This section helps you create, configure, and deploy the Access Review driver. You perform these tasks in your project in Designer.
NetIQ regularly provides updates to the Identity Manager drivers. You must have the latest content for the Access Review driver, User Application driver, and notifications object. For more information about the packages, see Section 1.3.1, Installation Requirements.
Open Designer.
Select Help > Check for Package Updates.
Select the updated packages that you want to update, including packages for the User Application driver and notification templates.
Click Yes.
When the update completes, restart Designer.
This section helps you configure the Access Review driver and establish its basic settings.
The driver interacts with Access Review through database views. It uses the Access Review administrator account as well as an account in the Identity Manager identity applications. When configuring the driver, you need information about Access Review and Identity Manager settings. For more information about required settings, see Section 1.3.2, Information Needed for Installation and Configuration.
NOTE:The Access Review driver requires the driver set packages for common settings: NOVLACOMSET and NOVLCOMSET. Ensure that you import these packages before configuring the driver. For more information about the packages, see Section 1.3.1, Installation Requirements.
In the Modeler view of Designer, select Developer.
(Conditional) If you have more than one driver set in the Identity Vault, select the driver set in the Modeler view to which you want to add the driver.
In the Palette view, expand Service.
Drag Access Review to the Modeler view.
This action opens the Driver Configuration Wizard.
For Select Driver Base Configuration, select Access Review Base, then click Next.
For Optional Features, select the following items:
Default Configuration
Managed System Information
Password Synchronization
Click Next.
For Driver Name, specify a value. For example, Access Review Driver.
Click Next.
For Application Authentication, specify the settings for connecting to the Access Review database: user account and account password.
For Driver Parameters, specify the settings that allow the Access Review driver to communicate with the Access Review server and the User Application.
The following sections provide guidance for configuring some of the settings.
Represents the settings that Identity Manager needs to manage application permissions received from Access Review. Identity Manager uses the User Application administrator account to dynamically create nrfResourceDefs permission folders and nrfResource objects. The folders and objects are stored in a base container within the ResourceDefs folder of the User Application driver.
The default container name is ACCESS_REVIEW_RESOURCES.
Represents the settings that allow Identity Manager to create new users based on the identities published from the Access Review repository. To add user accounts, the driver uses an account in Access Review that has the Data Administrator or Global Administrator role. The Access Review connection parameters grouped with this option enable the driver to update the Access Review Identities with critical IDM naming attributes after they are successfully added to Identity Manager. This option also controls the behavior of user object migration since this also requires the ability to update the Access Review Identities with IDM naming attributes.
Specifies the folder in the Identity Vault that stores the users created by the driver. The default value is data/users/arusers. For more information, see the following sections:
Click Finish.
This section helps you apply the system account that you created for the driver in the identity applications to the driver. For more information about the account, see Section 2.3, Creating an Identity Manager Provisioning Service Account for the Driver.
NOTE:Identity Manager shares Global Configuration Values (GCVs) with the entire driver set, the Role and Resource driver, and Access Review driver. NetIQ recommends that you periodically review the GCVs to ensure that it does not get reset by installations of other drivers or changes to the Access Review driver.
In the Outline view of Designer, right-click the Access Review driver.
Select Properties.
In the navigation pane, select Driver Configuration and select Publisher Options tab.
Specify the DN and password of the service account created for User Application Provisioning Service Account DN.
The Properties window displays the name of the service account based on the descriptive name that you created when you added the account to the GCVs for the driver set. For example, User Application Provisioning Service Account DN. For more information, see Section 2.3, Creating an Identity Manager Provisioning Service Account for the Driver.
Click OK.
After you create, configure, or modify the driver, you must deploy the Access Review driver, User Application driver, and notifications object.
In the Modeler or Outline view of Designer, right-click Driver Set or the driver set where you installed the Access Review driver.
Select Live > Deploy.
Select Deploy, then select OK.
Right-click the Access Review driver, then repeat the two deployment steps.
Deploy the User Application driver.
Deploy the Default Notification Collection object.
(Conditional) If Identity Manager requests Security Equivalences values, set equivalence to the admin.sa.system user.