6.0. Data Governance Edition. Data Governance Deployment Guide

Transcription

1 6.0 Data Governance Edition Data Governance Deployment Guide

2 2012 Quest Software, Inc. ALL RIGHTS RESERVED. This guide contains proprietary information protected by copyright. The software described in this guide is furnished under a software license or nondisclosure agreement. This software may be used or copied only in accordance with the terms of the applicable agreement. No part of this guide may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying and recording for any purpose other than the purchaser s personal use without the written permission of Quest Software, Inc. The information in this document is provided in connection with Quest products. No license, express or implied, by estoppel or otherwise, to any intellectual property right is granted by this document or in connection with the sale of Quest products. EXCEPT AS SET FORTH IN QUEST'S TERMS AND CONDITIONS AS SPECIFIED IN THE LICENSE AGREEMENT FOR THIS PRODUCT, QUEST ASSUMES NO LIABILITY WHATSOEVER AND DISCLAIMS ANY EXPRESS, IMPLIED OR STATUTORY WARRANTY RELATING TO ITS PRODUCTS INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. IN NO EVENT SHALL QUEST BE LIABLE FOR ANY DIRECT, INDIRECT, CONSEQUENTIAL, PUNITIVE, SPECIAL OR INCIDENTAL DAMAGES (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF PROFITS, BUSINESS INTERRUPTION OR LOSS OF INFORMATION) ARISING OUT OF THE USE OR INABILITY TO USE THIS DOCUMENT, EVEN IF QUEST HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. Quest makes no representations or warranties with respect to the accuracy or completeness of the contents of this document and reserves the right to make changes to specifications and product descriptions at any time without notice. Quest does not make any commitment to update the information contained in this document. If you have any questions regarding your potential use of this material, contact: Quest Software World Headquarters LEGAL Dept 5 Polaris Way Aliso Viejo, CA legal@quest.com Refer to our Web site ( for regional and international office information. Trademarks Quest, Quest Software, the Quest Software logo, and Simplicity at Work are trademarks of Quest Software and its subsidiaries. See for a complete list of Quest Software s trademarks. Other trademarks are property of their respective owners. Quest One Identity Manager Data Governance Edition - Data Governance Deployment Guide Updated - October 2012 Software Version Third Party Contributions Quest One Identity Manager contains some third party components (listed below). Copies of their licenses may be found at COMPONENT LICENSE OR ACKNOWLEDGEMENT Boost Boost Software License - Version August 17th, 2003.NET logging library 1.0 Copyright , The Regents of the University of California. All rights reserved. BSD 4.4 License.

3 COMPONENT Dojo Toolkit 1.6 Google Open Sans 1.0 JQuery JQuery UI Mono.Security Novell.Directory.LDAP SharpZipLib spin.js Windows Installer XML toolset (aka WIX) ZLib.NET zlib LICENSE OR ACKNOWLEDGEMENT Copyright , The Dojo Foundation All Rights Reserved. BSD Simple License. Copyright January 2004 ( Apache 2.0 License. Copyright 2011, John Resig. MIT License. Copyright 2011, John Resig. MIT License. Copyright 2004 Novell, Inc. ( MIT License. Copyright 2003 Novell, Inc. ( MIT License. Copyright Mike Krueger, John Reilly. SharpZipLib License. Copyright 2011 Felix Gnass [fgnass at neteye dot de]. MIT License. Common Public License 1.0 Copyright 2006, ComponentAce ( All rights reserved. Copyright (C) Jean-loup Gailly and Mark Adler ZLib.NET License notice Copyright (c) 2006, ComponentAce All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. Neither the name of ComponentAce nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDEN- TAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PRO- CUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

4

5 INTRODUCTION DEPLOYMENT OVERVIEW SYSTEM REQUIREMENTS INSTALLATION AND CONFIGURATION INSTALL QUEST ONE IDENTITY MANAGER DATA GOVERNANCE EDITION CONFIGURE QUEST ONE IDENTITY MANAGER COMPONENTS CREATE THE IDENTITY MANAGER DATABASE, AND DEPLOY THE DATA GOVERNANCE SERVER AND ACTIVITY DATABASE FROM THE CONFIGURATION WIZARD CONFIGURE THE IDENTITY MANAGER SERVICE SYNCHRONIZE ACTIVE DIRECTORY WITH IDENTITY MANAGER SET UP CONNECTIVITY WITH SHAREPOINT INSTALL THE WEB PORTAL MAP EMPLOYEES TO DATA GOVERNANCE APPLICATION ROLES CONFIGURE DATA GOVERNANCE COMPONENTS READYING SERVICE ACCOUNTS AND DOMAINS FOR DEPLOYMENT DEPLOYING FILE SERVER MANAGED HOSTS DEPLOYING SHAREPOINT MANAGED HOSTS ABOUT QUEST SOFTWARE CONTACTING QUEST SOFTWARE, INC CONTACTING QUEST SUPPORT

6

7 1 Introduction About this Guide Deployment Overview System Requirements

8 Quest One Identity Manager Data Governance Edition About this Guide This document contains the information required to install and configure Quest One Identity Manager Data Governance Edition. It provides step-by-step instructions to help you specifically set up and configure Data Governance functionality. This document is for network administrators, consultants, analysts, and IT professionals responsible for deploying Data Governance in their organization. Deployment Overview Installation and Configuration Overview The following activities must be performed to have a fully functional Data Governance deployment: Install Quest One Identity Manager Data Governance Edition Configure the Identity Manager database Set up the Data Governance Server Configure the Data Governance activity database Synchronize your target environments (Active Directory and SharePoint) Install the Web Portal Map employees with the required Data Governance application roles Deploy Managed Hosts Recommended Installation Install Quest One Identity Manager Administrative and System Configuration tools on Windows workstation Install Quest One Identity Manager Server Service on Windows Server with good connectivity to a database server Install Quest One Identity Manager database on a dedicated Windows SQL Server Install Quest One Identity Manager Web Portal on a dedicated Windows IIS Server 8

9 Data Governance Deployment Guide System Requirements Before installing Quest One Identity Manager, ensure that you meet the following minimum requirements: Database Server Requirements Quest One Identity Manager works with Microsoft SQL and Oracle database systems. Operating System: Microsoft Windows Operating Systems: Windows Server 2003 Service Pack 2 or later, Windows Server 2003 R2, Windows Server 2008, or Windows Server 2008 (R2) (32 bit or non-itanium 64 bit) UNIX and Linux Operation Systems: See Operating System vendor for minimum requirements needed to host an Oracle database Additional Software: Microsoft SQL Server Enterprise Edition 2008 Service Pack 3 or later, Microsoft SQL Server Enterprise Edition 2008 R2 Service Pack 1 or later (compatibility level: 10) Oracle database 11g r2 Enterprise Edition version 11.2 and higher (patch level will vary with operating system platform). Service Server Requirements Operating System: Microsoft Windows Operating Systems: Windows Server 2003 Service Pack 2 or later, Windows Server 2003 R2, Windows Server 2008, or Windows Server 2008 (R2) (32 bit or non-itanium 64 bit) Linux Operating Systems: SuSE Enterprise Server 10 Additional Software: Microsoft Windows Operating Systems Microsoft Software Installation (MSI) Service.Net 3.5 Service Pack 1 or later Linux Operation Systems Mono 2.8 Client Requirements Operating Systems: Microsoft Windows Operating Systems: Windows XP Service Pack 3 or later, Windows Vista, Windows7 (32 bit or non-itanium 64 bit) Additional Software: Microsoft Windows Operating Systems:.Net 3.5 Service Pack 1 or later, Microsoft Software Installation (MSI) Service, Windows Internet Explorer 7.0 or later, Mozilla Firefox 3.0 or later 9

10 Quest One Identity Manager Data Governance Edition Web Server Requirements Operating System: Microsoft Windows Operating Systems: Windows Server 2003 Service Pack 2 or later, Windows Server 2003 R2, Windows Server 2008, or Windows Server 2008 (R2) (32 bit or non-itanium 64 bit) Linux Operating Systems: See Operating System vendor for minimum requirements needed to host Apache HTTP Server 2.1 Additional Software: Microsoft Windows Operating Systems Microsoft Internet Information Service 7 or Apache HTTP Server 2.1.Net 3.5 Service Pack 1 or later Linux Operation Systems Apache HTTP Server 2.1 Mono 2.8 Data Governance Server To configure a Data Governance server, the user must belong to the Administrators group of the computer hosting the server. System Requirements: Windows Server 2003, Windows Server 2003 (R2), Windows Server 2008, Windows Server 2008 (R2), Windows SQL Server 2008 (R2) (64 bit non-itanium) quad core CPU 1024x 768 screen resolution with 16-bit color 100 GB free disk space 16 GB RAM Software Requirements:.Net 3.5 Service Pack 1 or later Microsoft SQL Server 2005 Enterprise Edition Service Pack 3 or later, Microsoft SQL Server Enterprise Edition 2008 Service Pack 1 or later (compatibility level: SQL Server 2005 (90)) 10

11 Data Governance Deployment Guide Oracle database 10g Enterprise Edition version and later or Oracle database 11g r2 Enterprise Edition version 11.2 and later (patch level will vary with operating system platform). Quest only provides a 64-bit server for Data Governance. Ensure that the server installed on a given computer uses the correct architecture to match the installed operating system. Account Requirements: When using SQL Server as the backing database, you must use SQL Server Authentication with the Data Governance Server. Windows Integrated Authentication must not be used. You must be an administrator of the computer on which you are installing the Data Governance Server. You must have the credentials of an account that can be used to create a database on the SQL server being used by the Data Governance Server. You must have the credentials of an account that can be used as a Service Account for your managed domains. For both the Web Portal and the Data Governance front ends, users must be logged in with an Active Directory user account from an Active Directory domain that is in the Identity Manager database. Agent Requirements System Requirements Update Rollup 1 for Windows Server 2000 with Service Pack 4, Windows Server 2003, Windows Server 2003 (R2), Windows Server 2008, or Windows Server 2008 (R2) (32 bit or non-itanium 64 bit) 500 MHz+ Processor 1024 MB RAM 100 MB free disk space for every 1,000,000 files / folders scanned Real-time file system updates and resource activity tracking are not supported on versions of ONTAP NetApp filers earlier than 7.3. Additionally, the following Network Attached Storage Devices are supported as managed hosts, but must be scanned remotely: NetApp 7.3 and 8.1(Data ONTAP)*, EMC Celerra 5.6 with Server Message Block 1.0. Windows 2008 and Windows 2008 (R2) failover clusters are supported as remote managed hosts types. Resource activity tracking is not supported for clusters. Data Governance Activity Database System Requirements: quad core CPU 11

12 Quest One Identity Manager Data Governance Edition 100 GB free disk space 16 GB RAM Report Requirements For Data Governance reports to function, proper authentication checks must be performed. This is accomplished by configuring the job server service to logon as an Active Directory account associated with an Employee who has been assigned the Data Governance Administrator application role. This job server must be configured with the SMTP Host server mask to ensure it is the job server that runs the reports. SharePoint Requirements\Recommendations Scanning SharePoint Server 2010 is supported. Standalone farms are not supported. Farms configured with only Local Users/Groups are not supported. Recommend installing the agent on a dedicated SharePoint 2010 Application Server in the farm and not on a Web Front server (to reduce processing load on the web front end server). Recommend 100 GB disk space on the SharePoint agent computer for data storage and scan post-processing activities. The space required is dependent on the number of sites, lists, and document libraries and the number of unique permissions gathered from the farm. Recommend 8 GB RAM for the SharePoint agent computer. Ensure that the service account configured for the SharePoint managed host is a SharePoint Farm Account (same account that is used to run the SharePoint timer service). Web Portal Requirement If the web server hosting the Quest One Identity Manager Web Portal is running on the same computer as the Data Governance server you must set the ImpersonateWcfCalls IIS application setting to TRUE. If the web server hosting the Quest One Identity Manager Web Portal is running on a different computer than the Data Governance server you must include entries in the ExplicitlyAllowed- Identities.txt file for the IIS host computers ActiveDirectory account. To access Quest One Identity Manager Data Governance Edition functionality in the Web Portal, you must configure IIS to use Integrated Authentication. 12

13 2 Installation and Configuration Upgrade Quest One Identity Manager 6.0 to Quest One Identity Manager 6.0 Data Governance Edition Install Quest One Identity Manager Data Governance Edition Configure Quest One Identity Manager Components Configure Data Governance Components

14 Quest One Identity Manager Data Governance Edition Upgrade Quest One Identity Manager 6.0 to Quest One Identity Manager 6.0 Data Governance Edition If you already have Quest One Identity Manager 6.0 installed, you can upgrade to Quest One Identity Manager 6.0 Data Governance Edition using the following steps. To upgrade existing components from Quest Once Identity Manager to Quest One Identity Manager Data Governance Edition, you must enable the Data Governance (QAM) components in the Designer before running the Configuration wizard. To upgrade to Data Governance Edition 1. Open the Designer and select the Base Data tab. 2. Select Configuration parameters, and then select Edit configuration parameters in the Tasks pane. 14

15 Data Governance Deployment Guide 3. Expand Target System ADS QAM. 4. Select the QAM check box, and click the Commit to database button on the toolbar. 15

16 Quest One Identity Manager Data Governance Edition 5. Click Save on the confirmation dialog box. 6. Select the Database menu, then compile database and follow the Configuration Wizard. 7. Run the Quest.Titan.Client.Q1IM.UpgradeConfigurationWizard.exe. 8. Select the database server type where the Quest One Identity Manager database is installed and enter the required connection information. 16

17 Data Governance Deployment Guide 9. Enter the fully qualified domain name of the computer where the Data Governance server service is or will be installed. If this is a first time installation for the Data Governance server, click Deploy to install the Data Governance server service on the specified computer. 10. Select the database where you would like to install the Data Governance resource activity database, and specify the required connection information. 17

18 Quest One Identity Manager Data Governance Edition 11. Specify any additional information required for creating the Data Governance resource activity database. 12. Wait while the Data Governance resource activity database is created and the Data Governance server is configured and click Finish. Quest One Identity Manager 6.0 Data Governance Edition is now ready for use. For details on configuration options, see Configure Data Governance Components on page

19 Data Governance Deployment Guide Install Quest One Identity Manager Data Governance Edition To install Identity Manager Data Governance Edition 1. On a Windows Workstation, run the Quest One Identity Manager Autorun, select the Components tab, and choose Complete Installation to install the Administration tools including the Data Governance User Interfaces and appropriate services. 2. Accept the license agreement, and click Install. All the required files will be installed on your system. 19

20 Quest One Identity Manager Data Governance Edition You can now use the Configuration Wizard to create the Identity Manager Database Service and deploy and configure the Data Governance Server. 3. Select the Run Configuration Wizard and click Finish. For details, see Create the Identity Manager Database, and Deploy the Data Governance Server and Activity Database from the Configuration Wizard on page 21. Configure Quest One Identity Manager Components For a fully functional Identity Manager setup, you need to: Create and configure the Identity Manager database and deploy the Data Governance Server and Activity database Synchronize Quest One Identity Manager with target systems (Active Directory and Share- Point) so that users can access data. Install the Web Portal so that users can access data from the self-service web site. Map Employees to the application roles required to perform Data Governance operations within the system. 20

21 Data Governance Deployment Guide Create the Identity Manager Database, and Deploy the Data Governance Server and Activity Database from the Configuration Wizard The following procedure describes the steps required to create the Identity Manager Database Service (for configuration details, see Configure the Identity Manager Service on page 27) and deploy the Data Governance Edition components. To setup the required components 1. In the Configuration Wizard, select Create and install database, and click Next. This procedure will highlight an SQL installation. 2. Select the database system, enter the connection information, and click Next. It is recommended to use SQL Server System Administrator account. Do not use Windows Authentication. 21

22 Quest One Identity Manager Data Governance Edition 3. Enter a name for the database leaving all other settings as the default. In the Installation source field, browse to and select the Quest One Identity Manager Autorun.exe file, and click Next. Identity Manager Data Governance Edition requires a number of modules to be enabled in order to provide the proper connectivity to Active Directory, File System, and SharePoint as well as presenting IT and business functions throughout the product. 22

23 Data Governance Deployment Guide 4. Select Data Governance Edition, and expand the Target system Connectors. 5. Select Microsoft Active Directory and the sub-entry Microsoft SharePoint 2010, and click Next. You are now ready to define customer data and create the administrative user accounts for the database connection. 6. Provide a Customer name or Customer prefix to differentiate Quest-provided content from cus- 23

24 Quest One Identity Manager Data Governance Edition tomer-specific content. 7. Provide one or several customer Identity Manager System administrator user accounts/passwords. These system accounts have the same permissions as the default Quest-provided viadmin account which should not be customized (except for the password). The task to install and compile the database will take approximately 30 minutes to run. 8. Click Next once the compile has completed. 9. Select the Skip service installation option to skip the configuration of the Identity Manager Database service, and click Next. The configuration of the Identity Manager database service can be performed once you have completed this wizard. See Configure the Identity Manager Service on page 27 for details. 24

25 Data Governance Deployment Guide You are now ready to configure the Data Governance components. 10. Enter the DNS name of the server where the Data Governance server will be installed and the port it will communicate on, and select Deploy. When the deployment has completed, click Finish, then click Next. You are now ready to configure the Data Governance Activity Database. 11. Enter the information for the SQL server where Quest One Identity Manager was installed and where the Data Governance Activity Database will be installed, and click Next. 25

26 Quest One Identity Manager Data Governance Edition 12. Enter the database options, and click Next. The default values can be used. 13. Once the Data Governance server and database have been installed, click Next. 14. Click Finish to complete the Configuration Wizard. 15. Log on to the server where the Autorun setup was completed, open the Services console, and select the Quest One Identity Manager Service. Change the Log On for the Quest One Identity Manager Service to the account to be used to connect to the database. 26

27 Data Governance Deployment Guide There is an option to install a standalone Server Service from the Autorun. It is not recommended to install this option on a computer where you have Quest One Identity Manager installed. If you do, it will not only add the service, but also remove any previously installed management tools such as the Manager and Designer. The standalone Server service installation is intended only for computers without Quest One Identity Manager management tools. Configure the Identity Manager Service To configure the Identity Manager Service 1. Select Start All Programs Quest Software Quest One Identity Manager Configuration Designer. When you open the Designer, you must first connect to the database. 2. Enter the Administrator user account and password, and click Connect 3. In the Navigation view, select and double-click Base Data. 4. Select the database server from the list of job servers, and select Edit Job server from the Tasks list. 5. From the Server mask option, include Identity Manager Service Installed, then select the Identity Manager Service Configuration tab. 6. Select Process collection from the module list, and click Insert. 7. Select the MSSqlJobProvider module and click OK. 8. Select the new MSSqlJobProvider module from the list, highlight the Connection string entry, 27

28 Quest One Identity Manager Data Governance Edition and click Edit. 9. Enter the parameters for connecting to the newly installed Quest Once Identity Manager database, and click OK. To test your settings and ensure you are accessing the database server correctly, select your database from the list instead of typing it in. If your database is available, then server, user and password values entered are correct. 10. Select the Job Destination module, and click Insert. Select the JobServiceDestination module, and click OK. 11. Select the Log writer module, and click Insert. Select the FileLogWriter module, and click OK. 12. Select the Plugins module, and click Insert. Select the HttpStatusPluigin module, and click OK. 13. Click the Save button in the Identity Manager Service Configuration panel and save the new configuration file to the Quest Software Quest One Identity Manager folder. If the file already 28

29 Data Governance Deployment Guide exists, overwrite it. 14. Click the Commit to database button on the Designer s tool bar. 15. On the Save changed object to the database screen, click Save. 16. From the server Services console, confirm that the Quest One Identity Manager Service is started. To ensure the new configuration is applied, restart the service. Synchronize Active Directory with Identity Manager To synchronize Active Directory 1. Select Start All Programs Quest Software Quest One Identity Manager Manager. 2. Enter the Administrator user account and password to connect to the Identity Manager database, and click Connect. 3. In the Navigation view, select My Identity Manager. 4. Select Target system wizards Configure Active Directory. The Configure Active Directory wizard opens. 29

30 Quest One Identity Manager Data Governance Edition 5. Read the Welcome information, and click Next. 6. Enter the domain name (pre-windows format), and click Next. 7. Enter in the full domain name (DNS format) and administrator username and password. The Parent domain is not a required field. 8. Use the default values for the Provider and Authentication, and click Next. 9. Select No for Should the domain users be managed using a user account resource, and click Next. 10. On the Destination Server page, select Create new server, and enter in the name of your domain controller (leave the port as 389). 11. On the Synchronization server page, select Use existing synchronization server, select the server where the Job Server is installed, and click Next. 30

31 Data Governance Deployment Guide 12. When the import domain data process completes, click Next. 13. Create the synchronization schedule by clicking the + button. 14. Click Enabled and select your time zone and duration; select to make it for an unlimited duration and select a start date of today; select your occurrence (every 60 minutes for example), click OK and Next. 15. Click Next to begin the synchronization. To ensure it was successful, open the Identity Manager and select Active Directory in the Navigation view and browse the different nodes to verify Active Directory objects are present. Set up Connectivity with SharePoint To have Quest One Identity Manager connected to a SharePoint server, you need to: Perform an Active Directory synchronization. For details see, Synchronize Active Directory with Identity Manager on page 29. Make Quest Once Identity Manager aware of the server by registering it. Enable processes by creating and configuring the Job Server Service for it. Register the Server with Quest One Identity Manager Once Active Directory has been synchronized, all the servers in your domain will be visible in the following location. To view your servers 1. Select Start All Programs Quest Software Quest One Identity Manager Identity Manager. 2. Enter the Administrator user account and password to connect to the Identity Manager database, and click Connect. 3. In the Navigation view, select Active Directory and browse to the Server node. The systems in the Server folder are those identified during the Active Directory synchronization. The SharePoint server is located in the Server hardware without server folder. 31

32 Quest One Identity Manager Data Governance Edition Before you can create and configure the Job Server Service, you need to elevate the SharePoint server to the Server folder. To elevate the server 1. Select Start All Programs Quest Software Quest One Identity Manager Identity Manager. 2. Connect with the viadmin user account and password. 3. In the Navigation view, select Active Directory and browse to the Server node. 4. Click the + button and enter the name of the server hosting SharePoint. 5. Select Language English. 6. Select the AD container where the computer is located. 7. Click Hardware and locate the SharePoint server. 8. Click Save. The SharePoint server will now be displayed under the Server folder. 32

33 Data Governance Deployment Guide Create and Configure the Job Server for a SharePoint Server Creating and configuring the Job Server Service on a SharePoint server includes the following: Install the Job Server service on the SharePoint server Configure the Job Server service on the server that hosts the Identity Manager management tools Transfer the JobService.cfg file to the SharePoint server Restart or start the Job Server on the SharePoint server Install the Job Server Service on the SharePoint Server To install the Job Server Service Log on to the SharePoint computer, launch the Quest One Identity Manager Autorun, and select the Components Server Service. Configure the Job Server Service for the SharePoint Server This procedure is performed on the server where you have installed the Identity Manager management tools. To configure the Job Server Service 1. Select Start All Programs Quest Software Quest One Identity Manager Designer. 2. Click Base Data, and select Job Server from the Navigation View. The SharePoint Job Server Service is configured using the same procedure used for configuring the initial Job Server Service in the Designer. Because we elevated the SharePoint server, it will appear in the Base Data, Job server folder. 3. Select the SharePoint Job Server and select Edit Job Server. 4. From the Server mask option, include Identity Manager Service Installed, then select the Identity Manager Service Configuration tab. 5. Select Process collection from the module list, and click Insert. 6. Select the MSSqlJobProvider module and click OK. 33

34 Quest One Identity Manager Data Governance Edition 7. Select the new MSSqlJobProvider module from the list, highlight the Connection string entry, and click Edit. 8. Enter the parameters for connecting to the newly installed Quest Once Identity Manager database, and click OK. To test your settings and ensure you are accessing the database server correctly, select your database from the list instead of typing it in. If your database is available, then server, user and password values entered are correct. 9. Select the Job Destination module, and click Insert. Select the JobServiceDestination module, and click OK. 10. Select the Log writer module, and click Insert. Select the FileLogWriter module, and click OK. 11. Select the Plugins module, and click Insert. Select the HttpStatusPluigin module, and click OK. You need to transfer the SharePoint Job Server configuration file to the SharePoint server and place it in the following folder: C:\Program Files (x86)\quest Software\Quest One Identity Manager to overwrite any existing configuration file. 12. Click the Save button in the Identity Manager Service Configuration panel and save the file to the Quest One Identity Manager folder on the SharePoint server. Ensure that you do not save this file to the Quest One Identity Manager folder on the server hosting the management tools. If you do, you will overwrite the configuration file. You can save the JobService.cfg file to SharePoint directly during configuration. For example, save the file to: \\qamchsp\c$\program Files (x86)\quest Software\Quest One Identity Manager. 13. Click the Commit to database button on the Designer s tool bar. 14. On the Save changed object to the database screen, click Save. Restart or start the Job Server on the SharePoint Server Before you start the Job Server, you need to ensure that the account you are using to run the Job Server service is the same as the SharePoint Timer service. To perform this check and restart or start the service 1. If the Quest One Identity Manage Service (Job Service) is running, stop it. 34

35 Data Governance Deployment Guide 2. Check the SharePoint Timer service account and compare it to the account running the Job Server. If these accounts do not match, then you need to change the Quest One Identity Manager Service Properties. 3. To change the Log On As account, right-click the service, and select Properties. Select the Log On tab and change the setting to use This Account. Enter the account information so it matches the SharePoint Time service account, and click OK. Once the service account has been set, you can then start the Quest One Identity Manager service. 4. To ensure that the Quest One Identity Manager Service is configured properly, use a Web 35

36 Quest One Identity Manager Data Governance Edition browser on the SharePoint Job Server and connect to Red text indicates a problem. Note: Be sure to check the data and time to ensure the message is recent. The most common issue is the JobService.Initialize or an initialization string error. These issues can be corrected through the Job Service Configuration utility. On the SharePoint Job Server, select Start All Programs Quest Software Quest One Identity Manager Target Systems Job Service Configuration. Configure the Service with the values used to configure the Identity Manager Service. Save you updates. You can test the new connection using the Verify option on the File menu. 5. Restart the Quest One Identity Manager Service. The SharePoint Job Server is now configured and should be seen in the Job Info Queue. You are now ready to perform a SharePoint synchronization. Synchronize SharePoint with Identity Manager Before you can proceed, you need to know your connection string. In the Registry on the SharePoint server, browse to Software Microsoft Shared Tools Web Server Extensions 14.0 Secure ConfigDB key = DSN. Copy the string. (This can also be done from Central Admin farm configuration database connection string.) To synchronize SharePoint 1. On the Quest One Identity Manager server, select Start All Programs Quest Software Quest One Identity Manager Manager. 2. Enter the Administrator user account and password to connect to the Identity Manager database, and click Connect. 36

37 Data Governance Deployment Guide 3. In the Navigation view, select SharePoint and the Farms node. 4. In the Result list, click the + button to add a SharePoint farm. 5. On the General tab, enter a name and display name for the farm. 6. Select to have it synchronized by Identity Manager. 7. Paste the configuration database connection string in the Connection parameter field. 8. Select the domain where the farm is located. 9. Enter and confirm the password. This is the farm passphrase created during SharePoint configuration. 10. Click Save. 11. Select the Synchronization tab and select the Job Server on the SharePoint server. 12. Click Save. You now need to check the account access. 13. On the SharePoint server, open the Service running as the farm account. 14. In the Services console, check the SharePoint 2010 Timer service credentials. Ensure that the account can access the Quest One Identity Manager database, through the sysadmin server role. If required, you can add the role through the SQL Server Management Studio. Use the 37

38 Quest One Identity Manager Data Governance Edition same credentials as the Quest One Identity Manager Service. 15. Restart the service. You are now ready to configure and run the synchronization. 16. Return to the Quest Once Identity Manager server and open the Manager. 17. In the Navigation view, select SharePoint and the Farms node. Select the previously created farm. 18. In the Task list, select Load the Mapping rules. 19. Click OK in the confirmation dialog. 20. In the Task list, select Load the Schema. 21. Click OK in the confirmation dialog. Ensure that the job queue tasks schema and mapping ran by monitoring job queue before performing the synchronization. 22. Select the farm, and in the Task view select Configure Synchronization. 23. Click the + button. 24. Enter a name, select Full Synchronization, and click OK. 25. Save your changes. 26. Click the + button (to the right of schedule). 27. Enter a name, select Enable, then select the time zone, start date, and unlimited duration. Enter the same settings as the Active Directory synchronization. 28. Save your changes. 29. Click the Play button beside the schedule to perform the synchronization. Verify that it ran in the job queue. 38

39 Data Governance Deployment Guide Configure SharePoint to Track Resource Activity To gather and report on resource activity in SharePoint, you must ensure that SharePoint native auditing is properly configured for any resources of interest. You can also optionally install the Quest Share- Point Auditing Monitor farm solution to obtain activity for events not available in the native SharePoint auditing system. Configuring Auditing on SharePoint Farms You can enable auditing at different levels in the SharePoint farm. It is recommended that you enable auditing at the site collection level to ensure all events are collected. The methods available for configuring auditing vary depending on the SharePoint edition installed. In some cases, you can use Central Administration; in all cases you can use PowerShell. It is recommended that you enable all SharePoint native events to ensure maximum coverage for data governance activities, but you may choose a smaller set to improve performance if necessary. Consult your Microsoft documentation for complete information on configuring auditing. Installing the Quest.SharePoint.Auditing.Monitor Farm Solution If you install the SharePoint farm solution, you can supplement the events captured by native auditing. Install Quest.SharePoint.Auditing.Monitor.wsp from the agent installation folder (by default Program Files\Quest Software\Data Governance\Agent Service.) Consult your Microsoft documentation for information on installing a farm solution. You must enable SharePoint native auditing. The farm solution is not a replacement for native auditing, it is an enhancement. This farm solution captures some events that are unavailable through native SharePoint auditing, specifically: Adding a folder Adding a library Renaming a list or library Creating a site Moving a site Mapping SharePoint Events to Data Governance Events When you track resource activity using Data Governance, the results appear in views, reports, and dashboards. To simplify things, SharePoint events are grouped for easier reporting. The following table outlines the events you will see your reports, and the corresponding SharePoint events. Data Governance Events DATA GOVERNANCE EVENTS Create Delete NATIVE SHAREPOINT EVENTS Undelete Item copied Item added Item deleted 39

40 Quest One Identity Manager Data Governance Edition Data Governance Events DATA GOVERNANCE EVENTS Move Read Security Change Write NATIVE SHAREPOINT EVENTS Item moved Item restored from Recycle Bin Item renamed Checkout View Audit mask change Inheritance breakage Inheritance restore Permission level granted Permission level revoked Item checked in Item updated Version deletion Version restored Item updated Attachment added Install the Web Portal Before installing the Web Portal, IIS must be configured with the following minimum settings. To configure IIS for the Web Portal installation 1. Select Start Administrative Tools Server Manager. 2. In the Server Manager, expand Roles, and then click Web Server (IIS). In the Web Server (IIS) pane, scroll to the Role Services section, and click Add Role Services. The Add Role Services dialog box opens. 40

41 Data Governance Deployment Guide 3. Ensure the following role services are enabled. 4. Select ASP.NET. In the Add Role Services dialog box, click Add Required Role Services. 5. Ensure the following role services are enabled: 41

42 Quest One Identity Manager Data Governance Edition 6. Click Next and Install. 42

43 Data Governance Deployment Guide 7. Click Close to complete the process. You are now ready to install the Identity Manager Web Portal. 43

44 Quest One Identity Manager Data Governance Edition To install the Web Portal 1. Select Start All Programs Quest Software Quest One Identity Manager Configuration Web Installer. 2. Select to install a new application and click Next. 3. Connect to the database by entering the Quest One Identity Manager Administrator account and password, and click Next. 44

45 Data Governance Deployment Guide 4. In the Select setup target page, accept all default settings. 5. Select the icon beside the Authentication for sub project is missing warning to add the required authentication. 6. Select VI-UserREgistration_Web, and click Define login information. 45

46 Quest One Identity Manager Data Governance Edition The database login screen opens. 7. The user account should be entered by default as the Quest One Identity Manager Administrator account. If not, then add the account. Enter the password, and click Connect. When the Authentication data dialog box is clear, click OK to return to the Web Portal setup. 46

47 Data Governance Deployment Guide 8. Once all warnings are clear, select Next. If you get the following error, you need to ensure that you have installed the Windows authentication role service for the web. See step 2 in this procedure. For information on Windows authentication role services required for different software versions, see 9. In the Applications to install window, accept the default entries, and select Next. There are two web sites included in this install English and German. When you log in to the Web Portal, you can select the language you want to use. This directs the login to the correct 47

48 Quest One Identity Manager Data Governance Edition web site. A dialog box opens with the Web Portal web site address. Note this address to log on to the Web Portal. 10. Click OK to begin the installation. While the two web sites have been installed, the application will try to verify the application start up. This process may take a long time. You can select Cancel to end this process if re- 48

49 Data Governance Deployment Guide quired. This does not appear to harm the Web Portal install. 11. Click Next (or Cancel) to complete the setup process. 12. Click Finish. To log on to the Web Portal 1. Open a browser and enter the web page created during the installation. 2. Log in with an appropriate account. 49

50 Quest One Identity Manager Data Governance Edition Troubleshoot Web Portal Issues Open a browser and enter the web page created during the installation. If the default web site does not work, enter the following URL: Where servername is the server where you installed the Web Portal. If you receive the following error, it means a System Configuration parameter has not been enabled correctly. 50

51 Data Governance Deployment Guide To avoid the problem: When installing through the old DB Installer, ensure that the parameters are as shown below: To solve the issue on the current install: Open the Designer and navigate to Base Data Configuration Parameters and select Edit Configuration Parameters. Set the proper parameters then commit to database then Recompile Database. 51

52 Quest One Identity Manager Data Governance Edition Browse the Web Portal from a Windows Server When using a Windows Server to browse to the Web Portal, you need to disable IE Enhanced Security Setting (ESC). To set up IE to browse the Web Portal 1. Select Start Administrative Tools Server Manager. 2. Select Configure IE ESC. 3. Disable the option and select OK. 52

53 Data Governance Deployment Guide 4. Close IE and when restarting, you should see the message validating that ESC is now off. 53

54 Quest One Identity Manager Data Governance Edition Map Employees to Data Governance Application Roles For employees to access the full range of Data Governance features, you need to grant the appropriate application roles. The following application roles are specifically for Data Governance. They are to be used in conjunction with Quest One Identity Manager application roles. Data Governance\Access Managers Members of this role can access all information related to Data Governance, and can query information from Data Governance agents. Additionally, they can modify the security of objects contained on managed hosts. Data Governance\Administrators Members of this role can perform all administrative tasks necessary for the management of Data Governance. This includes deploying and configuring managed hosts, managing data access, editing security, and placing data under governance. Data Governance\Business Owner Members of this role can view information on resources they own. Data Governance\Direct Owners This role is held by accounts and roles marked as the owners of resources within Data Governance. To assign application roles 1. In the Quest One Identity Manager Navigation view, select Employees. 2. In the Results list, select the required employee. 3. In the Task view, select Assign Identity Manager application roles. 4. Apply the required application role, and save your changes. 54

55 Data Governance Deployment Guide Configure Data Governance Components You need to perform the following Data Governance-specific setup and configuration procedures: Identify the domains that you want to access and provide the credentials that can perform operations on those resources. Select the domains that contain the computers and data that you want to manage. Add the hosts that hold the resources that you want to manage. Readying Service Accounts and Domains for Deployment Before you can gather information on the data in your enterprise, you must: Add and assign the credentials (service accounts) to ensure that you can access resources on the computers within the domain. Select the domains that contain the computers hosting data that is of interest to you. To add a service account 1. In the Data Governance Navigation view, right-click Service accounts, and select New. 2. In the Change master data form, select the Active Directory account, and enter the password and comments. 3. Save your changes. Data Governance requires administrative rights over computers in the target domains to scan their computers. This is established through adding domains and assigning a service account. To enable Data Governance Server to interact with computers in a domain 1. Select Active Directory in the Quest One Identity Manager Navigation view and expand the domains node. 2. Select the required domain, and click Change master data in the Tasks view. 3. Select the Active Directory tab, and select the Data Governance account. 4. Save your changes. Deploying File Server Managed Hosts Open the Identity Manager Administration Tool and connect with a Employee mapped to an Active Directory account with Domain Admin privileges. You have the option of adding a local or remote Windows computer, a Windows cluster, EMC or NetApp devices, or SharePoint farm as a managed host. You can also add multiple managed hosts at once. To add a managed host with a local agent 1. In the Navigation view, select Managed hosts. 2. In the Tasks view, select Add managed host. 3. Select Locally Managed Windows Computer and click Add. 55

56 Quest One Identity Manager Data Governance Edition 4. Select the General tab, and the computer to scan from the Server list. When you install a locally managed host, you have the option of automatically installing the agent with the host, or manually installing the agent at a later date. Although it is recommended that you install the agent with the host, so you can properly configure it, if you are unable to do so due to a firewall or other security issues, you can manually install it after you set up the managed host. On the Agent Details page, choose External for the deployment method, and then run the Agent.msi file located in the Data Governance installation folder on the locally managed host. You must now decide if you want to enable resource activity tracking for the agent. 5. Select the Resource Activity tab, and configure the resource activity tracking. 6. Select the Aggregation period. As resource activity is continuously tracked, this period is used to group together the results over a period of time. 7. To limit network traffic, select Enable activity synchronization window. 8. To excluded accounts and objects from tracking, click the Manage Exclusions button and select the objects to exclude. a) Select to add or remove users or groups, file extensions or folders to be monitored for resource activity. b) Use the Export and Import buttons on their respective tabs to export and import a list of SIDs, file types, or folders to exclude. For file extensions, you can enter a Category name to group any extensions you add to the exclusions list. c) Select OK to save the changes. 9. To selectively scan a host, select the Security Index Roots tab, and select Add security index roots from the Tasks view. For a local host, you need to add and save your changes before you can add a security index root. For a remote host, you need to add and save your changes, then add an agent and save your changes before you can add a security index root. 10. Choose the directory to be scanned and the required agent, and click OK. Local agents by default scan all local fixed volumes on their host computer. 11. Save your changes. To add a managed host with a remote agent 1. In the Navigation view, select Managed hosts. 2. In the Tasks view, select Add managed host. 3. Select the Remotely Managed Windows Computer option, and click Add. For remotely managed hosts, the first remote agent should be added during the host s initial deployment. You can manually add more remote agents later, if needed. 4. Select the General tab, and the computer to scan from the Server list. Real-time file system security index updating and Rescan on error are checked by default. 5. Save your changes. 6. Select the Agents tab, and click Add agent in the Tasks view. 7. Select the agent host computer from the Server location list, and select a service account with sufficient permissions to access both the target computer and the agent host. Save the agent data. An agent requires a service account that has the right to read security information on the remote host. This account is configured separately, and then selected when you deploy the agent. 8. Select the newly created managed host in the Result list, and select the Scanning Schedule tab to set the time and frequency with which the agent scans the target computer. 9. Select the Security Index Roots tab to select the roots to scan. 56