Sun Java logo     Previous      Contents      Next     

Sun logo
Sun Java[tm] System Identity Manager Quick Start Guide 

Chapter 4
Quick Start Scenario

This Quick Start Scenario provides a guided demonstration of some of Identity Manager’s most powerful features. The demonstration consists of three sections:

In addition, the following users are provided to illustrate how different people in an organization can use Identity Manager:

Basic Provisioning

This section provides instructions for

Creating Accounts on a Configured Server

You can create an account on the resource configured in the Setup Wizard by creating an Identity Manager user with the assigned resource, as follows:

  1. Open a Web browser and type the following address into the address bar:

    2. http://localhost:8080/idm/

    Note

    Depending on the options that you selected during the Tomcat installation, the port may be different.

  2. Login to the Identity Manager Administrator interface as the Configurator user. The default password for this user is configurator.
  3. Click the Accounts tab to navigate to the Accounts page.
  4. Select New User from the New Actions menu to create a new user.
  5. Enter the following information on the Identity tab:
    • Account ID
    • First name
    • Last name
    • Email address
    • Password

      • Note

      The password must conform to the Password Policy described in the “Resource account whose password will be changed” table. You can modify this password policy to match your corporate standards by navigating to
      Security > Policies and clicking Password Policy.

  6. In the Individual Resource Assignment field on the Assignments tab, select the resource that you configured in the Setup Wizard.
  7. Optionally enter any additional information about the resource account on the Attributes tab.
  8. Click Save.

    9. The Create User Results should show that a Lighthouse user was created (this is the virtual user in Identity Manager) and that an account was created on the resource. You can use native tools on the resource to verify that the account was actually created.

  9. Click OK at the bottom of the Results page.

    10. The user that you just created should display on the List Accounts page.

Configuring Identity Manager to Send Email Notifications

Use the following steps to configure Identity Manager to send email notifications when new users are created:

  1. Select the Server Tasks > Configure Tasks tabs to access the Task Configuration page.
  2. Click Create User Template to edit properties for the workflow that runs when a user is created in Identity Manager.
  3. Select the Notification tab.
  4. Select Administrator List for the Determine Notification Recipients from field.
  5. Select demoapprover from the Administrators to Notify field.

    6. This is the demoapprover user that was created in the Setup Wizard. When you select this user, Identity Manager will send email to the email address that you specified in the Setup Wizard when new users are created in Identity Manager.

  6. Select Account Creation Notification as the for the Email Template field.
  7. Click Save.
  8. Repeat steps 4–11 from the Creating Accounts on a Configured Server section to create a new user.
    • If you configured an SMTP server in the Setup Wizard, Identity Manager will send an email to the demoapprover.
    • If you configured a notification file in the Setup Wizard, you can open the notification file in a text editor to see the email that would have been sent.

      • Identity Manager uses a process diagram to illustrate the steps that are executed by the workflow when creating, updating, or deleting a user. If user interaction is required during a workflow (such as an approval) the process diagram shows which workflow steps have run and which steps will run after the required interaction is completed.

      Figure 4-1  Example Process Diagram
      Example Identity Manager Process Diagram

For more information about workflows, and an illustrated example of altering the approval workflow, see Sun Java™ System Identity Manager Workflows, Forms, and Views.

Note

You can also

  • Configure notifications for user updates and deletes.
    Repeat the preceding steps 1–7, being sure to select the appropriate email template (Update User Template or Delete User Template) for step 2.
  • Enable the Notify User checkbox on the Notification tab to send an email to the end user who is being created, updated, or deleted.
  • Use an Attribute, a Query on the resource, or a Rule to determine additional notification recipients.

Configuring Identity Manager to Approve Account Creations

When you add a user to the Identity Manager system, administrators who are assigned as approvers for new accounts must validate the account creation. Identity Manager supports four categories of approvals, applied to these Identity Manager objects:

For this scenario, you will require the demoapprover administrator to approve an account creation, as follows:

  1. Select the Server Tasks > Configure Tasks tabs to access the Task Configuration page.
  2. Click Create User Template to edit properties for the workflow that is run when a user is created in Identity Manager.
  3. Select the Approvals tab.
  4. Select Administrator List for the Determine additional approvers from field.
  5. Select demoapprover for the Approval Administrator field.
  6. Enable all checkboxes in the Editable column of the Approval Attributes table to allow the approver to modify these attributes when approving user creations.
  7. Click Save.
  8. Repeat steps 4-11 in the Creating Accounts on a Configured Server section to create a new user.

    9. Notice that the Create User Results page states that the creation is pending an approval from demoapprover. If you view the List Accounts page, the new user will not yet appear.

    • If you configured an SMTP server in the Setup Wizard, Identity Manager will send an email to the demoapprover to notify the administrator that an account creation approval has been requested.
    • If you configured a notification file in the Setup Wizard, you can open the notification file in a text editor to view the email that would have been sent.
  9. Click Logout to log Configurator out of Identity Manager.
  10. When the Login page displays, log in as demoapprover and use the password that you specified in the Setup Wizard.

    11. Notice that there are only three tabs in Identity Manager when you are logged in as demoapprover – Home, Passwords, and Work Items.

    Identity Manager only displays tabs and sub-tabs for pages that the logged in user can use. Because demoapprover only has the Approver capability, these three tabs are the only pages that are available.

  11. Select the Work Items tab to view the Awaiting Approvals page.

    12. Note

    The process diagram (described in Configuring Identity Manager to Send Email Notifications) is stalled at this point, awaiting an approval.

  12. Click the approval link in the table, and then click the approval.
  13. If necessary, you can change user attributes or add comments about the approval.

    14. Note

    You can forward an approval to a different user by selecting that Identity Manager user’s name in the Forward to list.

  14. Click Approve to approve the account creation request.
  15. Logout demoapprover and log back in as Configurator.
  16. Click the Accounts tab to verify that the new user was created after the approval. Also, demoapprover should receive an email notification that the account was created.

    17. Note

    • You can also configure approvals for user updates and deletes. Repeat the preceding steps 1–7, being sure to select the appropriate email template (Update User Template or Delete User Template) for step 2.
    • Use the Approval times out after option to specify what happens if an approval has not been accepted or rejected within a certain time period. You can reject the request, escalate the approval to a different approver, or run a custom task (such as send email to another administrator).

End User Self-Service

The End User Self-Service section demonstrates how end users can use Identity Manager to login with authentication questions when they forget their password, change their password on all resource accounts, and change their personal data.

In this section you are assuming the role of an end user and performing the following tasks:

Changing Your Authentication Questions’ Answers

To change the answers to your authentication questions:

  1. To view the login page for the end user interface, open a Web browser and type the following address into the address bar:

    2. http://localhost:8080/idm/user/login.jsp

    Note

    Depending on the options that you selected for the Tomcat installation, the port may be different than 8080.

  2. Enter the User ID and Password of a user that you created in the Basic Provisioning section.
  3. Click Authentication Questions, and then click the Profiles tab.
  4. Enter an answer for the displayed question.

    5. Note

    You can configure the list of authentication questions and question policy from the administrator interface. Log in as Configurator, select Configure > Policies, and click Default Lighthouse Account Policy.

  5. Click Save to save the new answer to your question.
  6. Click Logout.

Changing Your Password

To change your password:

  1. Enter the same User ID that you entered in step 2 of the previous section, but leave the Password blank.
  2. Click Forgot Your Password?.
  3. Enter the same answer that you provided in step 4 of the previous section.
  4. Click Login.

    5. Because the login occurred with a forgotten password, you are prompted for a new password.

  5. Enter a new password.

    6. Notice that the new password will be set on the Lighthouse account (the Identity Manager user) and on the account on the configured resource.

  6. Click Change Password.

Changing Your Personal Data

To change your personal data:

  1. Click the Profiles tab, and then click the Account Attributes tab.
  2. Modify the email address.
  3. Click Save.

    4. Notice that the email address has been updated for the Lighthouse user and possibly the resource account if the resource manages an email address.

  4. Click Logout to logout of the end-user pages.

Advanced Features

This Advanced Features section demonstrates

Loading Users into Identity Manager

One of the first steps you perform for an Identity Manager deployment is to load all accounts from the managed resource into Identity Manager so they can be managed. Generally, most deployments manage multiple resources; however, for the purposes of this quick start scenario, only a single resource will be managed.

  1. Select the Resources tab to access the List Resources page.
  2. Expand the resource tree to find the resource that you configured in the Setup Wizard.
  3. Enable the resource’s checkbox to select the resource.
  4. Select Edit Reconciliation Policy from the Resource Actions list to define how accounts found on the resource will be reconciled with the users found in Identity Manager.

    5. Initially, Identity Manager will have only a few administrators (Configurator, Administrator, demoapprover) and the users that you created in the Basic Provisioning section.

    All other users on the managed resource will be considered UNMATCHED when reconciled because there are no Identity Manager users that match the resource accounts that are found.

  5. Select Create new user based on resource account for the UNMATCHED situation in the Situation Options table.

    6. The remaining situation options are used to determine how Identity Manager responds to other reconciliation situations. For this Quick Start Scenario, do not change the default values for these options.

  6. Click Save to save the reconciliation policy.
  7. Enable the resource’s checkbox.
  8. Select Full Reconcile Now from the Resource Actions list to initiate a full reconciliation from the resource.
  9. Enable the resource’s checkbox.
  10. Select View Reconciliation Status from the Resource Actions list to view the status of the full reconciliation.

    11. The time it takes to complete a full reconciliation can vary widely, based on the number of users on the managed resource, the speed of the managed resource, the speed of the Identity Manager server, and so forth.

  11. When the reconciliation is complete, review the information provided to see how many accounts were created.
  12. Select the Accounts tab to navigate to the List Accounts page.

    13. Notice that all users from the resource are now listed on this page.

Detecting Changes on the Managed Server

Identity Manager accommodates bidirectional synchronization, depending on target resource functions and market need.

For the purpose of this Scenario, you will use reconciliation to detect changes on a managed server. Use the following instructions:

  1. Natively create a new user on the managed resource.

    2. The method for creating a new user will vary depending on the resource.

    • You can create a new user with the Active Directory Users and Computers tool in Active Directory
    • You can import an LDIF file in a Directory Server
    • You can use the useradd command on a Red Hat Linux or Solaris server
  2. Select the Resources tab to access the List Resources page.
  3. Expand the resource tree to find the resource that you configured in the Setup Wizard.
  4. Enable the resource’s checkbox to select the resource.
  5. Select Incremental Reconcile Now from the Resource Actions list to initiate an incremental reconciliation from the resource.
  6. Enable the resource’s checkbox.
  7. Select View Reconciliation Status from the Resource Actions list to view the status of the incremental reconciliation.
  8. After the reconciliation is complete, review the information to see how many accounts were created.
  9. Select the Accounts tab to access the List Accounts page.

    10. Notice that the new user you created on the resource is now listed on this page.

Viewing the Historical User’s Change Report

To view a user’s change report history:

  1. Open a Web browser and type the following Web address in the address bar:

    2. http://localhost:8080/idm/

    Note

    Depending on the options that you selected during the Tomcat installation, the port (8080) may be different.

  2. Login to the Identity Manager Administrator interface as the Configurator user.

    3. Note

    The default password for this user is configurator.

  3. Select the Reports tab to access the Run Reports page.
  4. Click the Historical User Changes Report link to provide information about which report to run.
  5. Enter the Account ID of the user specified in the End User Self-Service section.
  6. Click Run.
  7. Review the historical change report.

    8. Notice that events such as creation, modifications, change password, login, and logout are reported. The report provides information about when the change occurred, which user caused the change, the result of the change, attribute-level before and after values for creations and modifications, which interface the change occurred in, and so forth.

  8. You can run this report for all users by clicking the Run button located next to the User Historical Change Report on the Run Reports page.

Next Steps

There are many other important features in Identity Manager that are not discussed in this Quick Start Guide, such as:

For more information about these and other Identity Manager features, consult the Identity Manager publications listed in the Related Documentation and Help section of the Preface.

To contact a Sales representative for more information about the Identity Manager product, get information about self-qualifying, or sign-up for the Identity Champions newsletter be sure to visit the following web site and select the Sun Identity Insights Program checkbox:

https://subscriptions.sun.com/subscription_center/ecomm.jsp



Previous      Contents      Next     

Part No: 819-7564-10.   Copyright 2006 Sun Microsystems, Inc. All rights reserved.