Identity Manager 4 Package Manager Lab

Identity Manager 4 Package Manager Lab NIQ16 Novell Training Services ATT LIVE 2012 LAS VEGAS www.novell.com

Legal Notices Novell, Inc., makes no representations or warranties with respect to the contents or use of this documentation, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc., reserves the right to revise this publication and to make changes to its content, at any time, without obligation to notify any person or entity of such revisions or changes. Further, Novell, Inc., makes no representations or warranties with respect to any software, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc., reserves the right to make changes to any and all parts of Novell software, at any time, without any obligation to notify any person or entity of such changes. Any products or technical information provided under this Agreement may be subject to U.S. export controls and the trade laws of other countries. You agree to comply with all export control regulations and to obtain any required licenses or classification to export, re-export or import deliverables. You agree not to export or re-export to entities on the current U.S. export exclusion lists or to any embargoed or terrorist countries as specified in the U.S. export laws. You agree to not use deliverables for prohibited nuclear, missile, or chemical biological weaponry end uses. See the Novell International Trade Services Web page (http://www.novell.com/info/exports/) for more information on exporting Novell software. Novell assumes no responsibility for your failure to obtain any necessary export approvals. Copyright 2012 Novell, Inc. All rights reserved. No part of this publication may be reproduced, photocopied, stored on a retrieval system, or transmitted without the express written consent of the publisher. Novell, Inc., has intellectual property rights relating to technology embodied in the product that is described in this document. In particular, and without limitation, these intellectual property rights may include one or more of the U.S. patents listed on the Novell Legal Patents Web page (http://www.novell.com/company/legal/patents/) and one or more additional patents or pending patent applications in the U.S. and in other countries. Novell, Inc. 404 Wyman Street, Suite 500 Waltham, MA 02451 U.S.A. www.novell.com Online Documentation: To access the latest online documentation for this and other Novell products, see the Novell Documentation Web page (http:// www.novell.com/documentation). Novell Trademarks For Novell trademarks, see the Novell Trademark and Service Mark list (http://www.novell.com/company/legal/trademarks/tmlist.html). Third-Party Materials All third-party trademarks are the property of their respective owners. 2

Contents SECTION 1 Advanced Package Management 3 Exercise 1-1 Package Manager Development 4 Task I: Import Packages from Package Catalog........................................................... 4 Task II: Create a New Development Identity Vault............................................................. 4 Task III: Copy Default Packages.......................................................... 5 Task IV: Customize Prompts for Copied Package........................................................... 7 Task V: Customize Filters for Copied Package........................................................... 8 Task VI: Customize GCVs for the Copied Package........................................................... 9 Task VII: Customize Policies for the Copied Package.......................................................... 10 Task VIII: Publish the Package for Download........................................................ 13 Task IX: Create New Category and Group................................................................ 14 Task X: Create Category and Group through the Driver........................................................... 15 Task XI: How to add Optional Packages......................................................... 15 Task XII: Create New Package Version.......................................................... 18 1

NIQ16-Identity Manager 4 Package Manager: Configuring and Upgrading Your Identity Deployment / Lab 2

Advanced Package Management SECTION 1 Advanced Package Management In this section of the workbook, you learn how to do the following: 1. Package Manager Development on page 4 3

NIQ16-Identity Manager 4 Package Manager: Configuring and Upgrading Your Identity Deployment / Lab Exercise 1-1 Package Manager Development In this lab, you will work with the Package Manager to create your own package and then add the package you created to a driver. This exercise has twelve parts: Task I: Import Packages from Package Catalog on page 4 Task II: Create a New Development Identity Vault on page 4 Task III: Copy Default Packages on page 5 Task IV: Customize Prompts for Copied Package on page 7 Task V: Customize Filters for Copied Package on page 8 Task VI: Customize GCVs for the Copied Package on page 9 Task VII: Customize Policies for the Copied Package on page 10 Task VIII: Publish the Package for Download on page 13 Task IX: Create New Category and Group on page 14 Task X: Create Category and Group through the Driver on page 15 Task XI: How to add Optional Packages on page 15 Task XII: Create New Package Version on page 18 Task I: Import Packages from Package Catalog This lab requires that certain packages be available to use. We need to go import all the packages into Designer. 1. Open Designer if its not open on your desktop. 2. In the outline view, right-click on the Package Catalog and select Import Package.. 3. Uncheck the option Show Base Packages Only. 4. Click the button Select All then click OK to import all the packages. Task II: Create a New Development Identity Vault We will use a test Identity Vault to develop packages. Do the following: 1. On the right edge of the Designer window, you have a Palette panel. Drag over a new Identity Vault to the modeler work space. When prompted for the Server DN, leave the suggested default unchanged and click OK. 2. Right-click on the new Identity Vault and select Properties from the context menu. In the Properties of Identity Vault dialog, enter the new Vault name: IDM Development. Click OK. 4

Advanced Package Management Task III: Copy Default Packages Package Manager does not ever allow you to modify or replace Package content that is in a locked state. You can add it to the driver, but you can't modify it. The solution is to get a package that can be customized. The only way to take a base package and customize it is to copy it. Once the base package has been copied, then you will be able to customize it to meet your business needs. During the lecture we mentioned that there will be times when driver packages have to be modified. The placement rule and the filter is a good example, in most implementations you will have to customize these items. This task will show you how to customize locked packages. Package Manager Developer Mode has to be enabled to do this. Do the following: 1. Go to the properties of your IDM Development Identity Vault. 2. Enable the option Package Developer Mode. 3. Do the same thing for IDM4-IDV-01 Identity Vault. 4. In your Palette view, expand the Directory folder. 5. Drag the Active Directory driver over to your IDM Development Identity Vault. 6. When prompted for Driver Base Configuration, click Cancel. You will now have an Active Directory driver connected to your IDM Development Identity Vault. NOTE: The reason why we are doing this is we want a clean driver with no additional information added. 7. Double-click the line between the driver and the Identity Vault. 8. Change the name to ACME AD Dev Driver 9. In your outline view under the Package Catalog select Directory > Active Directory > Active Directory Default Configuration. You will be displayed the packages that are supported for Active Directory. The Active Directory Default Configuration is the package we need to copy. 10. Right-click on your 1.0.0 package under Active Directory Default Configuration. 11. Select Copy Package... You will be prompted with a new Copy Package dialog. 12. Configure the package prompts like the following: Name: ACME Active Directory Default Configuration Short Name: ACMEADDCFG Version: 1.0.0 5

NIQ16-Identity Manager 4 Package Manager: Configuring and Upgrading Your Identity Deployment / Lab Description: Active Directory driver base configured for ACME Corp. Type: Driver Category: ACME You can type in the name in the Category field. Group Active Directory You can type in the name in the Group field. 13. Click Next. 14. Click Next at the constraints menu. 15. Change the Vendor name to ACME Corp. 16. Click Next > Finish. 17. In your package outline view you will see a ACME folder. Expand it. 18. Expand the Active Directory Folder. You should see your new copied package in the list of ACME packages. 19. Expand the contents of your new ACME AD Default Configuration package. 6

Advanced Package Management NOTE: You can now see all the contents that are going to be applied when this packages is being applied to a the Active Directory driver. Task IV: Customize Prompts for Copied Package During this task you are going to customize the connection prompt that is displayed during the driver config. Prompts can be configured before you add your package to a development driver. Do the following: 1. In your package outline view expand the Resources folder. Edit the NOVLADDCFG-SynchronizationPrompts resource object. 2. Enter the following for the Synchronization Settings: Domain DNS Name* acme.com Subscriber Channel Placement Type Flat Active Directory User Container* cn=users,dc=acme,dc=com Publisher Channel Placement Type Flat NOTE: Working with a Development IDvault allows you to test your configuration. 3. Double-click on the line between your ACME AD Dev Driver and your IDM Development Identity Vault. 4. Select the Packages option from the properties menu. 5. Click the green sign in the top right corner. 6. Put a tic next to ACME Active Directory Default Configuration. 7. Click OK. 8. Click OK on the Common Settings package dependencies. 9. Click OK to install. 10. When prompted for Common Settings, leave at defaults and click Next. NOTE: You will notice that the prompts have been pre-configured. 11. Click Next. 12. Click Finish to apply the custom package. 13. Drag a new Active Directory driver from your Palette over to your IDM Development IDvault. 14. Click Cancel. 15. Double-click the line between the driver and the Identity Vault. 16. Change the name to ACME AD Dev Driver 7

NIQ16-Identity Manager 4 Package Manager: Configuring and Upgrading Your Identity Deployment / Lab 17. Select the Packages option from the properties menu. 18. Click the green sign in the top right corner. 19. Put a tic next to ACME Active Directory Default Configuration. 20. Click OK. 21. Click OK to install the package. 22. You then will be prompted for the ACME AD Default config synchronization settings. NOTE: You should notice that the values have been pre-filled with the correct values. 23. Click Next > Finish. Task V: Customize Filters for Copied Package You can create multiple filter resource objects, however, they will always be combined as one when viewed in the filter. This does give you the option of being able to add filter resource objects when add-on packages are applied. Novell has filter resource object in the default package and in the entitlements package. This allows them to add more functionality to the driver filter when the entitlement package is applied. In this task we are going to create a brand new filter object. However, you could easily copy and modify the one that is there, as in the example we did with promptings. WARNING: The steps here are not as detailed. Please refer to the last task for any reference help. Do the following: 1. In your outline view right-click on your ACME AD Dev Driver and select New > Resource... 2. Change the name to ACMEADDevice-Filter. 3. Change the content type to application/vnd.novell.dirxml.filter-ext+xml 8

Advanced Package Management 4. Click OK. 5. Click Yes to open up the editor. 6. Add the Device class to the filter and enable the Subscriber channel to Synchronize. NOTE: This is just an example to show you how this device class would be added to current filter. 7. Close and Save your ACMEADDevice-Filter from the editor. 8. Right-click on your new filter resource object to add it to the package. NOTE: In a real world scenario you would definitely be changing the default filter. You would want to do it the same way you did with the resource promptings above. You would copy and rename your filter and make changes to it. Then you would add it to your package and then remove the default filter from the package. 9. Edit your ACME AD Dev Driver Filter object. You will notice that the Device class has been added to the filter. Task VI: Customize GCVs for the Copied Package During this task, we are going to create a new Global Config Variable (GCV) object that sets a path for placement for contractors being created in AD to a different container in the Identity Vault. Do the following: 1. In your outline view right-click on your ACME AD Dev Driver and select New > Global Configuration... 2. Enter the name of ACMEADContractors-GCVs 3. Edit your new contractor GCV. 4. Select the GCVs menu option in the properties editor. 9

NIQ16-Identity Manager 4 Package Manager: Configuring and Upgrading Your Identity Deployment / Lab 5. Click the Add... button at the bottom left of the editor. 6. Enter the name of contractor.placement.ad 7. Enter the Display name of Contractor Placement from AD into Identity Vault. 8. Enter something in the description. 9. Change type to dn. 10. Change syntax to slash. 11. Change DN Space to dirxml. 12. Click Finish. 13. In the dn field, click on the browse icon and select your Workorders.System container. 14. If you are prompted for credentials enter the following: Host: 172.17.5.111 Username: admin.sa.system Password: novell 15. You should have system\workorders in your GCV. 16. Click OK to save your new GCV. 17. Right-click on your new GCV and select Add to Package. Task VII: Customize Policies for the Copied Package During this task, we are going to customize one of the original placement policies on the publisher channel. We only allow contractors and temporary employees to be created in the Identity Vault coming from AD. All other users are created through the HR system. Its more likely that your subscriber channel will be highly customized in your production environment. Do the following: 1. Highlight your ACME AD Dev Driver in your outline view. 2. Click on the Show Policy Flow view icon. 3. Highlight the Publisher Placement policy set. 4. In the Policy Set tab below you will see the NOVLADDCFG-pub-pp placement policy. 5. Copy the NOVLADDCFG-pub-pp placement policy. 6. Name your new policy ACMEADDCFG-pub-pp. 7. Leave the option checked to open the editor. 8. Click OK. 9. Click the XML Source tab in the bottom view. 10. Delete the entire XML source. 10

Advanced Package Management 11. Leaving Designer open, navigate with Windows Explorer to c:\users\administrators\desktop\exercises\3110. 12. Open the Contractor.xml file with an editor. 13. Copy the entire contents and then go back to Designer and past it into the XMLSource editor. 14. Click the Policy Builder tab. You will see your new placement policy for contractors listed. 15. Close and Save your new policy. 16. Add your new publisher placement policy to your package. 17. Remove NOVLADDCFG-pub-pp from your package by right clicking and select Remove from package. 18. Delete the NOVLADDCFG-pub-pp policy. 19. Click on the green add symbol to add another placement policy for temporary employees. Give the policy a name of Placement Policy for Temporary Employees. 20. Uncheck the option to edit the policy. NOTE: We are not going to worry about the rule code for this placement policy. We only need the policy for this example. 21. Add the new Temporary Placement rule to your package. NOTE: You will now see two placement policies. When this policy is applied to a package, the package knows from which policy set it came from, however, it does not take into account ordering. 22. Change your view back to the Outline View. 23. In your Package Catalog expand the ACME package category. 24. Review the Policies, Resources, and GCVs in your package under the ACME Active Directory Default Configuration package. 25. You should see the four new objects that have been added. NOTE: The main reason why we added or copied configuration parameter objects is that if this package was ever updated we could feel confident that our modified policies would never be overwritten. If Novell ever released a new version of this package, we could easily make a copy of the new version, verify those changes with our customizations, and then build our own new version of the package. 26. Open the properties of the Placement Policy for Temporary Employees. 27. Select the Linkage menu option. 28. Change the weight option from 500 to 50. 11

NIQ16-Identity Manager 4 Package Manager: Configuring and Upgrading Your Identity Deployment / Lab NOTE: By default Novell packages start at 500. If you want policy to come before then you need to make them a lower number. 29. Open the properties of the ACMEADDCFG-pub-pp policy in the package view. 30. Select the Linkage menu option. 31. Change the weight option from 500 to 75. 32. This is where you can verify a few things. You can see the Policy Set that it is part of. Plus you can see the order the policy is being put down in that policy set. NOTE: If you had multiple policies that you created in your policy set and they needed to be ordered as the package lays it down, you would want to provide an order and weight option for those policies in the package. The weight option is the best choice because if you had two policies that had weighting of 400 and 500 and you created an entirely new package that placed policies in the same location, you could put those to 100 and 200. So when both packages were applied, they would be in the correct order under the policy set. 33. Click OK to exit the properties menu. 34. Lets test the current package. Delete the ACME AD Dev driver from the Modeler view. 35. Drag a new Active Directory driver from your Palette over to your IDM Development IDvault. 36. Click Cancel. 37. Double-click the line between the driver and the Identity Vault. 38. Change the name to ACME AD Dev Driver 39. Select the Packages option from the properties menu. 40. Click the green sign in the top right corner. 41. Put a tic next to ACME Active Directory Default Configuration. 42. Click OK. 43. Click OK to install the package. 44. You then will be prompted for the ACME AD Default config synchronization settings. NOTE: You should notice that the values have been pre-filled in with the correct values. 45. Click Next > Finish. 46. Verify your Filter and GCV have been added to the driver. Also verify that your two placement rules have been added properly and are in the right ordering. 12

Advanced Package Management NOTE: The tasks above showed you how to add Promptings, Filters, GCVs, and Policy to a package. If you were going to create a custom package for a business rule that you were implementing, you would do the same thing. Create your add-on package and then add your content to the package. Task VIII: Publish the Package for Download A scenario for this part of the lab could be a consulting company that has released a new version of the driver and its customer needs to download the latest enhancements made. This also could be a way to transfer packages to another Designer project. Now that you know how to customize a new package, the next part of the lab will show you how you can lock and release this package so a.jar file can be passed around or you can use Designer to do a automatic update. Do the following: 1. Navigate to your ACME package category in your Package Catalog view. 2. Expand the ACME Active Directory Default Configuration. 3. Right-click on your 1.0.0 package and select Build... WARNING: As a reminder you should have seen the option New Package Version... This allows you to create a 2.0.0 version of this package if you wanted to, however, the Designer project you developed the 1.0.0 package in has to be used to create the 2.0.0 version. 4. Click the Browse... option and navigate to c:\novell\packages. 5. Put a tic next to the Release Package option. NOTE: The Release option is what will lock your package from ever being edited. Once a packages has been locked, the only option you have is to create a new package version. 6. You will be prompted with an information screen telling you that your.jar file was created successfully. 7. Right-click on your Package Catalog and select Import Package. 8. If you select the Browse... option you can see where a co-worker with another Designer instance could install the new package.jar file you just built. 9. Click Cancel to get out of the import option. Since you have the package already in your Designer project, there is no need to re-import it. NOTE: Building the.jar is one way of sharing a new package. The next few steps are going to use the publish option which allows you to do a automatic update in Designer. 10. Right-click on your 1.0.0 package you just built. 11. Select the Publish... option. 13

NIQ16-Identity Manager 4 Package Manager: Configuring and Upgrading Your Identity Deployment / Lab 12. In the Publish Directory option browse and select c:\novell\packages folder. 13. In the Build Directory option browse and select c:\novell\packages folder. 14. Click OK. 15. Using Windows Explorer navigate to c:\novell\packages folder. 16. You have two folders plugins and features and a site.xml file. 17. View the contents of the two folders. NOTE: The XML file and the folders would need to be moved to a HTTP server. Then Designer would need to be configured to point to this new location. 18. In the Designer menu select Window > Preferences. 19. Expand Novell > Package Manager > Online Updates. 20. This is where you would add the http URL to the list. You can also add a file URL as in the example in the list with ACME. 21. Click Cancel to exit the view. Task IX: Create New Category and Group During this task we are going to show you the different options that are available. We are going to show you how to create a category and groups using the Package Catalog. Do the following: 1. Right-click on Package Catalog and select New Category... 2. Provide a name for your new category. Click OK. 3. Right-click on your new Category and select New Group... 4. Provide a name for your new group. Click OK. 5. Right-click on your new group and select New Package... 6. In your Create Package menu, provide the required information. Short name has to be unique and only 11 characters. The type options specifies that type of package. If you choose the Base Package option, then this package would only be available for NEW drivers. 7. Click Next to continue. 8. The Driver Type field specifies the driver this package can be installed on. 9. Click Next to continue. 10. Enter in a name for the Vendor information. Click Next > Finish. 11. In the package catalog view expand your new package to look at the results. 12. Right-click on the version of your driver. You will be prompted with many options. 14

Advanced Package Management NOTE: The package itself has very little configuration. You can configure and create Prompt Resources on the package itself. If you selected a Base package the Prompt Resource would show you more options like a Remote Loader prompts setting etc. As you can see there is NO option to add content to a package. As you have completed the above tasks, it is required that the package be applied to a driver before content can be added to it. Also make sure that the Enable Developer mode is turned on in the Driver Set or you won t be able to add content to a package from a driver. Task X: Create Category and Group through the Driver During this task we are going to show you the different options that are available. We are going to show you how to create a category and groups using the driver option. Do the following: 1. Go to the Package properties on your Active Directory Development driver. 2. In the top right corner you will see a brown package icon. 3. Click on it. 4. You will be displayed a Package Properties menu like before. 5. We want to point out to you is the Category and group option. This allows you to select an existing category or group. The other point we want to make is that you can type in a new category and group names in those fields. You do not have to create the category and group exclusively from Package Catalog. 6. You can finish the package creation if you wish with a new category and group or you can click Cancel. Task XI: How to add Optional Packages What if you created a custom package and also wanted two additional packages to be installed with it? This task will show you how to do that. This happens by default with the base package. Do the following: 1. Drag another Active Directory driver over to your IDM Development. 2. Select the Active Directory Base package and click Next. NOTE: Notice that on the optional features its wanting to install additional configuration. 3. Click Next to continue. 4. Select OK to install the Password Package Dependencies and Java Class. 5. Notice the Driver Name, click Next. 6. Notice the Authentication Parameters, click Cancel to stop the driver config. 7. Delete the driver from your test Identity Vault. 15

NIQ16-Identity Manager 4 Package Manager: Configuring and Upgrading Your Identity Deployment / Lab NOTE: You should have noticed that the Base package contains a lot of prompting information. As you did in an earlier lab, you could customize these prompts also. In the steps below we are going to copy the base package. 8. Under the Package Catalog navigate to Directory > Active Directory >Active Directory Base. 9. Right-click on 1.0.3 base package and select Copy Package... 10. Change the name to ACME Active Directory Base. 11. Change the short name to ACMEADBASE. 12. Change the Version to 1.0.0 13. Change the Category to ACME and group to Active Directory. 14. Click Next > Next. 15. Change vendor to ACME. Click Next > Finish. You should now have a new ACME Active Directory Base in your Active Directory group. 16. Navigate and highlight your 1.0.0 ACME Active Directory Default Configuration package. NOTE: Notice under the Resources folder, you have four prompts configuration. Click on one of them and see what prompting information could be changed or set. NOTE: In the steps below we are going to show you how when the ACME Base package is added the ACME default configuration is also added. 17. Notice under the Resources folder, you have four prompts configuration. Click on one of them and see what prompting information could be changed or set. 18. In your bottom left corner view in Designer you have a Properties window that should now have results in it. Make sure the package is highlighted. 19. Move the slider down until you see Package Id. 20. This is the number we need for the optional packages configuration. 16

Advanced Package Management 21. Right-click and select properties on your 1.0.0 package under your ACME Active Directory Base. 22. Select the Dependencies menu option. NOTE: The Dependencies option makes it easy to configure dependent packages. The green add icon lets you add additional add on packages. 23. Select the Configuration Wizard menu option. 24. We need to remove the other optional packages from the XML. Select the <group tag on the Entitlements and Exchange Mailbox Support...false > and drag and highlight the rest of the tags down to the last </group> and cut out. 25. You should be left with the following XML. 26. Change the display-name field to ACME Default Configuration. 27. Copy the Package ID from the properties option we showed you earlier and replace the current one there. Click OK when finished. WARNING: Make sure you copy the right package ID from the ACME Default Configuration package. 28. We are now ready to test the new base with the optional package. Delete your ACME AD Dev driver. 29. Drag a new driver over to your IDM Development Identity Vault. 30. Your ACME Active Directory Base should now be visible. 31. Select it and click Next. 17

NIQ16-Identity Manager 4 Package Manager: Configuring and Upgrading Your Identity Deployment / Lab 32. You should notice that your ACME Default Configuration is now displayed in the Optional Features view. Click Next. 33. If you want to see if everything is being put down properly you can continue with the rest of the configuration. You should notice the pre-configured Synchronization Settings prompt come up. Task XII: Create New Package Version The objective of this section is to take an existing package and create a new updated version. 1. In your Outline view, expand your ACME > Active Directory group. 2. Right click on the 1.0.0 package inside your ACME Active Directory Default Configuration and select New Package Version... 3. Keep all the information the same except change the Version to a different number. 4. Select Next and continue with the defaults until finished. NOTE: You should now notice that you have two packages listed under your ACME Active Directory Default Configuration. At this time you could add additional prompts to the existing resources or create new ones depending upon if your new package version required additional prompts. 5. Go to the Package properties on your Active Directory Development driver. You will now notice that your Upgrades option now has a green check box. 6. Under the Operations option select Upgrade, you then will be prompted for the upgraded version. Select OK. 7. Select OK then Finish to install the upgraded package. WARNING: At this time, your new package doesn t have any new configuration. You could add new prompting configuration, however, we must apply it to a driver to change the current package configuration. Now that the package has been added to a development driver, we can change the package contents. 8. In the Outline view or the Fishbone view. Edit the Placement Policy for Temporary Employees on the Publisher placement policy set. In the previous lab we did not add any rules in this policy. It wasn t need in that example. Lets add a rule so this policy will be different then the version 1.0.0. 9. Create a new rule with the name of Department must match Temporary or it will be Vetoed. 10. Your two conditions should be If operation attribute OU not equal to Temporary or If operation attribute OU not equal to Contractor then action Veto. We won t be actually testing this rule, so really anything in there will work. 18

Advanced Package Management 11. Close and save your rule. 12. Right click on your new rule and select Sync to Package. NOTE: This is one small change, you could add additional policies, resources, GCVs to make this an updated version. The key to this is that the package needed to be added to a development driver. After you had done all those things then you could lock and publish it as we did earlier. 13. You have completed this lab exercise. (End of Exercise) 19

NIQ16-Identity Manager 4 Package Manager: Configuring and Upgrading Your Identity Deployment / Lab 20