgrading customer only. For more details about End points versions supported legacy connectors refer to the CA Identity Governance 12.5 SP3 support matrix. Integration Examples Using Third-party Identity Management Systems The following examples are available on request via CA Services. IBM TIM Sun IM Sample Kettle PDI Data Transforms CA Identity Governance provides the ability to invoke Pentaho Data Integration (PDI) transformations and jobs. This feature allows for complex ETL (Extract, Transform, and Load) operations during data import. CA support site provides a list of the available transforms. Link: https://support.ca.com/irj/portal/anonymous/phpdocs?filepath=0/8247/8247_rcmdata.html CA Identity Governance ships with PDI version 4.2. The installation process extracts the software with additional CA Identity Governance dedicated input/output plugins for customers to use in their environment. For more information, check the product documentation. Note: CA Technologies does not support the transforms. Password Management Components The following section describes the supported CA Identity Governance portal password management components. Target System Microsoft Active Directory CA etrust Directory CA Single SignOn CA Identity Manager Additional Comments Windows 2003 or 2008 r12.0.x r12.0 SP3 latest CR, 12.5 latest. r12.5 SP8 and above, r12.6 GA and above 18
Linux Reasonable Commercial Effort Statement This Support Statement applies to CA Identity Governance that offers documented support for one or more Linux Reference Platforms. CA strives to meet our clients diverse and ever changing needs. CA products support and manage many of today's leading platforms, operating systems and applications across the IT enterprise. A Linux Reference Platform is a specific version of a particular Linux variant, such as Red Hat Enterprise 5/6, which is used in CA development, QA, and Support, and is documented as a supported environment in which to run CA Identity Governance. To verify the Linux Reference Platforms supported for CA Identity Governance, review the system requirements section of the respective product documentation, or check with CA Support. Many of our clients use variants of the Linux operating system as their production operating system platform, for example Oracle Enterprise Linux, SUSE, etc. Some of those Linux variants claim compatibility (compatibility modes) with CA Identity Governance supported Linux Reference Platforms. Note: CA does not test every possible configuration of CA Identity Governance running on the many Compatible Linux Variants available and cannot certify specific client configurations. To facilitate a quick resolution and isolate the root cause of any potential product issue encountered running on Compatible Linux Variants, CA is establishing the following support protocol for CA Identity Governance operated in these environments: The current GA version of a Linux Reference Platform and the prior major version of that environment are supported. Any exceptions will be noted in respective product documentation. The client is responsible for properly configuring their Linux Variant to be compatible with a Linux Reference Platform supported by CA Identity Governance. The client is responsible for having an active maintenance agreement for both their CA Identity Governance and for the Compatible Linux variant. While CA does not require that clients recreate each issue on a Linux Reference Platform before contacting support, we can request that the client diagnose and troubleshoot specific issues without the Linux Variant "variable" through reproducing the issue on the Linux Reference Platform. CA will only do this when we have reason to believe the issue is directly related to the Compatible Linux Variant environment. While functional problems are rare under Compatible Linux Variants, problems may occur related to the third-party 19
components embedded in applications, and those embedded products support of Compatible Linux Variants may be limited or unavailable. Diagnosis and resolution of this class of problem may require the client to return to a Linux Reference Platform. Compatible Linux Variants are diverse; CA may require extra time to understand, collect data, troubleshoot and possibly reproduce reported issues. If CA Support cannot directly identify the root cause as a CA or a Compatible Linux Variant issue, client can open a support issue with their Compatible Linux Variant vendor and any other necessary third-party vendors to expedite the resolution of the issue. CA, the vendor(s), and the client will work together toward a quick resolution where there business relationship mechanism to do so. CA, Novell, and many other software vendors belong to the Technical Support Alliance Network (http://www.tsanet.org) that may be engaged by either CA or the Compatible Linux variant vendor if and when the need for a third-party arises as long as active maintenance exists for the CA and third party vendor s product. Note if the customer does not have a Vendor support agreement for the Linux variant, there is no third party CA may work with. Any known issues with running CA Identity Governance on specific Compatible Linux Variants will be noted in the respective product documentation. Reasonable Commercial Effort Statement CA Technical Support will make a reasonable commercial effort to troubleshoot and/or resolve customer support requests that involve the use of currently supported versions of CA Identity Governance on or with "unsupported" platforms as follows: CA Technical Support will accept support incidents (support requests) involving a software platform or a combination of software platforms that is not officially supported per the then-current CA published platform support matrices. CA will troubleshoot the issue up to the point that CA has reason to believe that the problem is related to the use of software that is not specified in a then-current platform supported matrix. At such point, CA shall require that the customer reproduce the problem on a fully supported combination of platforms before CA proceeds in troubleshooting the incident. Third Party Products End of Support Statement When a third party product reaches the end of its primary or mainstream support, CA will no longer provide support for that third party product or any Identity Governance components that interoperate with the third party product. Third party products under extended vendor support are not supported by CA. Examples of third party products are: web server, application server, operating system, directory, database, etc. 20