Novell IDENTITY MANAGER 3.6. - INTEGRATION Guide de configuration rapide

Novell®

www.novell.com

novdocx (en) 11 July 2008

AUTHORIZED DOCUMENTATION

Identity Manager 3.6 Integration Guide for Novell Audit

Identity Manager

3.6

July 23, 2008

Integration Guide For Novell Audit

novdocx (en) 11 July 2008

Legal Notices

Novell, Inc., makes no representations or warranties with respect to the contents or use of this documentation, and

specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose.

Further, Novell, Inc., reserves the right to revise this publication and to make changes to its content, at any time,

without obligation to notify any person or entity of such revisions or changes.

Further, Novell, Inc., makes no representations or warranties with respect to any software, and specifically disclaims

any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc.,

reserves the right to make changes to any and all parts of Novell software, at any time, without any obligation to

notify any person or entity of such changes.

Any products or technical information provided under this Agreement may be subject to U.S. export controls and the

trade laws of other countries. You agree to comply with all export control regulations and to obtain any required

licenses or classification to export, re-export or import deliverables. You agree not to export or re-export to entities on

the current U.S. export exclusion lists or to any embargoed or terrorist countries as specified in the U.S. export laws.

You agree to not use deliverables for prohibited nuclear, missile, or chemical biological weaponry end uses. See the

Novell International Trade Services Web page (http://www.novell.com/info/exports/) for more information on

exporting Novell software. Novell assumes no responsibility for your failure to obtain any necessary export

approvals.

stored on a retrieval system, or transmitted without the express written consent of the publisher.

Novell, Inc., has intellectual property rights relating to technology embodied in the product that is described in this

document. In particular, and without limitation, these intellectual property rights may include one or more of the U.S.

patents listed on the Novell Legal Patents Web page (http://www.novell.com/company/legal/patents/) and one or

more additional patents or pending patent applications in the U.S. and in other countries.

Novell, Inc.

404 Wyman Street, Suite 500

Waltham, MA 02451

U.S.A.

www.novell.com

Online Documentation: To access the latest online documentation for this and other Novell products, see

the Novell Documentation Web page (http://www.novell.com/documentation).

novdocx (en) 11 July 2008

Novell Trademarks

For Novell trademarks, see the Novell Trademark and Service Mark list (http://www.novell.com/company/legal/

trademarks/tmlist.html).

Third-Party Materials

All third-party trademarks are the property of their respective owners.

novdocx (en) 11 July 2008

Contents 5

Contents

novdocx (en) 11 July 2008

About This Guide 7

1Overview 9

1.1 Novell Audit Integrated Architecture. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

2 Installing and Configuring Novell Audit 11

2.1 Installing Novell Audit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

2.2 Configuring the Secure Logging Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

2.3 Configuring the Data Store. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

2.4 Configuring System Notifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

3 Installing and Configuring the Platform Agent 13

3.1 Installing the Platform Agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

3.2 Configuring the Platform Agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

4 Managing Identity Manager Events 17

4.1 Selecting Events to Log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

4.1.1 Selecting Events for the User Application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

4.1.2 Selecting Events for the Driver Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

4.1.3 Selecting Events for a Specific Driver . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

4.1.4 Identity Manager Log Levels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

4.2 User-Defined Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

4.2.1 Using Policy Builder to Generate Events. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

4.2.2 Using Status Documents to Generate Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

4.3 eDirectory Objects that Store Identity Manager Event Data. . . . . . . . . . . . . . . . . . . . . . . . . . . 25

5 Using Status Logs 27

5.1 Setting the Log Level and Maximum Log Size. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

5.1.1 Setting the Log Level and Log Size for the Driver Set . . . . . . . . . . . . . . . . . . . . . . . . 27

5.1.2 Setting the Log Level and Log Size for the Driver . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

5.2 Viewing Status Logs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

5.2.1 Accessing the Driver Set Status Log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

5.2.2 Accessing the Publisher Channel and Subscriber Channel Status Logs . . . . . . . . . 30

6 Securing the Connection with Novell Audit 31

6.1 Updating the Novell Audit Certificate Infrastructure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

6.2 The Novell Audit AudCGen Utility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

6.3 Creating a Root Certificate for the Secure Logging Server . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

6.3.1 Creating a Self-Signed Root Certificate for the Secure Logging Server . . . . . . . . . . 35

6.3.2 Using a Third-Party Root Certificate for the Secure Logging Server . . . . . . . . . . . . . 35

6.4 Creating Logging Application Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

6.4.1 Enabling the Identity Manager Instrumentation to Use a Custom Certificate . . . . . . 36

6.5 Validating Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

6Identity Manager 3.6 Integration Guide for Novell Audit

novdocx (en) 11 July 2008

6.6 Securing Custom Certificates. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

6.6.1 Windows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

6.6.2 Linux and Solaris . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

A Identity Manager Events 39

A.1 Event Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

A.2 Error and Warning Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

A.3 Job Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40

A.4 Remote Loader Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40

A.5 Object Events. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40

A.6 Password Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

A.7 Search List Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

A.8 Engine Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

A.9 Server Events. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

A.10 Security Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

A.11 Workflow Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

A.12 Driver Start and Stop Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

B Novell Audit Reports 43

B.1 Administrative Action Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

B.2 Historical Approval Flow Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

B.3 Resource Provisioning Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46

B.4 Specific User Audit Trail Report I . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48

B.5 Specific User Audit Trail Report II . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50

B.6 Specific User Audit Trail III. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52

B.7 Specific User Provisioning Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54

B.8 User Provisioning Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56

About This Guide 7

novdocx (en) 11 July 2008

About This Guide

Welcome to the Novell®Identity Manager Integration Guide for Novell Audit. This guide provides

the information necessary to integrate Novell Audit with Identity Manager to provide auditing and

reporting services for Identity Manager.

Chapter 1, “Overview,” on page 9

Chapter 2, “Installing and Configuring Novell Audit,” on page 11

Chapter 3, “Installing and Configuring the Platform Agent,” on page 13

Chapter 4, “Managing Identity Manager Events,” on page 17

Chapter 5, “Using Status Logs,” on page 27

Chapter 6, “Securing the Connection with Novell Audit,” on page 31

Appendix A, “Identity Manager Events,” on page 39

Appendix B, “Novell Audit Reports,” on page 43

Audience

This guide is intended for network administrators.

Feedback

We want to hear your comments and suggestions about this manual and the other documentation

included with this product. Please use the User Comments feature at the bottom of each page of the

online documentation, or go to www.novell.com/documentation/feedback.html and enter your

comments there.

Documentation Updates

For the most recent version of the Identity Manager 3.6 Integration Guide for Novell Audit, visit the

Identity Manager Documentation Web site (http://www.novell.com/documentation/idm36).

Additional Documentation

For the current Novell Audit documentation, see the Novell Audit Documentation Web site (http://

www.novell.com/documentation/novellaudit20/index.html).

Documentation Conventions

In Novell documentation, a greater-than symbol (>) is used to separate actions within a step and

items in a cross-reference path.

A trademark symbol (®, TM, etc.) denotes a Novell trademark. An asterisk (*) denotes a third-party

trademark.

When a single pathname can be written with a backslash for some platforms or a forward slash for

other platforms, the pathname is presented with a backslash. Users of platforms that require a

forward slash, such as Linux* or UNIX*, should use forward slashes as required by your software.

8Identity Manager 3.6 Integration Guide for Novell Audit

novdocx (en) 11 July 2008

Overview

novdocx (en) 11 July 2008

Overview

Adding Novell®Audit to you Identity Manager solution provides auditing and reporting services.

By adding auditing and reporting, you can demonstrate that the business policies are implemented as

designed with your Identity Manager solution.

1.1 Novell Audit Integrated Architecture

The following diagram illustrates the Identity Manager logging and reporting architecture when

integrated with Novell Audit.

Figure 1-1 Identity Manager and Novell Audit Integrated Architecture

1. An Identity Manager event occurs and it is sent to the Platform Agent. To capture all Identity

Manager events, the Platform Agent must be installed and configured on each Identity Manager

server.

2. (Conditional) If the Platform Agent cannot connect to the Secure Logging Server, the events

are stored in cache until the connection is reestablished.

3. The Platform Agents sends the event to the Secure Logging Server.

4. The Secure Logging Server sends the events to eDirectoryTM. Through iManager, you configure

the objects that store the events.

5. The Secure Logging Server sends the event to the data store, which stores the events. The data

store is a database that stores the events until they are needed.

The stored events are displayed through Novell Audit reports and iManager queries.

For more information about the Novell Audit architecture, see “System Architecture” in the Novell

Audit 2.0 Administration Guide.

eDirectory

Secure Logging

Server

Identity

Manager

Platform

Agent

Events

Cache

When disconnected

from the Secure

Logging Server

When reconnected

to the Secure

Logging Server

Configuration

data via

iManager

Novell Audit

Report

iManager

Queries

Crystal

Reports

Data Store

Port 289

10 Identity Manager 3.6 Integration Guide for Novell Audit

novdocx (en) 11 July 2008

Table des matières

Autres manuels Novell Logiciel

Novell

Novell GROUPWISE 8 - DOMAINS Manuel utilisateur

Novell

Novell PRIVILEGED USER MANAGER EVALUATION - Manuel utilisateur

Novell

Novell LINUX ENTERPRISE DESKTOP 11 - ADMINISTRATION GUIDE... Guide de référence rapide

Novell

Novell LINUX ENTERPRISE DESKTOP 10 - KDE 21-06-2006 Manuel utilisateur

Novell

Novell SENTINEL LOG MANAGER 1.0.0.4 - S Mode d’emploi

Novell

Novell GROUPWISE 7 - DISTRIBUTION LISTS Manuel utilisateur

Novell

Novell ZENWORKS APPLICATION VIRTUALIZATION - V8.0.3 INTEGRATION AND STREAMING... Manuel utilisateur

Novell

Novell ACCESS MANAGER 3.1 SP2 - README 2010 Manuel utilisateur

Novell

Novell SENTINEL 6.1 SP1 HOTFIX 2 - READ ME 9-2009 Manuel utilisateur

Novell

Novell LINUX ENTERPRISE SERVER 11 - VIRTUALIZATION Manuel utilisateur

Novell

Novell GROUPWISE 8 - MONITOR Manuel utilisateur

Novell

Novell DST - READ ME 03-2007 Manuel utilisateur

Novell

Novell ACCESS MANAGER 3.1 SP1 - ADMINISTRATION Manuel utilisateur

Novell

Novell GROUPWISE 7 ASYNC GATEWAY - INSTALLATION AND... Mode d’emploi

Novell

Novell SUSE LINUX ENTERPRISE SERVER 10 STORAGE Manuel utilisateur

Novell

Novell APPARMOR - AND Manuel technique

Novell

Novell ENHANCED SMART CARD METHOD 3.0.1 - INSTALLATION... Manuel utilisateur

Novell

Novell IFOLDER 3.6 - SECURITY ADMINISTRATION Manuel utilisateur

Novell

Novell GROUPWISE 8 - INTERNET AGENT Manuel utilisateur

Novell

Novell GROUPWISE 8 - MONITOR Manuel utilisateur

Novell

Novell LINUX ENTERPRISE SERVER 10 SP2 - STORAGE ADMINISTRATION GUIDE... Mode d’emploi

Novell

Novell GROUPWISE 8 - INTEROPERABILITY Manuel utilisateur

Novell

Novell LINUX ENTERPRISE SERVER 10 - STORAGE ADMINISTRATION GUIDE... Mode d’emploi

Novell

Novell LINUX ENTERPRISE DESKTOP 10 SP1 - GNOME... Manuel utilisateur

Manuels Logiciel populaires d'autres marques

COMPRO

COMPRO COMPROFM Manuel utilisateur

Muratec

Muratec OFFICEBRIDGE ONLINE Manuel utilisateur

Oracle

Oracle Contact Center Anywhere 8.1 Manuel utilisateur

Adobe

Adobe 65007312 - Photoshop Lightroom Manuel

Avaya

Avaya NULL One-X for RIM Blackberry Manuel utilisateur

HP ProLiant BL420c Manuel utilisateur

PS Audio

PS Audio PowerPlay Manuel du propriétaire

Brady

Brady LOCKOUT PRO 3.0 Manuel de service

Avaya

Avaya Interaction Center Manuel utilisateur

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Manuel

Oracle

Oracle Application 9i Manuel utilisateur

Acer

Acer RDM Manuel utilisateur

Canon

Canon Vixia HF21 Manuel utilisateur

Canon

Canon ZR950 Manuel utilisateur

Samsung

Samsung Auto Backup Manuel utilisateur

Polycom

Polycom Vortex EF2201 Instructions d'installation et d'utilisation

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Manuel utilisateur

Lexmark

Lexmark Apps Manuel de service