Novell IDENTITY MANAGER 3.6. - INTEGRATION Guida rapida alla configurazione

Novell®

www.novell.com

novdocx (en) 11 July 2008

AUTHORIZED DOCUMENTATION

Identity Manager 3.6 Integration Guide for Novell Audit

Identity Manager

3.6

July 23, 2008

Integration Guide For Novell Audit

novdocx (en) 11 July 2008

Legal Notices

Novell, Inc., makes no representations or warranties with respect to the contents or use of this documentation, and

specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose.

Further, Novell, Inc., reserves the right to revise this publication and to make changes to its content, at any time,

without obligation to notify any person or entity of such revisions or changes.

Further, Novell, Inc., makes no representations or warranties with respect to any software, and specifically disclaims

any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc.,

reserves the right to make changes to any and all parts of Novell software, at any time, without any obligation to

notify any person or entity of such changes.

Any products or technical information provided under this Agreement may be subject to U.S. export controls and the

trade laws of other countries. You agree to comply with all export control regulations and to obtain any required

licenses or classification to export, re-export or import deliverables. You agree not to export or re-export to entities on

the current U.S. export exclusion lists or to any embargoed or terrorist countries as specified in the U.S. export laws.

You agree to not use deliverables for prohibited nuclear, missile, or chemical biological weaponry end uses. See the

Novell International Trade Services Web page (http://www.novell.com/info/exports/) for more information on

exporting Novell software. Novell assumes no responsibility for your failure to obtain any necessary export

approvals.

stored on a retrieval system, or transmitted without the express written consent of the publisher.

Novell, Inc., has intellectual property rights relating to technology embodied in the product that is described in this

document. In particular, and without limitation, these intellectual property rights may include one or more of the U.S.

patents listed on the Novell Legal Patents Web page (http://www.novell.com/company/legal/patents/) and one or

more additional patents or pending patent applications in the U.S. and in other countries.

Novell, Inc.

404 Wyman Street, Suite 500

Waltham, MA 02451

U.S.A.

www.novell.com

Online Documentation: To access the latest online documentation for this and other Novell products, see

the Novell Documentation Web page (http://www.novell.com/documentation).

novdocx (en) 11 July 2008

Novell Trademarks

For Novell trademarks, see the Novell Trademark and Service Mark list (http://www.novell.com/company/legal/

trademarks/tmlist.html).

Third-Party Materials

All third-party trademarks are the property of their respective owners.

novdocx (en) 11 July 2008

Contents 5

Contents

novdocx (en) 11 July 2008

About This Guide 7

1Overview 9

1.1 Novell Audit Integrated Architecture. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

2 Installing and Configuring Novell Audit 11

2.1 Installing Novell Audit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

2.2 Configuring the Secure Logging Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

2.3 Configuring the Data Store. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

2.4 Configuring System Notifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

3 Installing and Configuring the Platform Agent 13

3.1 Installing the Platform Agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

3.2 Configuring the Platform Agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

4 Managing Identity Manager Events 17

4.1 Selecting Events to Log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

4.1.1 Selecting Events for the User Application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

4.1.2 Selecting Events for the Driver Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

4.1.3 Selecting Events for a Specific Driver . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

4.1.4 Identity Manager Log Levels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

4.2 User-Defined Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

4.2.1 Using Policy Builder to Generate Events. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

4.2.2 Using Status Documents to Generate Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

4.3 eDirectory Objects that Store Identity Manager Event Data. . . . . . . . . . . . . . . . . . . . . . . . . . . 25

5 Using Status Logs 27

5.1 Setting the Log Level and Maximum Log Size. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

5.1.1 Setting the Log Level and Log Size for the Driver Set . . . . . . . . . . . . . . . . . . . . . . . . 27

5.1.2 Setting the Log Level and Log Size for the Driver . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

5.2 Viewing Status Logs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

5.2.1 Accessing the Driver Set Status Log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

5.2.2 Accessing the Publisher Channel and Subscriber Channel Status Logs . . . . . . . . . 30

6 Securing the Connection with Novell Audit 31

6.1 Updating the Novell Audit Certificate Infrastructure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

6.2 The Novell Audit AudCGen Utility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

6.3 Creating a Root Certificate for the Secure Logging Server . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

6.3.1 Creating a Self-Signed Root Certificate for the Secure Logging Server . . . . . . . . . . 35

6.3.2 Using a Third-Party Root Certificate for the Secure Logging Server . . . . . . . . . . . . . 35

6.4 Creating Logging Application Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

6.4.1 Enabling the Identity Manager Instrumentation to Use a Custom Certificate . . . . . . 36

6.5 Validating Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

6Identity Manager 3.6 Integration Guide for Novell Audit

novdocx (en) 11 July 2008

6.6 Securing Custom Certificates. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

6.6.1 Windows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

6.6.2 Linux and Solaris . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

A Identity Manager Events 39

A.1 Event Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

A.2 Error and Warning Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

A.3 Job Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40

A.4 Remote Loader Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40

A.5 Object Events. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40

A.6 Password Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

A.7 Search List Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

A.8 Engine Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

A.9 Server Events. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

A.10 Security Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

A.11 Workflow Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

A.12 Driver Start and Stop Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

B Novell Audit Reports 43

B.1 Administrative Action Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

B.2 Historical Approval Flow Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

B.3 Resource Provisioning Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46

B.4 Specific User Audit Trail Report I . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48

B.5 Specific User Audit Trail Report II . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50

B.6 Specific User Audit Trail III. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52

B.7 Specific User Provisioning Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54

B.8 User Provisioning Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56

About This Guide 7

novdocx (en) 11 July 2008

About This Guide

Welcome to the Novell®Identity Manager Integration Guide for Novell Audit. This guide provides

the information necessary to integrate Novell Audit with Identity Manager to provide auditing and

reporting services for Identity Manager.

Chapter 1, “Overview,” on page 9

Chapter 2, “Installing and Configuring Novell Audit,” on page 11

Chapter 3, “Installing and Configuring the Platform Agent,” on page 13

Chapter 4, “Managing Identity Manager Events,” on page 17

Chapter 5, “Using Status Logs,” on page 27

Chapter 6, “Securing the Connection with Novell Audit,” on page 31

Appendix A, “Identity Manager Events,” on page 39

Appendix B, “Novell Audit Reports,” on page 43

Audience

This guide is intended for network administrators.

Feedback

We want to hear your comments and suggestions about this manual and the other documentation

included with this product. Please use the User Comments feature at the bottom of each page of the

online documentation, or go to www.novell.com/documentation/feedback.html and enter your

comments there.

Documentation Updates

For the most recent version of the Identity Manager 3.6 Integration Guide for Novell Audit, visit the

Identity Manager Documentation Web site (http://www.novell.com/documentation/idm36).

Additional Documentation

For the current Novell Audit documentation, see the Novell Audit Documentation Web site (http://

www.novell.com/documentation/novellaudit20/index.html).

Documentation Conventions

In Novell documentation, a greater-than symbol (>) is used to separate actions within a step and

items in a cross-reference path.

A trademark symbol (®, TM, etc.) denotes a Novell trademark. An asterisk (*) denotes a third-party

trademark.

When a single pathname can be written with a backslash for some platforms or a forward slash for

other platforms, the pathname is presented with a backslash. Users of platforms that require a

forward slash, such as Linux* or UNIX*, should use forward slashes as required by your software.

8Identity Manager 3.6 Integration Guide for Novell Audit

novdocx (en) 11 July 2008

Overview

novdocx (en) 11 July 2008

Overview

Adding Novell®Audit to you Identity Manager solution provides auditing and reporting services.

By adding auditing and reporting, you can demonstrate that the business policies are implemented as

designed with your Identity Manager solution.

1.1 Novell Audit Integrated Architecture

The following diagram illustrates the Identity Manager logging and reporting architecture when

integrated with Novell Audit.

Figure 1-1 Identity Manager and Novell Audit Integrated Architecture

1. An Identity Manager event occurs and it is sent to the Platform Agent. To capture all Identity

Manager events, the Platform Agent must be installed and configured on each Identity Manager

server.

2. (Conditional) If the Platform Agent cannot connect to the Secure Logging Server, the events

are stored in cache until the connection is reestablished.

3. The Platform Agents sends the event to the Secure Logging Server.

4. The Secure Logging Server sends the events to eDirectoryTM. Through iManager, you configure

the objects that store the events.

5. The Secure Logging Server sends the event to the data store, which stores the events. The data

store is a database that stores the events until they are needed.

The stored events are displayed through Novell Audit reports and iManager queries.

For more information about the Novell Audit architecture, see “System Architecture” in the Novell

Audit 2.0 Administration Guide.

eDirectory

Secure Logging

Server

Identity

Manager

Platform

Agent

Events

Cache

When disconnected

from the Secure

Logging Server

When reconnected

to the Secure

Logging Server

Configuration

data via

iManager

Novell Audit

Report

iManager

Queries

Crystal

Reports

Data Store

Port 289

10 Identity Manager 3.6 Integration Guide for Novell Audit

novdocx (en) 11 July 2008

Indice

Altri manuali Novell Software

Novell

Novell DATA SYNCHRONIZER - 07-2010 Manuale utente

Novell

Novell CLIENT FOR LINUX 2.0 SP1 - ADMINISTRATION Manuale di istruzioni

Novell

Novell LINUX ENTERPRISE SERVER 10 SP1 - ARCHITECTURE-SPECIFIC INFORMATION... Manuale

Novell

Novell CLIENT FOR LINUX 2.0 SP1 - 08-2008 Manuale utente

Novell

Novell IMANAGER 2.7.3 - README 8-26-2010 Manuale utente

Novell

Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - COMMAND LINE UTILITIES REFERENCE 10.3... Manuale di programmazione

Novell

Novell GROUPWISE 8 - SECURITY POLICIES Manuale utente

Novell

Novell GROUPWISE 7 GATEWAY FOR MICROSOFT EXCHANGE - INSTALLATION AND... Manuale di istruzioni

Novell

Novell Open Enterprise Server 2 Manuale di istruzioni

Novell

Novell SENTINEL 6.1 SP1 HOTFIX 2 - READ ME 9-2009 Manuale utente

Novell

Novell DATA SYNCHRONIZER - 07-2010 Manuale utente

Novell

Novell ZENWORKS APPLICATION VIRTUALIZATION 8.0 -... Manuale utente

Novell

Novell IDENTITY MANAGER 3.6.1 Manuale utente

Novell

Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - COMMAND LINE UTILITIES REFERENCE 10.3... Manuale di installazione e funzionamento

Novell

Novell APPARMOR - AND Manuale tecnico

Novell

Novell LINUX ENTERPRISE DESKTOP 11 - KDE Manuale utente

Novell

Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - COMMAND LINE UTILITIES REFERENCE 10.3... Manuale utente

Novell

Novell IDENTITY MANAGER DRIVER FOR ID PROVIDER 3.6.1 -... Manuale utente

Novell

Novell IFOLDER 3 - ADMINISTRATION Manuale utente

Novell

Novell PLATESPIN ORCHESTRATE 2.0.2 - ADMINISTRATOR REFERENCE... Manuale di servizio

Novell

Novell GROUPWISE 7 - POST OFFICE AGENT Manuale utente

Novell

Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - COMMAND LINE UTILITIES REFERENCE 10.3... Manuale tecnico

Novell

Novell ACCESS MANAGER 3.1 SP2 BETA 1 - SCENARIOS... Manuale utente

Novell

Novell CUSTOMER CENTER 2.3 - GUIDE 4-8-2009 Manuale utente

Manuali Software popolari di altre marche

COMPRO

COMPRO COMPROFM Manuale utente

Muratec

Muratec OFFICEBRIDGE ONLINE Manuale utente

Oracle

Oracle Contact Center Anywhere 8.1 Manuale utente

Adobe

Adobe 65007312 - Photoshop Lightroom Manuale

Avaya

Avaya NULL One-X for RIM Blackberry Manuale utente

HP ProLiant BL420c Manuale utente

PS Audio

PS Audio PowerPlay Manuale del proprietario

Brady

Brady LOCKOUT PRO 3.0 Manuale di servizio

Avaya

Avaya Interaction Center Manuale utente

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Manuale

Oracle

Oracle Application 9i Manuale utente

Acer

Acer RDM Manuale utente

Canon

Canon Vixia HF21 Manuale utente

Canon

Canon ZR950 Manuale utente

Samsung

Samsung Auto Backup Manuale utente

Polycom

Polycom Vortex EF2201 Istruzioni per l'installazione e il funzionamento

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Manuale utente

Lexmark

Lexmark Apps Manuale di servizio