1.5 Key Driver Features

A local installation is an installation of the driver on the Identity Manager server. The PAM driver can be installed on the Windows or Linux supported for the Identity Manager server.

For more information about local installations, see Where to Install the PAM Driver.

For additional information about system requirements, see System Requirements in the Identity Manager 4.9 Documentation.

The PAM driver can use the Remote Loader service to run on a Windows or a Linux server other than the Identity Manager server.

For more information about remote installations, see Where to Install the PAM Driver.

For additional information about system requirements, see System Requirements in the Identity Manager 4.9.

The PAM driver supports entitlements. Entitlements make it easier to integrate Identity Manager with the Identity Manager User Application and Role-Based Services in eDirectory. In the User Application, an action such as provisioning a user to a PAM UserGroup and UserRole is delayed until the proper approvals have been made. In Role-Based Services, rights assignments are made based on attributes of a user object and not by regular group membership. Both of these services offer a challenge to Identity Manager because it is not obvious from the attributes of an object whether an approval has been granted or the user matches a role.

Entitlements standardize a method of recording this information on objects in the Identity Vault. From the driver perspective, an entitlement grants or revokes the right to perform a task in PAM. You can use entitlements to control PAM UserGroup and UserRole membership. The driver is unaware of the User Application. It depends on the User Application server or the Entitlements driver to grant or revoke the entitlement for a user based upon its own rules.

The PAM driver encompasses Access Control and Command Control policies. The UserGroup entitlement falls under the command control policy, while the UserRole entitlement is associated with the Access Control policy. However, both UserGroups and UserRoles consist of users with similar responsibilities. This similarity enables the use of the group or role as a condition for a rule, determining whether users are granted or denied the rights to execute commands.

UserGroup: This entitlement grants or denies membership to a UserGroup in Privileged Account Manager. When the entitlement is revoked, Identity Manager removes the user membership from the UserGroup.

For a new resource, the administrator must not assign the entitlement value as Submit User or Everyone.

UserRole: This entitlement comprises users and groups, collectively referred to as members, from a various sources who share similar access requirements. A User Role can include members from one or more sources.

UserRole supports different types of members with IDM Entitlement, but only users from the LDAP server (eDirectory).

If an administrator assigns a resource to a user in the User Application or in iManager, that change is reflected in PAM server.

The NOVLPUMENT_x.x.x.xxxxxx.jar package contains the Entitlement contents for PAM.

For more information about entitlements, see the Identity Manager 4.8 Entitlements Guide.

Password synchronization is used to synchronize passwords of the DirXML-PUMCredential objects from the Identity Vault to the target PAM server and in case of password check-in, from PAM server to the Identity Vault. When the account objects are created in eDirectory the Identity Vault, passwords are synchronized to the target PAM servers through the Subscriber channel. For the password check-in feature, passwords are synchronized to IDM through the Publisher channel. For more information about password synchronization through the Publisher channel, refer Password Synchronization with Connected Systems through Identity Manager.

The PAM driver synchronizes Privileged Account Domains and Credentials objects from the Identity Vault to the PAM server.