A.1 Driver Configuration

In iManager:

Click to display the Identity Manager Administration page.
Open the driver set that contains the driver whose properties you want to edit:
1. In the Administration list, click Identity Manager Overview.
2. Click the Driver Sets tab.
3. If the driver set is not listed on the Driver Sets tab, use the Search In field to search for and display the driver set.
4. Click the driver set to open the Driver Set Overview page.
Locate the driver icon, then click the upper right corner of the driver icon to display the Actions menu.
Click Edit properties to display the driver’s properties page.

By default, the Driver Configuration page is displayed.

In Designer:

Open a project in the Modeler.
Right-click the driver line, then select click Properties.
Click Driver Configuration.

The Driver Configuration options are divided into the following sections:

A.1.1 Driver Module

The driver module changes the driver from running locally to running remotely or the reverse.

Java: Used to specify the name of the Java class that is instantiated for the shim component of the driver. This class can be located in the classes directory as a class file, or in the lib directory as a .jar file. If this option is selected, the driver is running locally.

The name of the Java class is com.netiq.nds.dirxml.driver.pum.PUMDriverShim.

Native: This option is not used in this driver.

Connect to Remote Loader: Used when the driver is connecting remotely to the connected system. Designer includes one sub-option:

Remote Loader client configuration for documentation: Includes information on the Remote Loader client configuration when Designer generates documentation for the driver.

Driver Object Password: Use this option to set a password for the driver object. If you are using the Remote Loader, you must enter a password on this page or the remote driver does not run. This password is used by the Remote Loader to authenticate itself to the remote driver shim.

A.1.2 Driver Object Password (iManager Only)

A.1.3 Authentication

The Authentication section stores the information required to authenticate to the connected system.

Authentication ID: Specify a user application ID. This ID is used to pass Identity Vault subscription information to the application.

Example: Admin

Authentication context/Connection Information: Specify the IP address or name of the PAM server the application shim should communicate with.

Example: myserver.company.com

Remote loader connection parameters/Remote Loader authentication: Used only if the driver is connecting to the application through the Remote Loader. The parameter to enter is hostname=xxx.xxx.xxx.xxx port=xxxx kmo=certificatename, when the hostname is the IP address of the application server running the Remote Loader server and the port is the port the Remote Loader is listening on. The default port for the Remote Loader is 8090.

The kmo entry is optional. It is only used when there is an SSL connection between the Remote Loader and the Identity Manager engine.

Example: hostname=10.0.0.1 port=8090 kmo=IDMCertificate

Driver Cache Limit: Specify the maximum event cache file size (in KB). If it is set to zero, the file size is unlimited. Click Unlimited to set the file size to unlimited in Designer.

Application password: Specify the password for the user object listed in the Authentication ID field.

Remote loader password: Used only if the driver is connecting to the application through the Remote Loader. The password is used to control access to the Remote Loader instance. It must be the same password specified during the configuration of the Remote Loader on the connected system.

A.1.4 Startup Option

The Startup Option section allows you to set the driver state when the Identity Manager server is started.

Auto start: The driver starts every time the Identity Manager server is started.

Manual: The driver does not start when the Identity Manager server is started. The driver must be started through Designer or iManager.

Disabled: The driver has a cache file that stores all of the events. When the driver is set to Disabled, this file is deleted and no new events are stored in the file until the driver state is changed to Manual or Auto Start.

Do not automatically synchronize the driver (Designer only): This option only applies if the driver is deployed and was previously disabled. If this is not selected, the driver re-synchronizes the next time it is started.

A.1.5 Driver Parameters

The Driver Parameters section lets you configure the driver-specific parameters. When you change driver parameters, you tune driver behavior to align with your network environment.

Publisher Options

Configure the below parameters:

Publisher heartbeat interval: Allows the driver to send a periodic status message on the Publisher channel when there has been no Publisher channel traffic for the given number of minutes. The default value is 1 minute.

Driver polling interval: Under Publisher options, in the Driver polling interval field, specify the number of seconds to delay before querying the PAM database for changes. A larger number reduces the load on the PAM database, but it also reduces the responsiveness of the driver. The default value is 15 seconds.

Driver Options

The Privileged Account Manager driver is a Java program running in Identity Manager. This driver communicates with the Privileged Account Manager application using the Java JSON API library provided by the Privileged Account Manager. This communication happens over an HTTPS channel using SSL protocol using the SSL protocol.

You can configure the below setting:

Use SSL: To secure the connection between the PAM drivers and the Identity Manager server, set this option to Yes. This option is set to No by default.

When this option is set to Yes, the below settings will be displayed:

Verify server certificate: The PAM driver can be configured to validate the PAM HTTPS certificate by using this option. This parameter is optional and disabled by default.

NOTE:Validation of the PAM HTTPS certificate is supported on Identity Manager 4.9 and higher and the corresponding configuration files are available in the Driver Parameter on the configuration page.
Keystore path for SSL certificate(s): To validate the certificate it is necessary to configure the Java keystore path. A Java Keystore file of JKS type must be generated on the IDM server where the PAM IDM Driver is deployed, and the PAM HTTPS certificate needs to be imported into it.

To validate the HTTPS certificate, you must export the PAM certificate and store it in the JAVA keystore file. To export and store the HTTPS certificate in the keystore, perform the following steps:
1. Export the PAM HTTPS certificate.
  
  For example,
  
  openssl s_client -showcerts -connect pam_server:port </dev/null 2>/dev/null|openssl x509 -outform PEM >pam_https.pem
2. Create the keystore.
  
  For example,
  
  /opt/netiq/common/jre/bin/keytool -genkey -alias pam_alias -keyalg RSA -keystore /tmp/pam.jks -validity 3650 -keysize 2048 -storepass novell123
3. Import certificate into keystore.
  
  For example,
  
  /opt/netiq/common/jre/bin/keytool -importcert -alias pam_alias -file pam_https.pem -keystore /tmp/pam.jks -storepass kspasswd -v
4. To list and display the details of entries within a Java keystore file named pam.jks located in the /tmp directory.
  
  For example,
  
  keytool -list -keystore /tmp/pam.jks -v
Keystore password: Specifies the password used to load the keystore file. You can change the keystore password by using the Change Password option.

A.1.6 ECMAScript (Designer Only)

Displays an ordered list of ECMAScript resource objects. The objects contain extension functions for the driver that Identity Manager loads when the driver starts. You can add additional ECMAScript objects, remove existing files, or change the order the objects are executed.

A.1.7 Global Configurations (Designer Only)

Displays an ordered list of Global Configuration objects. The objects contain extension GCV definitions for the driver that Identity Manager loads when the driver is started. You can add or remove the Global Configuration objects, and you can change the order in which the objects are executed.