Novell IDENTITY MANAGER 3.6.1 User manual

Novell®

www.novell.com

novdocx (en) 13 May 2009

AUTHORIZED DOCUMENTATION

Identity Manager 3.6 Security Guide

Identity Manager

3.6.1

June 05, 2009

Security Guide

novdocx (en) 13 May 2009

Legal Notices

Novell, Inc. makes no representations or warranties with respect to the contents or use of this documentation, and

specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose.

Further, Novell, Inc. reserves the right to revise this publication and to make changes to its content, at any time,

without obligation to notify any person or entity of such revisions or changes.

Further, Novell, Inc. makes no representations or warranties with respect to any software, and specifically disclaims

any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc.

reserves the right to make changes to any and all parts of Novell software, at any time, without any obligation to

notify any person or entity of such changes.

Any products or technical information provided under this Agreement may be subject to U.S. export controls and the

trade laws of other countries. You agree to comply with all export control regulations and to obtain any required

licenses or classification to export, re-export, or import deliverables. You agree not to export or re-export to entities

on the current U.S. export exclusion lists or to any embargoed or terrorist countries as specified in the U.S. export

laws. You agree to not use deliverables for prohibited nuclear, missile, or chemical biological weaponry end uses.

Please refer to the International Trade Services (http://www.novell.com/company/policies/trade_services) for more

information on exporting Novell software. Novell assumes no responsibility for your failure to obtain any necessary

export approvals.

stored on a retrieval system, or transmitted without the express written consent of the publisher.

Novell, Inc. has intellectual property rights relating to technology embodied in the product that is described in this

document. In particular, and without limitation, these intellectual property rights may include one or more of the U.S.

patents listed on the Novell Legal Patents Web page (http://www.novell.com/company/legal/patents/) and one or

more additional patents or pending patent applications in the U.S. and in other countries.

Novell, Inc.

404 Wyman Street, Suite 500

Waltham, MA 02451

U.S.A.

www.novell.com

Online Documentation: To access the latest online documentation for this and other Novell products, see

the Novell Documentation Web page (http://www.novell.com/documentation).

novdocx (en) 13 May 2009

Novell Trademarks

For Novell trademarks, see the Novell Trademark and Service Mark list (http://www.novell.com/company/legal/

trademarks/tmlist.html).

Third-Party Materials

All third-party trademarks are the property of their respective owners.

4Identity Manager 3.6 Security Guide

novdocx (en) 13 May 2009

Contents 5

Contents

novdocx (en) 13 May 2009

About This Guide 7

1 Security Best Practices 9

1.1 Using SSL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

1.2 Securing Directory Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

1.2.1 Granting Task-Based Access to Drivers and Driver Sets . . . . . . . . . . . . . . . . . . . . . 10

1.3 Managing Passwords . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

1.4 Creating Strong Password Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

1.5 Securing Connected Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

1.5.1 Password Generation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

1.6 Designer for Identity Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

1.7 Industry Best Practices for Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

1.8 Tracking Changes to Sensitive Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

1.8.1 Using iManager to Log Events. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

1.8.2 Using Designer to Log Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

6Identity Manager 3.6 Security Guide

novdocx (en) 13 May 2009

About This Guide 7

novdocx (en) 13 May 2009

About This Guide

This guide contains information about security best practices you might want to implement in your

Identity Manager environment. The guide is organized as follows:

Chapter 1, “Security Best Practices,” on page 9

Audience

This guide is intended for administrators, consultants, and network engineers who require a high-

level introduction to Identity Manager business solutions, technologies, and tools.

Documentation Updates

For the most recent version of this document, see the Identity Manager Documentation Web site

(http://www.novell.com/documentation/idm36/index.html).

Additional Documentation

For documentation on other Identity Manager drivers, see the Identity Manager Drivers Web site

(http://www.novell.com/documentation/idm36drivers/index.html).

Documentation Conventions

In Novell®documentation, a greater-than symbol (>) is used to separate actions within a step and

items in a cross-reference path.

A trademark symbol (®, TM, etc.) denotes a Novell trademark. An asterisk (*) denotes a third-party

trademark.

When a single pathname can be written with a backslash for some platforms or a forward slash for

other platforms, the pathname is presented with a backslash. Users of platforms that require a

forward slash, such as Linux* or UNIX*, should use forward slashes as required by your software.

8Identity Manager 3.6 Security Guide

novdocx (en) 13 May 2009

Security Best Practices

novdocx (en) 13 May 2009

Security Best Practices

The following sections provide information you should consider as you secure your Identity

Manager system:

Section 1.1, “Using SSL,” on page 9

Section 1.2, “Securing Directory Access,” on page 9

Section 1.3, “Managing Passwords,” on page 11

Section 1.4, “Creating Strong Password Policies,” on page 12

Section 1.5, “Securing Connected Systems,” on page 13

Section 1.7, “Industry Best Practices for Security,” on page 14

Section 1.8, “Tracking Changes to Sensitive Information,” on page 15

1.1 Using SSL

Enable SSL for all transports, where it is available. Enable SSL for communication between the

Metadirectory engine and Remote Loader and between the Metadirectory engine or Remote Loader

and the connected systems. For information, see “Creating a Secure Connection” in the Identity

Manager 3.6.1 Remote Loader Guide.

If you don't enable SSL, you are sending sensitive information such as passwords in the clear.

1.2 Securing Directory Access

Make sure that you secure access to Identity Vaults and to Identity Manager objects.

Physical Security: Protect access to the physical location of the servers where an Identity Vault is

installed.

File System Access: The security of the file system for Identity Manager is critical to ensuring the

security of the system as a whole. Verify that the directories containing eDirectoryTM, the

Metadirectory engine, and the Remote Loader are accessible only to the appropriate administrators.

There is an issue with the file system when the Remote Loader is installed on a Windows* 2000

server. For more information, see TID 3243550, Securing a Remote Loader Install on a Microsoft

Windows 2000 Server (http://www.novell.com/support/

search.do?cmd=displayKC&docType=kc&externalId=3243550&sliceId=SAL_Public&dialogID=4

7824778&stateId=0%200%2047832401).

Access Rights: Identity Manager requires Administrative rights to create Identity Manager objects

and configure drivers. Monitor and control who has rights to create or modify the following:

An Identity Manager driver set

An Identity Manager driver

10 Identity Manager 3.6 Security Guide

novdocx (en) 13 May 2009

Driver configuration objects (filters, style sheets, policies), especially policies that are used for

password retrieval or synchronization

Password policy objects (and the iManager task for editing them), because they control which

passwords are synchronized to each other, and which Password Self-Service options are used

1.2.1 Granting Task-Based Access to Drivers and Driver Sets

In addition to the eDirectory standard object-based access controls, Identity Manager lets you assign

trustee rights to perform only certain tasks on an Identity Manager driver, rather than just granting

full Supervisor rights to the driver object. For example, you can assign trustee rights so that one user

can only configure the driver object (create and modify object properties), while another user can

only start and stop the driver.

Identity Manager provides the following driver object attributes that enable role-based access:

Setting trustee rights to these attributes grants access to the associated Identity Manager verbs and

sub-verbs. Read access lets users view state (get verb state), and Write access lets users modify or

change state (set verb state.) For example, granting Read access to a driver object’s DirXML-

AccessRun attribute lets the user get the driver state (started or stopped.) Granting Write access lets

the user set the driver state (change from started to stopped, or vice versa.)

The goal of providing this attribute-based access to driver tasks is to let you create well-defined

administrative roles, perhaps using the eDirectory Administrative Role object, that let users perform

certain management tasks without exposing all management functionality. Creating these roles can

go beyond providing access to the DirXML-Access attributes described above and can include

access rights to other attributes, as well as access to other Identity Manager objects. The following

examples demonstrate the flexibility available for creating administrative roles:

Start/Stop Driver Admin: This administrative role lets the assigned user start and stop all drivers

in a given driver set. It requires the following access rights:

Browse rights to the Driver Set object

Read and Write access, with inheritance, to the DirXML-AccessRun attribute of the Driver Set

object

Driver Admin: This administrative role lets the assigned user manage a single Driver object. It

requires the following access rights:

Browse and Create rights to the Driver object

Attribute Description

DirXML-AccessRun Start and stop Identity Manager drivers and jobs

DirXML-AccessMigrate Manage migration operations into the Identity Vault

DirXML-AccessSubmitCommand Manage the driver’s pass-through commands

DirXML-AccessCheckObjectPassword Manage the driver’s check object password

commands

DirXML-AccessConfigure Manage the driver’s configuration and job

configuration

DirXML-AccessManage View and modify the driver’s cache file contents

Other manuals for IDENTITY MANAGER 3.6.1

This manual suits for next models

Table of contents

Other Novell Software manuals

Novell

Novell LINUX ENTERPRISE DESKTOP 11 - ADMINISTRATION GUIDE... Instruction Manual

Novell

Novell OPEN ENTERPRISE SERVER 2.0 SP2 - DOMAIN SERVICE FOR... Instruction Manual

Novell

Novell APPARMOR 2.0 Instruction Manual

Novell

Novell ZENWORKS APPLICATION VIRTUALIZATION 8.0.2 - INTEGRATION AND STREAMING GUIDE... User manual

Novell

Novell SUSE LINUX ENTERPRISE SERVER 10 STORAGE User manual

Novell

Novell PLATESPIN ORCHESTRATE 2.0.2 - UPGARDE GUIDE... Installation and operation manual

Novell

Novell ZENWORKS APPLICATION VIRTUALIZATION 8.0 -... User manual

Novell

Novell LINUX ENTERPRISE SERVER 10 SP3 -... Manual

Novell

Novell IDENTITY MANAGER 3.6.1 - UNDERSTANDING POLICIES... User manual

Novell

Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - COMMAND LINE UTILITIES REFERENCE 10.3... User manual

Novell

Novell APPARMOR 2.0.1 - ADMINISTRATION GUIDE... Instruction Manual

Novell

Novell SUSE LINUX ENTERPRISE DESKTOP 11 SP1 - 8-18-2010 VIRTUALIZATION WITH... User manual

Novell

Novell APPARMOR - AND Manual

Novell

Novell LINUX ENTERPRISE DESKTOP 10 SP1 - GNOME... User manual

Novell

Novell OPEN ENTERPRISE SERVER 2 SP2 - PLANING AND IMPLEMENTATION GUIDE... User manual

Novell

Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - COMMAND LINE UTILITIES REFERENCE 10.3... Quick reference guide

Novell

Novell GROUPWISE 8 - MONITOR User manual

Novell

Novell EDIRECTORY 8.8 SP1 User manual

Novell

Novell IDENTITY MANAGER 3.6.1 - PASSWORD MANAGEMENT User manual

Novell

Novell LINUX ENTERPRISE 11 SP1 - LINUX AUDIT User manual

Novell

Novell LINUX ENTERPRISE SERVER 11 - STORAGE ADMINISTRATION GUIDE... Instruction Manual

Novell

Novell GROUPWISE 7 - SECURITY POLICIES Instruction Manual

Novell

Novell ACCESS MANAGER 3.1 SP1 - ADMINISTRATION User manual

Novell

Novell GROUPWISE 7 - SECURITY POLICIES User manual

Popular Software manuals by other brands

COMPRO

COMPRO COMPROFM manual

Muratec

Muratec OFFICEBRIDGE ONLINE user guide

Oracle

Oracle Contact Center Anywhere 8.1 installation guide

Adobe

Adobe 65007312 - Photoshop Lightroom Programmer's guide

Avaya

Avaya NULL One-X for RIM Blackberry user guide

HP ProLiant BL420c user guide

PS Audio

PS Audio PowerPlay Programming manual

Brady

Brady LOCKOUT PRO 3.0 Administrator's guide

Avaya

Avaya Interaction Center user guide

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Guide book

Oracle

Oracle Application 9i Configuration guide

Acer

Acer RDM user guide

Canon

Canon Vixia HF21 instruction manual

Canon

Canon ZR950 instruction manual

Samsung

Samsung Auto Backup user manual

Polycom

Polycom Vortex EF2201 Application note

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c user manual

Lexmark

Lexmark Apps Administrator's guide