Novell Doc: Identity Manager 3.6 ID Provider Driver Implementation Guide

3.1 Creating the Driver

You can run the driver as a native Java module or as an Identity Manager driver on any supported platform.

You can create the driver through Designer or iManager. It is recommended to use Designer during the planning and implementation phases of the Identity Manager deployment.

In Designer, drag and drop the ID Provider driver, from the Service folder, onto the Modeler.
Select the ID Provider driver from the list, then click Run.
Specify the following information:
- Driver name: Specify the name of the driver object for your environment.
- LDAP server: Specify the IP address of the LDAP server that contains the ID policies.
- LDAP port: Specify the TCP port of the LDAP server. The default is 389 for non-SSL and 636 for SSL.
- Policy Container DN: Specify the DN of the policy container.
- Authenication ID: Specify the LDAP DN of a user with read/write access to the ID Policy container and its child objects.
- Authenication Password: Specify the password of the user used in the Authenication ID field.
Click Next.
Click Configure if you want to change additional settings on the driver, or click Close to create the driver.

If you want to make additional changes to the driver, the following sections contain information about the driver parameters.

ID Policy Repository

The ID policy repository parameters contain information about the location and how to access any ID policies.

Table 3-1 ID Policy Repository

Parameter	Default Value	Description
LDAP Server	127.0.0.1	The IP address or DNS name of the LDAP server holding the ID policies
LDAP Port	636	The TCP port that the LDAP server listens on. The value is usually 389 for non-SSL connections and 636 for SSL connections.
Use SSL	True	Specify whether or not you want to use SSL.
Always trust	True	Specify whether or not you want to trust all servers. If this option is set to True, the ID provider trusts all LDAP servers even if the server certificate is untrusted.
Policy Container DN	LDAP DN for the policy container under the driver object. For example cn=id-policies,cd=id-provider,cn=driverset1,dc=idm,dc=services,dc=system.	Specify or browse to the DN of the policy container in your tree. The policy container can only be created under the ID Provider driver.

Client Options

The client options are for the ID Provider clients. For more information, see Section 4.0, Configuring ID Clients.

Table 3-2 Client Options

Parameter	Default Value	Description
Client name	ID-Provider Driver	This is the name the driver uses when it acts as an ID client and requests and ID from the provider. This is useful for tracing and if access control is enabled on any of the ID policies. If access control is enabled, a list of ID client names can be specified that are allowed to obtain an ID from the policy. If the client name associated with the request is not in that list, the provider does not issue an ID.
ID Generation Map	workforceID=wfid	Enter a comma-separated list of attribute=policy pairs. For example, workforceID=wfid,uniqueID=uid. This example configures the driver to request IDs from the wfid policy and stores them in the workforceID attribute whenever a new object is created or whenever someone tries to change this attribute. Similarly, IDs from the UID policy are used from the uid attribute. The driver only issues IDs for any attribute if that attribute and the object class holding the attribute are in both the Subscriber, Publisher, Filter, and are set to synchronize. Note: Attribute names must be in the Identity Namespace (not LDAP) and must be case-exact.

Parameter

Default Value

Description

Client name

ID-Provider Driver

This is the name the driver uses when it acts as an ID client and requests and ID from the provider. This is useful for tracing and if access control is enabled on any of the ID policies.

If access control is enabled, a list of ID client names can be specified that are allowed to obtain an ID from the policy. If the client name associated with the request is not in that list, the provider does not issue an ID.

ID Generation Map

workforceID=wfid

Enter a comma-separated list of attribute=policy pairs.

For example, workforceID=wfid,uniqueID=uid. This example configures the driver to request IDs from the wfid policy and stores them in the workforceID attribute whenever a new object is created or whenever someone tries to change this attribute.

Similarly, IDs from the UID policy are used from the uid attribute. The driver only issues IDs for any attribute if that attribute and the object class holding the attribute are in both the Subscriber, Publisher, Filter, and are set to synchronize.

Note: Attribute names must be in the Identity Namespace (not LDAP) and must be case-exact.

Server Options

Allow you to setup clients other than the ID Provider driver using Java remote method invocation (RMI). It also allows you to set ID Provider trace level.

Table 3-3 Server Options

Parameter	Default Value	Description
Start RMI	True	Controls whether the ID provider starts an RMI service or not. You only need a running RMI service if you request IDs from other clients than the driver (for example, DirXMLScript policies.) If all IDs are managed through this driver’s filter and ID Generation Map settings, then no RMI service is needed.
RMI server	172.17.2.117	Specify the IP address the RMI server binds to. Leave this field empty if you want the server to bind to all IP addresses.
RMI port	1199	Specify the TCP port the RMI service listens on. The defined standard port for RMI is 1099. If that port is already in use (you see errors in the trace when you start the driver), use a different port higher than 1023. This configuration assumes a port of 1199 to avoid common port conflicts.
Use legacy ID-server schema?	False	Enables the backward compatibility mode when migrating an existing ID-Server configuration to run with the new ID Provider driver. Setting this to True allows you to keep using legacy ID policies, which do not use the new schema that ships with the ID Provider.
Trace level	ALL	This is not the driver trace level, but the ID Provider trace level. The levels are: OFF: Tracing is turned off. FATAL: Displays only fatal messages. ERROR: Displays only error messages. WARN: Displays only warning messages. INFO: Displays only informational messages. DEBUG: Displays only debug messages. ALL: Displays all messages.