User manual NOVELL IDENTITY MANAGER ENTITLEMENTS SERVICE DRIVER 3.6.1 IMPLEMENTATION

[. . . ] novdocx (en) 17 September 2009 AUTHORIZED DOCUMENTATION Implementation Guide Novell® 3. 6. 1 June 05, 2009 Identity Manager Entitlements Service Driver www. novell. com Identity Manager 3. 6. 1 Driver for Role-Based Entitlements: Implementation Guide novdocx (en) 17 September 2009 Legal Notices Novell, Inc. makes no representations or warranties with respect to the contents or use of this documentation, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. reserves the right to revise this publication and to make changes to its content, at any time, without obligation to notify any person or entity of such revisions or changes. makes no representations or warranties with respect to any software, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. [. . . ] For detailed instructions, see Upgrading (http://www. novell. com/documentation/idm36/ idm_install/data/be1l4ik. html) in the Identity Manager 3. 6. 1 Installation Guide (http:// www. novell. com/documentation/idm36/idm_install/data/be1l0t1. html). Upgrading an Existing Driver 21 novdocx (en) 17 September 2009 22 Identity Manager 3. 6. 1 Driver for Role-Based Entitlements: Implementation Guide novdocx (en) 17 September 2009 5 Creating Entitlement Policies 5 The Entitlements Service driver implements entitlements through the use of entitlement policies. An entitlement policy contains the following: Membership: The list of users assigned to the policy. A user can be dynamically assigned to the policy when he or she meets the criteria for the policy, or the user can be statically (manually) assigned to the policy. Entitlements: The list of entitlements associated with the policy. Users assigned to the policy receive all of the entitlements associated with the policy. If the user is removed from the policy, he or she loses all entitlements associated with the policy. To create an entitlement policy: 1 In iManager, click to display the Identity Manager Administration page. 2 In the Feature list, click Role-Based Entitlements. 3 In the Select driver set field, click to browse for and select the driver set where you want to create the entitlement policy, then click OK to display the Entitlement Policy List. This list displays all entitlement policies that have been created for the driver set. If you are using Role-Based Entitlements for the first time, no policies are listed. 4 Click New to launch the Entitlement Policy Wizard. Creating Entitlement Policies 23 novdocx (en) 17 September 2009 5 On the Step 1 of 6: Name and describe the Entitlement Policy page, fill in the fields: Entitlement Policy Name: Provide a name that indicates the purpose of the entitlement. The name must be unique within the driver set and cannot include more than 64 characters. Description: Provide any additional information you want to identity the policy. 6 On the Step 2 of 6: Define Dynamic Membership page, fill in the fields: Dynamic membership lets you define which users should be members of the entitlement policy by specifying criteria and specifying where in the tree to search for users that meet the criteria. If a user meets the criteria you specify, the policy's entitlements are automatically applied to the user. If the user's information changes and no longer meets the criteria, the entitlements are revoked without any manual intervention. Search Identity: Specify an object that has the rights that you want to be used when querying for Dynamic Membership. This field defaults to the object you logged in as, but you can change it to an object with the appropriate rights. For example, if you log in as the administrator, there might be parts of the tree that you have rights to that you don't want included in the query for the dynamic list of members. You could use this field to specify the Driver Set object, making sure that the Driver Set has the appropriate rights. Or, you could create a User object specifically for use with Entitlement Policies, and assign it the rights you want the query to use. Begin Search at (Base DN): Specify the base container where you want the user search to begin. [. . . ] The Entitlements Service driver functions only against the Identity Vault and cannot use the Remote Loader. Therefore, the authentication settings do not apply. The only setting that applies to the Entitlements Service driver is the cache setting. Option Description Driver Cache Limit (kilobytes) or Cache limit (KB) Specify the maximum event cache file size (in KB). If it is set to zero, the file size is unlimited. [. . . ]