Redpaper Ivy Chiu Axel Buecker Utilizing Group Sharing Account User Management using the IBM Tivoli Identity Manager Adapter for Tivoli Access Manager for Enterprise Single Sign-On Introduction In the 5.1 release of the IBM Tivoli Identity Manager Adapter for Tivoli Access Manager for Enterprise Single Sign-On, a group sharing account management feature has been introduced. This allows multiple users who have a Wallet to have access to credentials for a shared application account, without having ownership of the shared application account. Each share account has only one owner who is responsible for performing password resets on the account when required. This can help eliminate the number of accounts that are needed on a particular target system, and shared account users do not need to know the password of the shared account. This version of the adapter integrates Tivoli Identity Manager 5.1 and Tivoli Access Manager Enterprise Single Sign-On 8.1. It utilizes the IBM Tivoli Directory Integrator functionality to facilitate communication between Tivoli Identity Manager and the Tivoli Access Manager Enterprise Single Sign-On IMS Server to provide user management functionality such as create, delete, and change password operations for Tivoli Access Manager for Enterprise Single Sign-On users. It also leverages the workflow extension capabilities of Tivoli Identity Manager to provide application credentials management. This includes create, delete, and change passwords for application credentials in the user's Wallet. Important: The group sharing account user management differs from privileged identity management in that it does not provide individual accountability. If you have to address this individual accountability, you can learn more about the IBM Privileged Identity Management offering in the IBM Redpaper publication Centrally Managing and Auditing Privileged User Identities by Using the IBM Integration Services for Privileged Identity Management, REDP-4660. Copyright IBM Corp. 2010. All rights reserved. ibm.com/redbooks 1
This Redpaper publication focuses on the group sharing account management in the following sections: Architecture overview on page 2 Group sharing account management on page 3 Group sharing account deployment on page 5 Scenarios on page 12 Architecture overview The Tivoli Identity Manager Adapter for Tivoli Access Manager for Enterprise Single Sign-On implementation is based on the Tivoli Directory Integrator framework for Tivoli Identity Manager Adapters. It consists of Tivoli Directory Integrator AssemblyLines. When an initial request is made by Tivoli Identity Manager to the adapter, the AssemblyLines are loaded into the Tivoli Directory Integrator server. As a result, subsequent service requests do not require those same AssemblyLines to be reloaded. The AssemblyLines utilize the Tivoli Directory Integrator components to undertake user management-related tasks on the IMS Server. It does this remotely by using SOAP over SSL as the trusted IMS Bridge agent. Figure 1 depicts the architecture flow. Figure 1 Architecture overview This integration also provides a set of Tivoli Identity Manager workflow extensions that enhance the integration between Tivoli Identity Manager and IMS Server. This allows the management of the Tivoli Access Manager for Enterprise Single Sign-On user s account credentials for specific application services to achieve single sign-on via Tivoli Identity Manager user provisioning. In this release of the adapter, the following workflow extensions are designed to support the management of application credentials in a user s wallet. It includes add, delete, and change password operations. createaccountwithtamesso createitimaccountwithtamesso Enables provisioning of application account credential into the user's Wallet. Enables provisioning of Tivoli Identity Manager account credential into the user's Wallet. 2 Utilizing Group Sharing Account User Management
changepasswordwithtamesso deleteaccountwithtamesso Enables change password of application account credential in the user's Wallet. Enables de-provisioning of application account credential from the user's Wallet. The workflow extensions that are specifically required for configuring group sharing account management are: changesharedaccountpasswordwithtamesso This enables password propagation for a group sharing account to the Wallets of shared users. issharedrole This determines shared role membership for new shared account users. Group sharing account management The group sharing account management uses Tivoli Identity Manager roles to determine who possesses a particular shared account, while at the same time leveraging the existing Tivoli Identity Manager Adapter for Tivoli Access Manager for Enterprise Single Sign-On to provide provisioning capabilities to the shared account users Wallets. Figure 2 shows the general flow of the process between the Tivoli Identity Manager server, the IMS Server, and the Access Agent during the provisioning of a group sharing account. Figure 2 General process flow between Tivoli Identity Manager server, IMS Server, and Access Agent Tivoli Identity Manager, the IMS Server, and Access Agent communicate as follows: 1. A Tivoli Identity Manager user is added to a Tivoli Identity Manager role to get access to a shared account. 2. The shared account owner is notified by email to reset the password for this shared account. 3. The shared account owner changes the password for the shared account. The Tivoli Identity Manager Adapter for Tivoli Access Manager for Enterprise Single Sign-On populates and updates the password for the shared account in the Wallets of those users who are members of this Tivoli Identity Manager role. Utilizing Group Sharing Account User Management using the IBM Tivoli Identity Manager Adapter for Tivoli Access
4. Access Agent synchronizes and downloads the Wallet from the IMS Server. 5. The user's local Wallet now contains the latest shared account user ID and password. The user can access the application with these credentials. Supported deployment Group sharing accounts have the following unique features that should be taken into consideration before deploying the group sharing account management into your own environment: Individual accountability is not required for the group sharing account. Users of the group shared account are not required to know the account password. The following example scenarios show the distinction between a typical supported deployment and an unsupported one. Supported customer deployment The help desk team requires a generic email account that all team members can use to respond to support requests. All team members need access to this email account, but there is no need for audit records about individuals using the account at particular times and what they are doing with it. The email account can be shared between multiple users at the same time via separate desktop clients. The help desk team members do not need to know the password of the account and they cannot change it. The help desk manager is the only person who can change the password of the shared account. He approves access to the shared account for individual team members. This scenario is a prime example of when the Tivoli Identity Manager Adapter for Tivoli Access Manager for Enterprise Single Sign-On group sharing account management can be used. Unsupported customer deployment The UNIX administrator team needs a shared account for the administration of UNIX systems. All team members need access to UNIX systems, and they need to be able to change the password for the shared account. Also, there is a requirement to ensure that audit records are created of when an account is used and what has been done with this account at a specific time. The Tivoli Identity Manager Adapter for Tivoli Access Manager for Enterprise Single Sign-On cannot be deployed in this scenario because individual team members cannot change the password of the shared account. No individual audit records can be generated for each team member using the shared account. All activities are logged against the shared account user name. 4 Utilizing Group Sharing Account User Management
Group sharing account deployment The following sections outline all deployment considerations: Prerequisite information on page 5 Configure the group sharing account mapping on page 6 Configure an application service on page 6 Configure the issharedrole workflow extension on page 7 Configure the changesharedaccountpasswordwithtamesso workflow extension on page 10 Prerequisite information To configure the group sharing account management, see the following sections for the actions that need to be completed. The name of the application service To use the Tivoli Identity Manager Adapter for Tivoli Access Manager for Enterprise Single Sign-On to manage the application credential inside a Wallet, the service name of this application is required, which can be found under Manage Services on the Tivoli Identity Manager administrative console. The name of the account to be shared This account is the application credential to be managed in the Wallet. It can be found under Manage Services Accounts on the Tivoli Identity Manager administrative console. Watch out: This account type cannot be a Tivoli Access Manager for Enterprise Single Sign-On account. The name of the owner of this account The owner of the account is a Tivoli Identity Manager user who has this application credential listed under her name on the Tivoli Identity Manager administrative console. The email address of the shared account owner The email address of the owner can be found under Manage Users Change User Contact Information on the Tivoli Identity Manager administrative console. The name of a Tivoli Identity Manager role that controls the access to this shared account Create a Tivoli Identity Manager role from Manage Roles Create Role, define the role name, and assign the owner of this account to be the owner of this role. Watch out: Only one role owner is allowed. Utilizing Group Sharing Account User Management using the IBM Tivoli Identity Manager Adapter for Tivoli Access
The Tivoli Access Manager for Enterprise Single Sign-On authentication service ID The authentication service ID can be found by using AccessStudio. Import data from IMS by clicking File Import data from IMS. After the import is complete, select View Authentication Services to view the list of services. Configure the group sharing account mapping To share the access of an account of a specific service between users, and to have this account provisioned into a user's Wallet, it is necessary to map the account, the application service, and the role that controls the access to this account to a specific Tivoli Access Manager for Enterprise Single Sign-On service. This is done by configuring the group sharing accounts mapping under the service form of a Tivoli Access Manager for Enterprise Single Sign-On service (Figure 3). Figure 3 Group sharing account mapping The adapter s schema and service form have been changed to allow the details of the group sharing accounts mapping to be configured in the service form: <ServiceName> <Account Name> <Role Name> This mapping entry defines a group sharing account for a specific Tivoli Identity Manager service and a Tivoli Identity Manager role associated with this group sharing account. Use the pipe character ( ) for separating values (TAM Service SSO_account Role_Name, for example). This is a multi-valued attribute. Configure an application service It is necessary to define the service prerequisite and the TAM E-SSO Authentication Service ID for the application service being managed. The service prerequisite is used to map the relationship between a Tivoli Access Manager for Enterprise Single Sign-On service and its managed application service. As a prerequisite, all application services in Tivoli Identity Manager can only be provisioned after Tivoli Access Manager for Enterprise Single Sign-On user accounts are provisioned in the IMS Server. Otherwise, sign-on automation does not work. The TAM E-SSO Authentication Service ID is required for the adapter to map the application account to the correct application service on IMS. As a prerequisite, all application services in Tivoli Identity Manager are required to have a TAM E-SSO Authentication Service ID defined in its service form. Otherwise, sign-on automation does not work. 6 Utilizing Group Sharing Account User Management
Figure 4 illustrates that TAM E-SSO 81 is the prerequisite service for the ITIM Service, and that the ITIM Service has a TAM E-SSO Authentication Service ID of dir_itim. Figure 4 TAM E-SSO Authentication Service ID Configure the issharedrole workflow extension To configure the workflow for the issharedrole, define the workflow extension for the modify operation for person. There are two important nodes that need to be inserted into this workflow, which are the issharedrole node and the Email node. The issharedrole node is a conditional branch, whereas the Email node is an action. The outcome of the issharedrole condition determines whether an email is sent. The issharedrole workflow extension needs to be inserted between the Start and the ModifyPerson node. Whenever a Tivoli Identity Manager role is assigned to or removed from a person, this extension checks whether the role is defined under the group sharing accounts mapping in the Tivoli Access Manager for Enterprise Single Sign-On service form. It has two data outputs: The string attribute sendemail returns true or false The entity attribute Recipient returns the owner of the sharedrole. issharedrole takes different actions depending on the outcome of the validation, as described below: If this Tivoli Identity Manager role does not match any of the roles that are defined under the group sharing account mapping, then no action is taken. If this Tivoli Identity Manager role is matched and it is being assigned to a user, then an email is sent to Recipient, who is the owner of this sharedaccount (that is, the owner of the Tivoli Identity Manager role). If this Tivoli Identity Manager role is matched and it is being removed from a user, then an email is sent to Recipient, the owner of this sharedaccount, and at the same time it triggers the adapter to remove the sharedaccount from this user's Wallet. Utilizing Group Sharing Account User Management using the IBM Tivoli Identity Manager Adapter for Tivoli Access
To be able to notify the sharedaccount owner to take action, an Email node must be inserted between the ISSHAREDROLE and MODIFY PERSON workflow node. Again, this Email node takes different actions depending on the outcome of the issharedrole validation: If this Tivoli Identity Manager role does not match any of the roles defined under the group sharing account mapping, then no email is sent. If this Tivoli Identity Manager role is matched, then an email is sent to Recipient to notify that a password change is required. To configure the workflow for issharedrole, complete the following steps: 1. Log on to Tivoli Identity Manager: a. Select Configure System Manage Operations. b. For the operation level, select Entity type level. c. Select Person as the entity type (Figure 5). Figure 5 Entity type level Person modify 2. Click the modify operation to make the next changes. The operation diagram in Figure 6 illustrates the completed workflow after the changes have been made. Figure 6 Operational workflow - modify 3. Remove the transition from Start to MODIFYPERSON. 4. Add a new extension between the Start node and the MODIFYPERSON node (Figure 7). Figure 7 Add a new extension 8 Utilizing Group Sharing Account User Management
5. Double-click the new Extension node. A pop-up window (Figure 8) displays all the extensions registered using workflowextensions.xml. Figure 8 Define the issharedrole extension 6. Select issharedrole for the extension name and type ISSHAREDROLE in the Activity ID field. 7. Set the split type to be OR. 8. Click Ok to close the Properties window. 9. Attach the transitions to the newly added extension. 10.Click Properties. 11.Click Add next to Relevant Data. 12.Create a new sendemail relevant data entry. Enter sendemail in the ID field. Ensure that the type is String and the default value is false. Click Ok to finish. 13.Create a new recipient Relevant Data entry. Enter recipient in the ID field. Ensure that the type is Person and the entity is Person. Click Ok to finish. 14.Click Ok to close the Properties window. Utilizing Group Sharing Account User Management using the IBM Tivoli Identity Manager Adapter for Tivoli Access
15.Add a new mail node between ISSHAREDROLE and MODIFYPERSON (Figure 9). Figure 9 Java script for the mail node 16.Double-click the new Mail node. A pop-up window displays the properties of the mail node. 17.In the Activity ID field, type emailaccountowner and select Custom from the Recipient drop-down menu. Click the ellipses button ( ) to add a new script with the following JavaScript: var recipientobj = recipient.get(); var recipientdn = recipientobj.dn; return new Participant(ParticipantType.USER, recipientdn); 18.Click Ok to close the Custom Participant dialog, then click Ok close the Mail Properties dialog. 19.Add the following script to the transition line between ISSHAREDROLE and emailaccountowner: (sendemail.get()=="true"); 20.Add the following script to the transition line between ISSHAREDROLE and MODIFYPERSON: (sendemail.get()!="true"); 21.Click the MODIFYPERSON node, and set the join type to OR. Click Ok to finish. 22.Click Update and then click Ok at the bottom of the dialog. 23.Click Close to close the Operations window. Configure the changesharedaccountpasswordwithtamesso workflow extension To configure the workflow for changesharedaccountpasswordwithtamesso, redefine the workflow extension for the changepassword operation for account. 10 Utilizing Group Sharing Account User Management
Update the changepassword node between the start and end nodes. changesharedaccountpasswordwithtamesso is a simple wrapper of the existing changepassword extension. Watch out: The shared account type cannot be a Tivoli Access Manager for Enterprise Single Sign-On account. First, the extension validates that the account is a Tivoli Access Manager for Enterprise Single Sign-On account. The extension then tries to find matches for this shared account from the accounts defined under the group sharing account mapping in the Tivoli Access Manager for Enterprise Single Sign-On service form. If this is not a shared account, then only the normal password change extension executes. If the shared account is identified, then the extension looks for Tivoli Access Manager for Enterprise Single Sign-On accounts for all users who are members of the role that controls access to the shared account. It then sends a request to the adapter to update the password of the shared account in these users Wallets. To configure the workflow for changesharedaccountpasswordwithtamesso, complete these steps: 1. Log on to Tivoli Identity Manager, then: a. Select Configure System Manage Operations. b. For the operation level, select Entity level. Watch out: If all account types are to be integrated with the Tivoli Access Manager for Enterprise Single Sign-On service, select Entity type level as the operation level. c. Select Account as the entity type. d. Select the type of account to be integrated with the Tivoli Access Manager for Enterprise Single Sign-On service (Figure 10). Watch out: If the Tivoli Identity Manager account is to be integrated with the Tivoli Access Manager for Enterprise Single Sign-On service, select Identity Manager User as the entity type. Figure 10 Entity type level Account changepassword Utilizing Group Sharing Account User Management using the IBM Tivoli Identity Manager Adapter for Tivoli Access
2. Click Add to create a changepassword operation if one does not already exist. The operation diagram displays. Provide the same changes as those shown in Figure 11. Figure 11 Operational workflow - changepassword 3. Double-click the CHANGEPASSWORD node. A pop-up window (Figure 12) displays all the extensions registered using workflowextensions.xml. 4. Select changesharedaccountpasswordwithtamesso for the extension name. 5. Click Ok to close the property window. 6. Click Update and then click Ok at the bottom of the dialog. 7. Click Close to close the Operations window. Figure 12 Define the changesharedaccountpasswordwithtamesso extension Scenarios In this section we focus on a help desk related deployment scenario. 12 Utilizing Group Sharing Account User Management
Assumptions Supported scenarios The Tivoli Identity Manager Adapter for Tivoli Access Manager for Enterprise Single Sign-On is installed and the following workflows are configured as described in the adapter's installation guide: createaccountwithtamesso This enables provisioning of the application account credential into the user's Wallet. deleteaccountwithtamesso This enables de-provisioning of the application account credential from the user's Wallet. changesharedaccountpasswordwithtamesso This enables password propagation for the group sharing account to shared users Wallets. issharedrole This determines shared role membership for new shared account users. Below is our list of example scenarios that illustrate the capabilities of group sharing account management: Granting access to a group sharing account Removing access from a group sharing account Changing the owner of a group sharing account Creating a new group sharing account Deleting an existing group sharing account Assigning multiple users to a group sharing account Assigning a user to a number of group sharing accounts Watch out: If you are using this guide to assist in deployment and configuration, note the order in which the steps are executed in each scenario. Background information Company A deployed the latest Tivoli Identity Manager Adapter for Tivoli Access Manager for Enterprise Single Sign-On and is ready to use the group sharing account management for its help desk team. People on the help desk team will be sharing access to a Tivoli Access Manager account called helpdesk_a. The owner of this account will be the help desk team lead, Alice, who is responsible for the password reset. To be able to have access to a group sharing account, all users are required to have a Tivoli Access Manager for Enterprise Single Sign-On account. The Tivoli Identity Manager administrator must create the Tivoli Identity Manager role HelpDeskRole_A to control access to the helpdesk_a account. A role owner must be assigned to this role to receive email notifications when role membership changes. Only one role owner is permitted for the group sharing account management configuration. The role owner must be the same person who owns the group sharing account. As identified above, Alice is assigned as the owner of this role. Whenever there is a request for a person to access the shared account, this person needs to be added to the HelpDeskRole_A role. This triggers an email to be sent to the role owner, Alice. Utilizing Group Sharing Account User Management using the IBM Tivoli Identity Manager Adapter for Tivoli Access
Alice receives an email requesting that the helpdesk_a account password be changed. Alice resets the password for this account. The change password operation triggers the adapter to provision the account with the new password to the new role member's Wallet. At the same time, it updates the password for helpdesk_a in all existing role members Wallets. Until the password change is completed, the new user is not able to use the shared account. The group sharing account is visible only under the owner's account list. For all other members sharing this account, there is no such account displayed in their account list in Tivoli Identity Manager. The following steps are performed to set up the group sharing account for the help desk team: 1. The Tivoli Identity Manager administrator verifies that Alice has a TAM E-SSO Service A account and that she has an email address (Figure 13 and Figure 14). Figure 13 Alice is a Tivoli Identity Manager user Figure 14 Alice has a Tivoli Access Manager for Enterprise Single Sign-On account 2. The Tivoli Identity Manager administrator creates the group sharing account helpdesk_a for the TAM Service in Tivoli Identity Manager and assigns Alice as the owner (Figure 15 and Figure 16 on page 15). Figure 15 New group sharing account helpdesk_a 14 Utilizing Group Sharing Account User Management
Figure 16 Alice is the owner of the helpdesk_a account 3. The Tivoli Identity Manager administrator creates a Tivoli Identity Manager role called HelpDeskRole_A to control access to the helpdesk_a shared account and assigns Alice to be the owner of this role. Alice also needs to be added as a member of this role (Figure 17, Figure 18, and Figure 19 on page 16). Figure 17 Creating the HelpDeskRole_A role - the owner is Alice Figure 18 Adding Alice as a member of the HelpDeskRole_A role Utilizing Group Sharing Account User Management using the IBM Tivoli Identity Manager Adapter for Tivoli Access
Figure 19 HelpDeskRole_A is created 4. The Tivoli Identity Manager administrator configures the email notification in the modify operation workflow for the person entity type to send an email to the role owner (Figure 20). Figure 20 Email notification to role owner 16 Utilizing Group Sharing Account User Management
5. The Tivoli Identity Manager administrator configures the TAM Service to have TAM E-SSO service A as a prerequisite service. At the same time, the TAM E-SSO Authentication Service ID needs to be defined (Figure 21). Figure 21 Service setup for TAM Service 6. The Tivoli Identity Manager administrator configures the TAM E-SSO service A to define the group sharing account mapping as following TAM Service helpdesk_a HelpDeskRole_A (Figure 22). Figure 22 Define the group sharing account mapping Granting access to a group sharing account Cathy joins Company A as a new member of the help desk team. As part of the new employee process, a Tivoli Identity Manager administrator creates the following accounts for Cathy: A Tivoli Identity Manager account A Tivoli Access Manager for Enterprise Single Sign-On account Cathy's job responsibilities require that she has access to the group sharing account helpdesk_a. The Tivoli Identity Manager administrator knows that the access to this group Utilizing Group Sharing Account User Management using the IBM Tivoli Identity Manager Adapter for Tivoli Access
sharing account is controlled by the Tivoli Identity Manager HelpDeskRole_A role. The Tivoli Identity Manager administrator completes the following steps to grant Cathy access to the helpdesk_a account: 1. The Tivoli Identity Manager administrator assigns Cathy to be a member of the HelpDeskRole_A role (Figure 23 and Figure 24). Figure 23 Add user members to HelpDeskRole_A Figure 24 Cathy s personal information By adding Cathy to the HelpDeskRole_A role, the system triggers an email to be sent to Alice. This email requests that Alice change the password for the helpdesk_a group sharing account. 18 Utilizing Group Sharing Account User Management
2. Alice changes the password of the helpdesk_a group sharing account using the Tivoli Identity Manager administrative console (Figure 25). Figure 25 Alice changes helpdesk_a account password The password change on the helpdesk_a group sharing account triggers the Tivoli Identity Manager Adapter for Tivoli Access Manager for Enterprise Single Sign-On to provision the helpdesk_a account to Cathy's Wallet. Also, as both Alice and Bob are part of the HelpDeskRole_A role, the adapter updates the password in both Alice's and Bob's Wallets. Cathy cannot use the sharing account until the password change is completed. Figure 26 illustrates that the helpdesk_a account has been provisioned into Cathy's Wallet. Figure 26 Cathy s Wallet Although the helpdesk_a account has been provisioned to Cathy's Wallet, it does not appear in the list of accounts when displaying her account list in Tivoli Identity Manager. This is due to the fact that Cathy is never the owner of the account (Figure 27). Figure 27 Cathy s Identity Manager account list Utilizing Group Sharing Account User Management using the IBM Tivoli Identity Manager Adapter for Tivoli Access
The account only appears under that account owner s account list. In this case, the group sharing account is displayed under Alice's account list in Tivoli Identity Manager (Figure 28). Figure 28 Alice s Identity Manager account list Removing access from a group sharing account Bob has decided to move from the help desk team to another team within Company A. While Bob was a member of the help desk team he was assigned access to the helpdesk_a group sharing account. This was done by assigning Bob to be a member of the HelpDeskRole_A role. As part of the employee transfer process, a Tivoli Identity Manager administrator needs to execute the following steps: 1. The Tivoli Identity Manager Administrator removes Bob from the HelpDeskRole_A role (Figure 29). Figure 29 Removing Bob from role membership This action triggers an email to be sent to Alice, who is the owner of both the helpdesk_a account and the HelpDeskRole_A role. The email requests that Alice change the password for the helpdesk_a shared account. 20 Utilizing Group Sharing Account User Management
The removal of Bob from HelpDeskRole_A also causes the Tivoli Identity Manager Adapter for Tivoli Access Manager for Enterprise Single Sign-On to remove the helpdesk_a account from Bob's Wallet (Figure 30). Figure 30 Bob s Wallet 2. Alice changes the password of the helpdesk_a group sharing account via the Tivoli Identity Manager administrative console (Figure 31). Figure 31 Alice changes the helpdesk_a account password This step is just a precaution, because an existing member was removed from the HelpDeskRole_A role. The change password operation on the helpdesk_a account causes the adapter to update the passwords in the Wallets of all existing role members, including both Alice and Cathy. Watch out: If the password change is not completed, there is a chance that Bob might still have access to the helpdesk_a credential within his local Wallet. After the local AccessAgent synchronizes the Wallet with the IMS Server, Bob no longer has access to the helpdesk_a account. Complete a password change every time that the owner of a group sharing account receives an email requesting it to be done. Utilizing Group Sharing Account User Management using the IBM Tivoli Identity Manager Adapter for Tivoli Access
Changing the owner of a group sharing account Alice has been promoted to another department in Company A and is leaving the help desk team. As Alice will no longer be the team lead for the help desk team, she can no longer be the owner of the helpdesk_a group sharing account and the HelpDeskRole_A role. Dan will be taking over the help desk team lead and needs to become the owner of the helpdesk_a group sharing account and the HelpDeskRole_A role. The Tivoli Identity Manager administrator completes the steps in this section to remove Alice as the owner of the helpdesk_a group sharing account and the HelpDeskRole_A role, then assigns the ownership of both to Dan. Important: In this example, Dan is already a member of the HelpDeskRole_A role and Dan's Wallet already contains the helpdesk_a group sharing account. If this is not the case, Dan needs to be added as a member before he can take ownership of the group sharing account and the role. This is because the adopt account operation in Tivoli Identity Manager does not automatically cause the Tivoli Identity Manager Adapter for Tivoli Access Manager for Enterprise Single Sign-On to populate the group sharing account into Dan's Wallet. Alternatively, after Dan becomes the owner of the HelpDeskRole_A role, he must force a password change operation to occur on the helpdesk_a account. This causes the adapter to provision the helpdesk_a account to Dan's Wallet. 1. The Tivoli Identity Manager administrator assigns the ownership of the helpdesk_a group sharing account to Dan using the Tivoli Identity Manager administrative console (Figure 32). Figure 32 Assign helpdesk_a account to user Dan This means that Alice is no longer the owner of the helpdesk_a group sharing account. Important: The helpdesk_a account still remains in Alice's Wallet because she is still a member of the helpdeskrole_a role. Dan is now the owner of the helpdesk_a account (Figure 33). Figure 33 Dan is the owner of the helpdesk_a account 22 Utilizing Group Sharing Account User Management
2. The Tivoli Identity Manager administrator removes Alice (Figure 34), then assigns Dan to be the only owner of the HelpDeskRole_A role (Figure 35). As Dan was already a member of the help desk team, he is already a member of this role. Figure 34 Change the owner of the helpdeskrole_a role Alice is no longer the owner of HelpDeskRole_A role. Dan is now the owner and a member of the HelpDeskRole_A role. Important: The helpdesk_a account still remains in Alice's Wallet, as she is still a member of the helpdeskrole_a role. Figure 35 New owner of role helpdeskrole_a 3. The Tivoli Identity Manager administrator then removes Alice as a member from the HelpDeskRole_A role (Figure 36). Figure 36 Change membership of helpdeskrole_a role Utilizing Group Sharing Account User Management using the IBM Tivoli Identity Manager Adapter for Tivoli Access
This triggers an email to be sent to Dan, who is now the owner of both the helpdesk_a account and the HelpDeskRole_A role. The adapter removes the helpdesk_a account from Alice's Wallet (Figure 37). Figure 37 Alice s Wallet 4. As a precaution, Dan changes the password of the helpdesk_a account using the Tivoli Identity Manager administrative console. Important: If the password change is not completed, there is a chance that Alice might still have access to the helpdesk_a credential within her local Wallet. After the local AccessAgent synchronizes the Wallet with the IMS Server, Alice no longer has access to the helpdesk_a account. Complete a password change every time that the owner of a group sharing account receives an email requesting it to be done. Figure 38 Dan changes the helpdesk_a account password This causes the adapter to update the password for the helpdesk_a account in both Dan and Cathy's Wallet. Creation of a new group sharing account The group sharing account feature is designed to support multiple group sharing accounts of various services. This means that a group of users can share access to an account for a Tivoli Access Manager service, while at the same time another group of users can share 24 Utilizing Group Sharing Account User Management
access to an account for a Lotus Notes service. This is done by defining the group sharing account mapping in the service form of the Tivoli Access Manager for Enterprise Single Sign-On. This attribute is a multi-valued attribute. The group sharing account also supports multiple Tivoli Access Manager for Enterprise Single Sign-On services. This means that the Tivoli Identity Manager Adapter for Tivoli Access Manager Enterprise Single Sign-On can manage multiple group sharing accounts for users with multiple Wallets. This is done by defining a Tivoli Access Manager for Enterprise Single Sign-On service as the prerequisite service for an application service. The following scenario outlines the creation of a new group sharing account of the same Tivoli Access Manager service. The information provided can be applied to any application service. In Company A, some existing users already have the helpdesk_a shared account in their Wallet. By creating the new helpdesk_b group sharing account and the Tivoli Identity Manager HelpDeskRole_B role, existing team members can be added to the HelpDeskRole_B role to gain access to the helpdesk_b shared account. Utilizing Group Sharing Account User Management using the IBM Tivoli Identity Manager Adapter for Tivoli Access
After reviewing the help desk team responsibilities, Dan requires a new group sharing account for the TAM Service. Dan submits a request to create a Tivoli Access Manager account with the name helpdesk_b. He also requests that the Tivoli Identity Manager HelpDeskRole_B role be created. This role will be used to manage access to the helpdesk_b shared account. Because Dan submitted the request, he will be assigned as the owner for both the HelpDesk_B account and the HelpDeskRole_B role. To create the new group sharing account, the Tivoli Identity Manager administrator completes the following steps: 1. The Tivoli Identity Manager administrator creates the HelpDeskRole_B role and assigns Dan as its owner. Dan is also added as a member of this role (Figure 39 and Figure 40). Figure 39 Creating HelpDeskRole_B role - the owner is Dan Figure 40 Adding Dan as a member of the HelpDeskRole_B role Dan is now the only owner and a member of the HelpDeskRole_B role. 26 Utilizing Group Sharing Account User Management
2. The Tivoli Identity Manager administrator then creates the helpdesk_b group sharing account and assigns Dan as the owner (Figure 41 and Figure 42). Figure 41 New helpdesk_b group sharing account Figure 42 Dan is the owner of the helpdesk_b account The createaccountwithtamesso workflow is triggered when the helpdesk_b group sharing account is created. This causes the adapter to look for Dan's Tivoli Access Manager for Enterprise Single Sign-On account. It then provisions the helpdesk_b account to Dan's Wallet. Utilizing Group Sharing Account User Management using the IBM Tivoli Identity Manager Adapter for Tivoli Access
The adapter uses the prerequisite service attribute to identify Dan's Wallet to provision the group sharing account to it. In this case, TAM E-SSO Service A is defined as the prerequisite service for the TAM Service. The helpdesk_b group sharing account is now added to Dan's Wallet for TAM E-SSO Service A (Figure 43). Figure 43 Dan s Wallet 3. The Tivoli Identity Manager administrator updates the TAM ESSO Service A service form by adding the following line to the Group Sharing Account mapping field: TAM Service helpdesk_b HelpDeskRole_B (Figure 44). Figure 44 Add the group sharing account mapping This modification ensures that when any new members are added to the HelpDeskRole_B role, the issharedrole workflow that occurs during a modify operation for a person is triggered. The workflow invokes an email notification to be sent to Dan. Therefore, Dan changes the password for the HelpDesk_B group sharing account to grant new members access to this account. New members cannot access the group sharing account until the password change is completed. Deletion of an existing group sharing account After a few months, Dan identifies that the helpdesk_b shared account is no longer needed. Dan submits a request to a Tivoli Identity Manager administrator requesting that the 28 Utilizing Group Sharing Account User Management
helpdesk_b group sharing account is removed. The Tivoli Identity Manager administrator completes the following steps. Important: Access to the group sharing account is not revoked from all users until all steps have been completed. 1. The Tivoli Identity Manager administrator deletes all members from HelpDeskRole_B (Figure 45). Figure 45 Remove role members This causes the Tivoli Identity Manager Adapter for Tivoli Access Manager for Enterprise Single Sign-On to delete the helpdesk_b account credentials from the Wallets of all the deleted role members. It also triggers an email to be sent to Dan. The helpdesk_b account is not removed from Dan's Wallet, as he is the owner of the account. Only when the helpdesk_b account is deleted from Tivoli Identity Manager is it removed from Dan's Wallet. 2. The Tivoli Identity Manager administrator deletes HelpDeskRole_B. The HelpDeskRole_B role is successfully deleted. The adapter takes no action during the deletion of a role. 3. The Tivoli Identity Manager administrator removes the group sharing account mapping from the TAM E-SSO Service A service form for the helpdesk_b account (Figure 46). Figure 46 Delete the group sharing account mapping 4. The Tivoli Identity Manager administrator deletes the helpdesk_b account from Tivoli Identity Manager (Figure 47). Figure 47 Delete the helpdesk_b account Utilizing Group Sharing Account User Management using the IBM Tivoli Identity Manager Adapter for Tivoli Access
The helpdesk_b account is successfully deleted. The deleteaccountwithtamesso workflow triggers the helpdesk_b account to be removed from Dan's Wallet (Figure 48). Figure 48 Dan s Wallet Assigning multiple users to a group sharing account To assign a group sharing account to a user, the user is added to the role that is associated with this shared account. When a Tivoli Identity Manager administrator assigns multiple users to a role that is associated with a shared account in one request, an email notification is sent to the account owner. The owner can assign all users access to this shared account via a single password change request. The email notification does not identify the users added or removed from the role. The notification only indicates that a role membership change has occurred and that a password change is required on the shared account. Assigning a user to a number of group sharing accounts To assign a group sharing account to a user, the user is added to the role that is associated with this shared account. In regards to the group sharing account configuration, the Tivoli Identity Manager administrator must not assign multiple roles to a user in a single request because only one email notification is sent to the owner to request a password change. This email only identifies the shared account for the first role assigned. The Tivoli Identity Manager administrator can assign only one role, associated with a group sharing account, per request for a user. Conclusion In this Redpaper publication we introduced the new group sharing account management functionality added to the IBM Tivoli Identity Manager Adapter for Tivoli Access Manager for Enterprise Single Sign-On. We included a brief overview of the group sharing account management functionality, outlining both supported and unsupported customer deployments. We also provided detailed deployment instructions to ensure a clear understanding of how the functionality is deployed. In conclusion, we discussed the capabilities of the group sharing account management functionality by using detailed use cases for supported scenarios. The group sharing account 30 Utilizing Group Sharing Account User Management
management functionality eliminates the number of accounts that are needed on a target system. It can help reduce the cost of maintaining an excessive number of user accounts by allowing multiple users to share a single account, yet still achieve full functionality. The team who wrote this paper This paper was produced by a team of specialists from around the world working at the International Technical Support Organization, Austin Center. Ivy Chiu is a software developer at the IBM Australian Development Lab (ADL), Gold Coast. She is an IBM Certified Deployment Professional for IBM Tivoli Identity Manager V5.1. She has four years of experience specializing in the testing and development of IBM Tivoli Identity Manager Adapters. She holds a degree in Information Technology from the Queensland University of Technology, Australia. Axel Buecker is a Certified Consulting Software IT Specialist at the ITSO, Austin Center. He writes extensively and teaches IBM classes worldwide on areas of software security architecture and network computing technologies. He holds a degree in Computer Science from the University of Bremen, Germany. He has 24 years of experience in a variety of areas related to workstation and systems management, network computing, and e-business solutions. Before joining the ITSO in March 2000, Axel worked for IBM in Germany as a Senior IT Specialist in Software Security Architecture. Thanks to the following people for their contributions to this project: Anthony Ferguson, Brian Matthiesen, Eng Kiat Koh, Zoran Radenkovic IBM Now you can become a published author, too! Here's an opportunity to spotlight your skills, grow your career, and become a published author all at the same time! Join an ITSO residency project and help write a book in your area of expertise, while honing your experience using leading-edge technologies. Your efforts will help to increase product acceptance and customer satisfaction, as you expand your network of technical contacts and relationships. Residencies run from two to six weeks in length, and you can participate either in person or as a remote resident working from your home base. Learn more about the residency program, browse the residency index, and apply online at: ibm.com/redbooks/residencies.html Utilizing Group Sharing Account User Management using the IBM Tivoli Identity Manager Adapter for Tivoli Access
Comments welcome Your comments are important to us! We want our papers to be as helpful as possible. Send us your comments about this paper or other IBM Redbooks publications in one of the following ways: Use the online Contact us review Redbooks form found at: ibm.com/redbooks Send your comments in an email to: redbooks@us.ibm.com Mail your comments to: IBM Corporation, International Technical Support Organization Dept. HYTD Mail Station P099 2455 South Road Stay connected to IBM Redbooks Find us on Facebook: http://www.facebook.com/ibmredbooks Follow us on Twitter: http://twitter.com/ibmredbooks Look for us on LinkedIn: http://www.linkedin.com/groups?home=&gid=2130806 Explore new Redbooks publications, residencies, and workshops with the IBM Redbooks weekly newsletter: https://www.redbooks.ibm.com/redbooks.nsf/subscribe?openform Stay current on recent Redbooks publications with RSS Feeds: http://www.redbooks.ibm.com/rss.html 32 Utilizing Group Sharing Account User Management
Notices This information was developed for products and services offered in the U.S.A. IBM may not offer the products, services, or features discussed in this document in other countries. Consult your local IBM representative for information on the products and services currently available in your area. Any reference to an IBM product, program, or service is not intended to state or imply that only that IBM product, program, or service may be used. Any functionally equivalent product, program, or service that does not infringe any IBM intellectual property right may be used instead. However, it is the user's responsibility to evaluate and verify the operation of any non-ibm product, program, or service. IBM may have patents or pending patent applications covering subject matter described in this document. The furnishing of this document does not give you any license to these patents. You can send license inquiries, in writing, to: IBM Director of Licensing, IBM Corporation, North Castle Drive, Armonk, NY 10504-1785 U.S.A. The following paragraph does not apply to the United Kingdom or any other country where such provisions are inconsistent with local law: INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Some states do not allow disclaimer of express or implied warranties in certain transactions, therefore, this statement may not apply to you. This information could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein; these changes will be incorporated in new editions of the publication. IBM may make improvements and/or changes in the product(s) and/or the program(s) described in this publication at any time without notice. Any references in this information to non-ibm websites are provided for convenience only and do not in any manner serve as an endorsement of those websites. The materials at those websites are not part of the materials for this IBM product and use of those websites is at your own risk. IBM may use or distribute any of the information you supply in any way it believes appropriate without incurring any obligation to you. Information concerning non-ibm products was obtained from the suppliers of those products, their published announcements or other publicly available sources. IBM has not tested those products and cannot confirm the accuracy of performance, compatibility or any other claims related to non-ibm products. Questions on the capabilities of non-ibm products should be addressed to the suppliers of those products. This information contains examples of data and reports used in daily business operations. To illustrate them as completely as possible, the examples include the names of individuals, companies, brands, and products. All of these names are fictitious and any similarity to the names and addresses used by an actual business enterprise is entirely coincidental. COPYRIGHT LICENSE: This information contains sample application programs in source language, which illustrate programming techniques on various operating platforms. You may copy, modify, and distribute these sample programs in any form without payment to IBM, for the purposes of developing, using, marketing or distributing application programs conforming to the application programming interface for the operating platform for which the sample programs are written. These examples have not been thoroughly tested under all conditions. IBM, therefore, cannot guarantee or imply reliability, serviceability, or function of these programs. Copyright International Business Machines Corporation 2010. All rights reserved. Note to U.S. Government Users Restricted Rights -- Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp. 33