This session will cover the basics of Identity Manager Permission model including Resources and Entitlements. Learn the challenges and benefits of on-boarding Permissions from various authoritative sources to the Identity Manager Catalog in the Entitlement-Resource-Role format. Learn more about Permission Collection and Reconciliation Service (PCRS). Permission Collection and Reconciliation Service satisfies two fold objective - first it enables entitlements for all the Identity Manager Drivers and secondly on-board/reconcile permissions from the application to the Identity Manager Catalog.

1. Permission Collection and
Reconciliation Service (PCRS)
November 2014
Kamal Narayan
Senior Product Manager
nkamal@netiq.com
Rajiv Kumar
Associate Senior Specialist
krajiv@netiq.com
#BrainShare #NetIQ7130

2. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.2
Agenda
• Entitlements and Resources
• Current limitations
• PCRS
• PCRS components
• PCRS flow
• Troubleshooting tips

3. Entitlements and Resources

4. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.4
Entitlements
Model application permission
IDM Drivers have sample entitlements
Primarily managed by Designer
Sample entitlements may not be readily useful (AD vs JDBC)
Often application integration requires creating entitlements
Primarily used on subscriber channel with IDV as the source of truth
No out of the box solution for onboarding application assignments

5. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.5
Resources
Introduced during RBPM 3.7
Abstraction layer between driver entitlements and Roles.
Curatable, thus people friendly names unlike entitlements, approval workflow
Enables granular assignment status
Management via Designer/UserApplication interface
Bound to one entitlement only, static & dynamic assignments
No out of the box solution for onboarding application assignment

6. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.6
Resource model

7. Current limitations

8. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.8
Current Limitations
• Application on boarding requires custom
implementation to on-board existing permission
assignments
• Assignment state may quickly get out of sync unless
all permission changes are done from IDM
• Catalogue does not reflect the actual state
• Creating new entitlements is tedious

9. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.9
Current limitations
• Requires changes in multiple locations : resource
objects/policies
• Multiple tools/steps required to create a resource
associated with an entitlement
• Resource/Entitlement assignments are uni-
directional(subscriber only)

10. PCRS

11. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.11
PCRS – What's new
• Easily create new Entitlements
• Seamless out of the box support for implementing
resource model for IDM drivers
• On-board application permissions and assignments
• Update assignment status changes on both channels
(publisher & subscriber)
• Simplified and quicker application integration
• Comprehensive permission catalogue
• Catalogue shows the actual state
• A common package for use with custom drivers

12. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.12
PCRS - Overview

13. PCRS components

14. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.14
PCRS components
Engine
changes
Administrative
accounts
Dynamic and
Static
Resources
Packages Job
Access
Control List
GCV Controls

15. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.15
PCRS components
Engine
changes
Administrative
accounts
Dynamic and
Static
Resources
Packages Job
Access
Control List
GCV Controls

16. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.16
Engine changes
Startup/Shutdown policy containers
• Two new policy containers
• Startup container has policies for performing
initialization tasks
• All run-once policies required at startup can be added
here
• Policies are executed after driver start by the engine.
• Shutdown container can have policies for performing
finalization tasks
• Polcies to save state/info that may be needed at driver
shutdown
• Policies are executed before stopping the driver.

17. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.17
Engine changes
Startup/Shutdown policy containers

18. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.18
Engine changes
Startup/Shutdown policy containers - Benefits
• Cleaner implementation, easier to debug
• No need to perform checks in content to verify if the
driver is up before executing initialization policies
• Run-once policies are outside of normal event-flow
containers, reduced tracing
• Shutdown tasks can be performed, which is not
possible otherwise.

19. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.19
Engine changes
Resource management API's
xmlns:ps=“http://www.novell.com/nxsl/java/com.netiq.resources.ProvisioningSchedu
ler”
// Provisions users to IDM resources in RBPM and reconciles the permissions of
// the user.
String ReconcilePermissions(String uaUrl, String uaUser, String uaPwd, String
recipient, int delay, String payload, boolean debugOn)
// Performs CodeMap Refresh of the Group Entitlement in RBPM
String RefreshCodeMapforGroupEntitlement(String uaUrl, String uaUser, String
uaPwd, String recipient, int delay, String payload, boolean debugOn)
// Reconciles resource assignments for groups in RBPM
String ReconcileGroupMemberPermissions(String uaUrl, String uaUser, String
uaPwd, String group, int delay, String payload, boolean debugOn)
// Check timestamp and allow grant or revoke if current timestamp is greater
// than or equal to that of the last update in the nrfResource history.
String AllowEntitlementGrantOrRevoke(String uaUser, String recvdEntTimeStamp,
String historyPayload, boolean debugOn)

20. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.20
PCRS components
Engine
changes
Administrative
accounts
Dynamic and
Static
Resources
Packages Job
Access
Control List
GCV Controls

21. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.21
Administrative accounts
• Following administrative accounts are used
– IDV Administrator
– PCRS Administrator
• Password Policy should be assigned to both the
admin users.
• Distribution password for these users are utilized for
creating/updating various objects

22. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.22
Administrative accounts
Password policy assignment

23. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.23
Administrative Accounts
IDV administrator/PCRS Administrator - Tasks
IDV administrator
Job execution
PCRS Administrator
Resource creation
Code-map refresh
Cache flush
Assign/revoke resources
Queries to user app

24. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.24
PCRS components
Engine
changes
Administrative
accounts
Dynamic and
Static
Resources
Packages Job
Access
Control List
GCV Controls

25. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.25
Resources
Dynamic
• Default Configuration – resources created by PCRS
have dynamic values
• Requires creating fewer resources
• Simplifies resource management
• Easy to add/remove values instead of
creating/deleting resources.

26. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.26
Resources
Static
• Access to some resources/permissions may need to
be tightly controlled for e.g. financial, business, etc.
• Manually configured
• Catalog administrator can be used for creating static
resources.
• Existing static resources may be added to the
StaticValueEntitlementMap

27. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.27
PCRS components
Engine
changes
Administrative
accounts
Dynamic and
Static
Resources
Packages Job
Access
Control List
GCV Controls

28. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.28
Packages
Driverset
• New driverset package(NOVLACOMSET) introduced
to specify
– User application URL
– Administrative user for performing PCRS actions

29. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.29
Packages
Driverset - screenshot

30. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.30
Packages
Driver
Specialized
package
Active Directory Entitlements
and Exchange Mailbox Support
Package
LDAP Entitlements Package
Delimited Text Entitlements
Package
Loopback Entitlements Package
Common
package
Permission Collection and
Reconciliation Service
Package
[Validated for SOAP driver]

31. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.31
Packages
Driver
• Common Package - NOVLCOMPCRS

32. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.32
Packages
Mapping Table - PermissionNameToFile
• Contains entitlement configuration data specified
during package installation in designer.

33. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.33
Driver objects
Post deployment

34. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.34
Driver objects
Post driver start

35. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.35
Packages
Mapping Table - PermissionEntMapping
• Contains mapping of entitlement and the respective
resource objects.
• Mapping table is empty at deploy time.

36. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.36
Packages
Mapping Table – PermissionEntMapping
• The specified entitlement is created by the driver
startup policies.

37. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.37
Packages
Entitlement object

38. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.38
Packages
Mapping Table - PermissionEntMapping
• The resource object is created by the Job object.

39. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.39
Packages
Mapping Table - StaticValueEntitlementMap
• Contains configuration data for static valued resources
• Mapping table is empty at deploy time.
• Manually populated
• Used for granular control.

40. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.40
Packages
Mapping Table - <Entitlement>_Values
• Contains values for an entitlement if values are
specified by a csv file
#
#CSV File containing entitlement values
#
Building A, Engineering, The engineering building
Building B, Accounting, The accounting building
Building C, Facilities, The facilities building
Building D, Warehouse, The warehouse

41. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.41
Packages
Mapping Table - <Entitlement>_Values
• Created by startup policies to store the entitlement
values.

42. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.42
Packages
Mapping Table - <Entitlement>_Values
• Contains entitlement values read from csv file
providing the entitlement values.

43. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.43
PCRS components
Engine
changes
Administrative
accounts
Dynamic and
Static
Resources
Packages Job
Access
Control List
GCV Controls

44. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.44
Job
Permission onboarding
• IDM Job object.
• Configured during driver start-up.
• Admin user account and password automatically
configured by the start-up policies.
• Not scheduled by default
• Executed during driver startup – invoked by startup
policies
Requires appropriate rights on PCRS objects

45. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.45
Job
Permission Onboarding - Tasks
• Reading CSV files containing Entitlement
Values and populating <name>_Values objects
• Creating a Dynamic Resource for assigning
Entitlement Values to Users
• Populating PermissionEntMapping object with
the Resource DN
• Triggering RBPM code-map refresh to
recognize the new entitlements and values

46. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.46
Job
Permission onboarding

47. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.47
PCRS components
Engine
changes
Administrative
accounts
Dynamic and
Static
Resources
Packages Job
Access
Control List
GCV Controls

48. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.48
Access Control List
PCRS Objects
Permission
Onboarding Job
[Trustee]
[Entry Rights] →
Browse
[All Attributes] →
Supervisor
PermissionEntMapping
<ENTITLEMENT>_Valu
es
<ENTITLEMENT>

49. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.49
PCRS components
Engine
changes
Administrative
accounts
Dynamic and
Static
Resources
Packages Job
Access
Control List
GCV Controls

50. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.50
GCV controls
• PCRS package – reconcile all entitlements
• PCRS package – reconcile select entitlement

51. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.51
GCV controls
• Specialized PCRS entitlement package

52. PCRS flow

53. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.53
Publisher Channel update

54. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.54
Subscriber channel
Attribute assignment

55. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.55
Subscriber channel
RBPM assignment

56. Troubleshooting tips

57. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.57
Troubleshooting tips
• Use the PCRS admin user for PCRS automation only
– Do not perform any modification from the
UserApplication/Aqua UI using this user
– Changes performed by the PCRS admin are vetoed out by the
policy as a part of loopback detection.
• The entitlement attribute name in the entitlement-to-
file mapping table should be in Identity manager
namespace.

58. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.58
Troubleshooting tips
• Job does not executes at driver startup
– Verify that password policies are enabled and the Identity
vault administrator has an assignment.
– Check Identity vault administrator’s password has been set
after enabling the password policy.
• Resource assignment not working
– Check the status of the “User Application” and “Role and
Resource” service drivers. The drivers should be in running
state.

59. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.59
Troubleshooting tips
• Permission on boarding job does not update the
catalogue for assignment changes
– Verify that password policy is enabled and the PCRS
administrator has an assignment.
– Verify that the correct connection values are provided in the
driverset advanced common settings package.
– Verify that the PCRS administrator has resource management
rights.
Is Permission Collection and Reconciliation GCV Enabled ?

60. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.60
Troubleshooting tips
• Steps to clean-up PCRS objects and resources
– Stop the driver
– Using User Application UI, delete all the resources specified in
the “PermissionEntMapping” mapping table under the
“resourceDn” column
– Delete all the “<entitlement>_values” objects under the driver
objects
– Delete the entitlements specified in the “entitlementDn”
column of the “PermissionEntMapping” mapping table
– Delete the entries of the “PermissionEntMapping” mapping
table

61. © 2014 NetIQ Corporation. All rights reserved.61
Thank you.
Don’t miss the Identity-Powered
Experience in IT Central.

62. © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.62
+1 713.548.1700 (Worldwide)
888.323.6768 (Toll-free)
info@netiq.com
NetIQ.com
Worldwide Headquarters
515 Post Oak Blvd.,
Suite 1200
Houston, TX 77027 USA
www.netiq.com/communities

63. This document could include technical inaccuracies or typographical errors. Changes are
periodically made to the information herein. These changes may be incorporated in new
editions of this document. NetIQ Corporation may make improvements in or changes to the
software described in this document at any time.
Copyright © 2014 NetIQ Corporation and its affiliates. All Rights Reserved.
ActiveAudit, ActiveView, Aegis, AppManager, Change Administrator, Change Guardian, Compliance Suite, the
cube logo design, Directory and Resource Administrator, Directory Security Administrator, Domain Migration
Administrator, Exchange Administrator, File Security Administrator, Group Policy Administrator, Group Policy
Guardian, Group Policy Suite, IntelliPolicy, Knowledge Scripts, NetConnect, NetIQ, the NetIQ logo, PSAudit,
PSDetect, PSPasswordManager, PSSecure, Secure Configuration Manager, Security Administration Suite,
Security Manager, Server Consolidator, VigilEnt, and Vivinet are trademarks or registered trademarks of NetIQ
Corporation or its subsidiaries in the United States.