Product Overview Guide

Transcription

1 IBM Security Identity Manager Version 6.0 Product Oeriew Guide GC

2

3 IBM Security Identity Manager Version 6.0 Product Oeriew Guide GC

4 Note Before using this information and the product it supports, read the information in Notices on page 71. Edition notice Note: This edition applies to ersion 6.0 of IBM Security Identity Manager (product number 5724-C34) and to all subsequent releases and modifications until otherwise indicated in new editions. Copyright IBM Corporation 2012, US Goernment Users Restricted Rights Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

5 Table of contents Table list About this publication ii Access to publications and terminology..... ii Accessibility iii Technical training iii Support information iii Statement of Good Security Practices ix Chapter 1. How to obtain software images Chapter 2. Hardware and software requirements Hardware requirements Operating system support Virtualization support Jaa Runtime Enironment support WebSphere Application Serer support Database serer support Directory serer support Directory Integrator support Report serer support Prerequisites for IBM Cognos report serer Browser requirements for client connections Adapter leel support Chapter 3. What's new in this release 11 Account ownership type Identity Serice Center user interface Shared access module Role management Extended role attributes Role assignment attributes Serice management and proisioning Serice leel form Serice connection mode Serice status and failure retry Serice tagging Enhanced adapter testing Account and access management Multiple leel access types Account search in the self serice console Authentication with an external user registry configured with WebSphere Vertical cluster support Application programming interfaces Web Serices API Extensions to the Recertification Policy API Enhanced logging APIs for use in custom JaaScript Report data synchronization enhancements Health monitoring IBM Cognos reporting framework Chapter 4. Known limitations, problems, and workarounds Chapter 5. Features oeriew Access management Shared access Shared access documentation Roadmap for configuring shared access for a managed resource Support for corporate regulatory compliance Identity goernance Triple user interface Administratie console user interface Self-care user interface Identity Serice Center user interface Recertification Reporting Static and dynamic roles Self-access management Proisioning features Resource proisioning Request-based access to resources Roles and access control Hybrid proisioning model Chapter 6. Technical oeriew Users, authorization, and resources Main components People oeriew Users Identities Accounts Access Passwords Resources oeriew Serices Adapters Adapter communication with managed resources 58 System security oeriew Security model characteristics Business requirements Resource access from a user's perspectie Organization tree oeriew Nodes in an organization tree Entity types associated with a business unit.. 63 Entity searches of the organization tree Policies oeriew Workflow oeriew Copyright IBM Corp. 2012, 2013 iii

6 Chapter 7. Initial login and password information Notices Index i IBM Security Identity Manager Version 6.0: Product Oeriew Guide

7 Table list 1. Hardware requirements for IBM Security Identity Manager Operating system support Virtualization support Database serer support Directory serer support Supported ersions of IBM Tioli Directory Integrator Software requirements for IBM Cognos report serer Prerequisites to run the UNIX and Linux adapter More information on role assignment attributes Shared access features Installation and upgrade System configuration Shared access administration Data references Shared access troubleshooting Shared access application programming interfaces Shared access for users Configuring managed resources that are supported by the IBM Security Identity Manager Defining roles and proisioning policies to grant ownership of sponsored accounts Adding credentials with a connection to an account to the ault Adding credentials without a connection to an account to the ault Configuring a shared access policy to grant access to the credentials Summary of reports Policy types and naigation Initial user ID and password for IBM Security Identity Manager Copyright IBM Corp. 2012, 2013

8 i IBM Security Identity Manager Version 6.0: Product Oeriew Guide

9 About this publication IBM Security Identity Manager Product Oeriew Guide proides the general information about IBM Security Identity Manager. It includes the information about: The product release, such as new or deprecated product features and functions The open standards, technologies, and architecture on which the product is based The user model and roles underlying the product features The graphical interfaces and tools proided to support arious user roles Access to publications and terminology This section proides: A list of publications in the IBM Security Identity Manager library. Links to Online publications. A link to the IBM Terminology website on page iii. IBM Security Identity Manager library The following documents are aailable in the IBM Security Identity Manager library: IBM Security Identity Manager Quick Start Guide, CF3L2ML IBM Security Identity Manager Product Oeriew Guide, GC IBM Security Identity Manager Scenarios Guide, SC IBM Security Identity Manager Planning Guide, GC IBM Security Identity Manager Installation Guide, GC IBM Security Identity Manager Configuration Guide, SC IBM Security Identity Manager Security Guide, SC IBM Security Identity Manager Administration Guide, SC IBM Security Identity Manager Troubleshooting Guide, GC IBM Security Identity Manager Error Message Reference, GC IBM Security Identity Manager Reference Guide, SC IBM Security Identity Manager Database and Directory Serer Schema Reference, SC IBM Security Identity Manager Glossary, SC Online publications IBM posts product publications when the product is released and when the publications are updated at the following locations: IBM Security Identity Manager library The product documentation site displays the welcome page and naigation for the library. com.ibm.isim.doc_ /kc-homepage.htm Copyright IBM Corp. 2012, 2013 ii

10 IBM Security Systems Documentation Central IBM Security Systems Documentation Central proides an alphabetical list of all IBM Security Systems product libraries and links to the online documentation for specific ersions of each product. IBM Publications Center The IBM Publications Center site linkweb/publications/serlet/pbi.wss offers customized search functions to help you find all the IBM publications you need. IBM Terminology website The IBM Terminology website consolidates terminology for product libraries in one location. You can access the Terminology website at software/globalization/terminology. Accessibility Accessibility features help users with a physical disability, such as restricted mobility or limited ision, to use software products successfully. With this product, you can use assistie technologies to hear and naigate the interface. You can also use the keyboard instead of the mouse to operate all features of the graphical user interface. Technical training Support information For additional information, see the topic "Accessibility features for IBM Security Identity Manager" in the IBM Security Identity Manager Reference Guide. For technical training information, see the following IBM Education website at If you hae a problem with your IBM software, you want to resole it quickly. IBM proides the following ways for you to obtain the support you need: Online Go to the IBM Software Support site at support/probsub.html and follow the instructions. IBM Support Assistant The IBM Support Assistant (ISA) is a free local software sericeability workbench that helps you resole questions and problems with IBM software products. The ISA proides quick access to support-related information and sericeability tools for problem determination. To install the ISA software, see the IBM Security Identity Manager Installation Guide. Also see: Troubleshooting Guide For more information about resoling problems, see the IBM Security Identity Manager Troubleshooting Guide. iii IBM Security Identity Manager Version 6.0: Product Oeriew Guide

11 Statement of Good Security Practices IT system security inoles protecting systems and information through preention, detection and response to improper access from within and outside your enterprise. Improper access can result in information being altered, destroyed, misappropriated or misused or can result in damage to or misuse of your systems, including for use in attacks on others. No IT system or product should be considered completely secure and no single product, serice or security measure can be completely effectie in preenting improper use or access. IBM systems, products and serices are designed to be part of a comprehensie security approach, which will necessarily inole additional operational procedures, and may require other systems, products or serices to be most effectie. IBM DOES NOT WARRANT THAT ANY SYSTEMS, PRODUCTS OR SERVICES ARE IMMUNE FROM, OR WILL MAKE YOUR ENTERPRISE IMMUNE FROM, THE MALICIOUS OR ILLEGAL CONDUCT OF ANY PARTY. About this publication ix

12 x IBM Security Identity Manager Version 6.0: Product Oeriew Guide

13 Chapter 1. How to obtain software images IBM Security Identity Manager installation files and fix packs can be obtained with the IBM Passport Adantage website, or from a DVD distribution. The Passport Adantage website proides packages, called eassemblies, for IBM products. To obtain eassemblies for IBM Security Identity Manager, follow the instructions in the IBM Security Identity Manager Download Document. The IBM Security Identity Manager Installation Guide proides full instructions for installing IBM Security Identity Manager and the prerequisite middleware products. The procedure that is appropriate for your organization depends on the following conditions: Operating system used by IBM Security Identity Manager Language requirements for using the product Type of installation you need to do: eassembly for the product and all prerequisites The IBM Security Identity Manager installation program enables you to install IBM Security Identity Manager, prerequisite products, and required fix packs as described in the IBM Security Identity Manager Installation Guide. Use this type of installation if your organization does not currently use one or more of the products required by IBM Security Identity Manager. eassembly for a manual installation You can install IBM Security Identity Manager separately from the prerequisites, and you can install separately any of the prerequisite products that are not installed. In addition, you must erify that each prerequisite product is operating at the required fix or patch leel. Copyright IBM Corp. 2012,

14 2 IBM Security Identity Manager Version 6.0: Product Oeriew Guide

15 Chapter 2. Hardware and software requirements Hardware requirements IBM Security Identity Manager has specific hardware requirements and supports specific ersions of operating systems, middleware, and browsers. The topics in this section list the hardware requirements and the supported ersions for each of the software products. The information lists the supported ersions when the product release was released. Note: Support for prerequisite software is continuously updated. To reiew the latest updates to this information, see the Software Product Compatibility Reports page at IBM Security Identity Manager has these hardware requirements: Table 1. Hardware requirements for IBM Security Identity Manager System components Minimum alues* Suggested alues** System memory (RAM) 2 gigabytes 4 gigabytes Processor speed Single 2.0 gigahertz Intel or pseries processor Dual 3.2 gigahertz Intel or pseries processors Disk space for product and 20 gigabytes 25 gigabytes prerequisite products * Minimum alues: These alues enable a basic use of IBM Security Identity Manager. ** Suggested alues: You might need to use larger alues that are appropriate for your production enironment. Operating system support IBM Security Identity Manager supports multiple operating systems. The IBM Security Identity Manager installation program checks to ensure that specific operating systems and leels are present before it starts the installation process. Table 2. Operating system support Operating system Platform Patch or maintenance leel AIX Version 6.1 System p None AIX Version 7.1 System p None Oracle Solaris 10 SPARC None Windows Serer 2008 Standard Edition x86-32 None x86-64 Windows Serer 2008 Enterprise Edition Windows Serer 2008 Release 2 Standard Edition x86-32 x86-64 None x86-64 None Copyright IBM Corp. 2012,

16 Table 2. Operating system support (continued) Operating system Platform Patch or maintenance leel Windows Serer 2008 Release 2 x86-64 None Enterprise Edition Windows Serer 2012 Standard x86-64 None Edition Red Hat Enterprise Linux 5.0 x86-32, x86-64, For 5.0, Update 6. System p, System z Red Hat Enterprise Linux 6.0 For 6.0, Update 5. x86-32, x86-64, System p, System z For both 5.0 and 6.0, Security Enhanced Linux must be disabled. See the topic "Red Hat Linux Serer Configuration" in the IBM Security Identity Manager Installation Guide. SUSE Linux Enterprise Serer 10.0 SUSE Linux Enterprise Serer 11.0 System p, System z, x86-32, x86-64 System p, System z, x86-32, x86-64 For 10, SP3 For 11, SP1 Virtualization support IBM Security Identity Manager supports irtualization enironments. See Table 3 for a list of the irtualization products that IBM Security Identity Manager supports at the time of product release. Table 3. Virtualization support Product IBM AIX Workload Partitioning (WPAR) and Logical Partitioning (LPAR) 6.1 and 7.1 and future fix packs IBM PowerVM Hyperisor (LPAR, DPAR, Micro-Partition), any supported ersion and future fix packs IBM PR/SM, any ersion, and future fix packs IBM z/vm Hyperisor 5.4 and any future fix packs IBM z/vm Hyperisor 6.1 and any future fix packs KVM in SUSE Linux Enterprise Serer (SLES) 11 Red Hat KVM as deliered with Red Hat Enterprise Linux (RHEL) 5.4 and future fix packs Red Hat KVM as deliered with Red Hat Enterprise Linux (RHEL) 6.0 and future fix packs Sun Solaris 10 Global/Local Zones (SPARC) 10 and future fix packs Applicable operating systems All supported operating system ersions automatically applied AIX All supported operating system ersions automatically applied All supported operating system ersions automatically applied Linux All supported operating system ersions automatically applied Linux, Windows All supported operating system ersions automatically applied All supported operating system ersions automatically applied 4 IBM Security Identity Manager Version 6.0: Product Oeriew Guide

17 Table 3. Virtualization support (continued) Product Sun/Oracle Logical Domains (LDoms) any ersion and future fix packs VMware ESXi 4.0 and future fix packs VMware ESXi 5.0 and future fix packs Applicable operating systems Solaris All supported operating system ersions automatically applied All supported operating system ersions automatically applied Jaa Runtime Enironment support IBM Security Identity Manager requires the Jaa Runtime Enironment (JRE). When a required ersion of the WebSphere Application Serer is installed, the required ersion or a later ersion of the JRE is installed in the WAS_HOME/jaa directory. For information about the required ersions of the WebSphere Application Serer, see WebSphere Application Serer support. Use of an independently installed deelopment kit for Jaa, from IBM or other endors, is not supported. The Jaa Runtime Enironment requirements for using a browser to create a client connection to the IBM Security Identity Manager serer are different than the JRE requirements for running the WebSphere Application Serer. WebSphere Application Serer support Database serer support IBM Security Identity Manager runs as an enterprise application in a WebSphere Application Serer enironment. IBM Security Identity Manager requires one of the following ersions of WebSphere Application Serer: WebSphere Application Serer, Version 8.5 with WebSphere Application Serer V8.5 Fix Pack 2. WebSphere Application Serer, Version 8.5, Network Deployment, with the Identity Serice Center user interface. WebSphere Application Serer V8.5 Fix Pack 2 is required for support of all platforms. WebSphere Application Serer, Version 7.0, with the WebSphere Fix Pack 29. WebSphere supports each of the operating systems that IBM Security Identity Manager supports. Reiew the WebSphere website for WebSphere requirements for each operating system: &uid=swg IBM Security Identity Manager supports multiple database serer products. Chapter 2. Hardware and software requirements 5

18 Note: The Identity Serice Center and Cognos reporting do not support Microsoft SQL Serer database. Use DB2 database or Oracle database instead. Table 4. Database serer support Database serer Fix pack Notes IBM DB2 Enterprise Version IBM DB2 Enterprise Version IBM DB2 Enterprise Version Oracle 10g Standard Edition and Enterprise Edition Release 2 Oracle 11g Standard and Enterprise Edition Release 2 Microsoft SQL Serer Enterprise Edition 2008 Microsoft SQL Serer Enterprise Edition 2008 Release 2 Fix Pack 3 IBM DB2 Workgroup Edition is required for Linux 32 bit operating system. Fix Pack 7 IBM DB2 Workgroup Edition is required for Linux 32 bit operating system. Red Hat Linux 6.0 requires Fix Pack 4. Windows 2012 requires Fix Pack 7. Fix Pack 2 IBM DB2 Enterprise 10.1 is only supported on 64 bit operating systems. Using IBM DB with IBM Tioli Directory Serer 6.3 requires Fix Pack 21. none none none none The Oracle database drier is required for both Oracle 10g Release 2 and 11g databases. The Oracle database drier is required for both Oracle 10g Release 2 and 11g databases. Directory serer support IBM Security Identity Manager supports multiple directory serers. Table 5. Directory serer support Directory serer IBM Tioli Directory Serer, Version 6.2 IBM Tioli Directory Serer, Version 6.3 Fix packs Fix Pack 29 Fix Pack 21 Notes IBM Tioli Directory Serer supports the operating system releases that IBM Security Identity Manager supports. IBM Tioli Directory Serer, Version 6.3 Fix Pack 21 is required for IBM Tioli Directory Serer V6.3 to work with IBM DB A fix pack can hae requirements for a specific leel of Global Security ToolKit (GSKit). For more information, see documentation that the directory serer product proides. For example, access this website: support/entry/portal/ documentation_expanded_list/software/ security_systems/tioli_directory_serer 6 IBM Security Identity Manager Version 6.0: Product Oeriew Guide

19 Table 5. Directory serer support (continued) Directory serer Sun Directory Serer Enterprise Edition and 7.0 Oracle Directory Serer Enterprise Edition Fix packs none none Notes See Oracle documentation to erify operating system support. Directory Integrator support IBM Security Identity Manager supports IBM Tioli Directory Integrator. You can optionally install IBM Tioli Directory Integrator for use with IBM Security Identity Manager. IBM Tioli Directory Integrator is used to enable communication between the installed agentless adapters and IBM Security Identity Manager. See the IBM Security Identity Manager Installation Guide. Table 6. Supported ersions of IBM Tioli Directory Integrator Release Fix pack IBM Tioli Directory Integrator, Version 7.1 Fix Pack 3 IBM Tioli Directory Integrator, Version Fix Pack 2 Report serer support IBM Tioli Directory Integrator supports each of the operating system ersions that IBM Security Identity Manager supports. IBM Security Identity Manager supports IBM Tioli Common Reporting Version Note: Though IBM Tioli Common Reporting is currently supported, it is being deprecated. It is the best practice to use IBM Cognos Business Intelligence Serer ersion to generate IBM Security Identity Manager reports. The following fix packs and interim fixes are required. Install the fixes in the following order: 1. IBM Tioli Common Reporting, Version 2.1.1, interim fix 2 2. IBM Tioli Common Reporting, Version 2.1.1, interim fix 5 3. IBM Tioli Integrated Portal Fix Pack IBM Tioli Common Reporting, Version 2.1.1, interim fix 6 To obtain fixes: Download the latest fixes for IBM Tioli Common Reporting Serer from the Fix Central website at Obtain and install the IBM Tioli Integrated Portal Fix Pack before you install IBM Tioli Common Reporting, Version 2.1.1, interim fix 6. For instructions for obtaining IBM Tioli Integrated Portal Fix Pack , see the IBM deeloperworks topic: Tioli Common Reporting Interim Fix 6. Chapter 2. Hardware and software requirements 7

20 Prerequisites for IBM Cognos report serer IBM Security Identity Manager supports IBM Cognos Business Intelligence Serer ersion You must install the software in the following table to work with IBM Security Identity Manager Cognos reports. Table 7. Software requirements for IBM Cognos report serer Software For more information, see IBM Cognos Business Intelligence Serer, ersion Web serer Data sources 1. Access the IBM Cognos Business Intelligence documentation at 10r2m1/index.jsp. 2. Search for Business Intelligence Installation and Configuration Guide Search for the installation information and follow the procedure. 1. Access the IBM Cognos Business Intelligence documentation at 10r2m1/index.jsp. 2. In the right pane of the home page, under Supported hardware and software section, click IBM Cognos Business Intelligence Supported Software Enironments. 3. Click tab. 4. Click Software in the Requirements by type column under the section IBM Cognos Business Intelligence Search for Web Serers section. 1. Access the IBM Cognos Business Intelligence documentation at 10r2m1/index.jsp. 2. In the right pane of the home page, under Supported hardware and software section, click IBM Cognos Business Intelligence Supported Software Enironments. 3. Click tab. 4. Click Software in the Requirements by type column under the section IBM Cognos Business Intelligence Search for Data Sources section. Note: Optionally, you can install IBM Framework Manager, ersion if you want to customize the reports or models. 8 IBM Security Identity Manager Version 6.0: Product Oeriew Guide

21 Browser requirements for client connections IBM Security Identity Manager has browser requirements for client connections. IBM Security Identity Manager supports the following browser ersions: Microsoft Internet Explorer 9.0 Microsoft Internet Explorer 10.0 Mozilla Firefox 3.6 (supported on AIX only) Note: 1. Microsoft Internet Explorer 10.0 Metro mode is not supported. 2. Firefox 3.6 requires the Next-Generation Jaa plug-in, which is included in Jaa 6 Update 10 and newer ersion. 3. The Identity Serice Center user interface is not supported in Firefox 3.6. Mozilla Firefox 10 Extended Support Release (not supported on AIX) Note: The Identity Serice Center user interface is not supported in Firefox 10 Extended Support Release. Mozilla Firefox 17 Extended Support Release (not supported on AIX) Mozilla Firefox 24 Extended Support Release (not supported on AIX) IBM Security Identity Manager software distribution does not include the supported browsers. The IBM Security Identity Manager administratie user interface uses applets that require a Jaa plug-in that is proided by Sun Microsystems JRE Version 1.6 or higher. When the browser requests a page that contains an applet, it attempts to load the applet with the Jaa plug-in. If the required JRE is not present on the system, the browser prompts the user for the correct Jaa plug-in, or fails to complete the presentation of the items in the window. The IBM Security Identity Manager user interface is displayed correctly for all pages that do not contain a Jaa applet, regardless of JRE installation. You must enable cookies in the browser to establish a session with IBM Security Identity Manager. Do not start two or more separate browser sessions from the same client computer. The two sessions are regarded as one session ID, which causes problems with the data. Adapter leel support The IBM Security Identity Manager installation program always installs a number of adapter profiles. The installation program installs these profiles: AIX profile (UNIX and Linux adapter) Solaris profile (UNIX and Linux adapter) HP-UX profile (UNIX and Linux adapter) Linux profile (UNIX and Linux adapter) LDAP profiles (LDAP adapter) The IBM Security Identity Manager installation program optionally installs the IBM Security Identity Manager LDAP adapter and IBM Security Identity Manager Chapter 2. Hardware and software requirements 9

22 UNIX and Linux adapter. Newer ersions of the adapters might be aailable as separate downloads. Install the latest ersions before you use the adapters. You must take additional steps to install adapters if you choose not to install them during the IBM Security Identity Manager installation. The following table lists the UNIX and Linux systems and ersions that are supported by the UNIX and Linux adapter. Table 8. Prerequisites to run the UNIX and Linux adapter Operating system Version AIX AIX 6.1, AIX 7.1 HP-UX HP-UX 11i1, HP-UX 11i1 trusted, HP-UX 11i2, HP-UX 11i2 trusted, HP-UX 11i3, HP-UX 11i3 trusted Red Hat Linux Red Hat Enterprise Linux Enterprise Serer 6.0, Red Hat Enterprise Linux Enterprise Serer 6.1, Red Hat Enterprise Linux Enterprise Serer 6.2 Oracle Solaris Oracle Solaris 10 SUSE Linux SLES 10.0, SLES 11.0 The following directory serer ersions are supported by the LDAP adapter: IBM Tioli Directory Serer 6.1, IBM Tioli Directory Serer 6.2, IBM Tioli Directory Serer 6.3 Sun Directory Serer Enterprise Edition 6.3, Sun Directory Serer Enterprise Edition The LDAP adapter supports an LDAP directory that uses the RFC 2798 scheme. This scheme supports communication between the IBM Security Identity Manager and systems that run IBM Tioli Directory Serer or Sun Directory Serer Enterprise Edition. The IBM Security Identity Manager LDAP Adapter Installation Guide describes how to configure the LDAP adapter. Adapters are aailable at the following IBM Passport Adantage website: passporthome Installation and configuration guides for adapters can be found in the IBM Security Identity Manager product documentation website at infocenter/tiihelp/2r1/index.jsp?topic=/com.ibm.isim.doc_ /kchomepage.htm. 10 IBM Security Identity Manager Version 6.0: Product Oeriew Guide

23 Chapter 3. What's new in this release Account ownership type IBM Security Identity Manager Version 6.0 proides new infrastructure, processes, and controls to support priileged identity management. In addition, it proides enhanced support for operational role management and integration with other identity and access management solutions. Note: The documentation updates in this library are added in the context of the IBM Security Identity Manager, ersion 6.0.0, Fix Pack 2. The Identity Serice Center, Cognos Reporting, and selected Shared Access features can only be aailable in your system after you install the fix pack. See the following README files for installation, configuration, and remoal details. ISIM6.0.0FP2_InstallAndConfig_README.pdf ISIM6.0.0FP2_UnInstallAndManualRemoal_README.pdf ISPIM1.0.1FP2_InstallandConfig_README.pdf See the topics that follow for detailed descriptions of new features and function. New account ownership types separate personal accounts from custodial accounts. Accounts that represent a user identity for personal use are indiidual accounts. All other accounts are sponsored accounts. Examples of sponsored accounts include the root account on a UNIX system, application accounts, and deice accounts. The owner of a sponsored account typically configures the account and completes maintenance tasks such as password reset. Password synchronization applies only to indiidual accounts. Account entitlements in a proisioning policy are specified differently for each account type. The type of ownership affects the password management process and proisioning policy ealuation. For example, password synchronization synchronizes passwords only for accounts of ownership type "Indiidual". For proisioning policies, entitlement to a particular serice can be based on the specific ownership type on the serice. You can filter accounts by ownership type when doing account management tasks. You can specify the ownership type when completing account request and account adoption tasks. See "Ownership type management" in the IBM Security Identity Manager Configuration Guide. Identity Serice Center user interface IBM Security Identity Manager introduces the Identity Serice Center, a new user interface, which proides the capability for managers or indiiduals to request access for indiiduals. Copyright IBM Corp. 2012,

24 Shared access module Note: The Identity Serice Center does not support Microsoft SQL Serer database. Use DB2 Uniersal Database or Oracle database instead. Unified access catalog The Identity Serice Center user interface contains a unified access catalog that proides sets of tasks, each tailored for the needs of the default user types: System administrator Manager Employee Auditor Enhanced user experience The Identity Serice Center gies you an enhanced user experience that is tailored to your business goals: Request access to applications View your requests Modern, intuitie, and efficient user interface You can model your business goals and user interface with a dedicated flow. The Identity Serice Center has: Type ahead search Guided tasks Usable layout Work flow and tasks that are applicable to your business goals Context-sensitie help Customizable user interface System administrators can easily customize the Identity Serice Center user interface either by copying and modifying the customizable files that are installed with IBM Security Identity Manager. They can also customize the new user interface by replacing the icons and graphics. See the Identity Serice Center user interface customization section of the IBM Security Identity Manager Configuration Guide for details. IBM Security Identity Manager proides a shared access module that extends the identity and access management goernance capabilities by supporting priileged identity management. The shared access module is used by an IBM product called IBM Security Priileged Identity Manager. When you purchase IBM Security Priileged Identity Manager, you obtain a license to use the IBM Security Identity Manager shared access module. You can then install the optional shared access module component as part of the IBM Security Identity Manager installation. The shared access module proides the following support for priileged identity management: Credential ault management for shared credentials, which can be connected or not connected to accounts. Lifecycle management of shared credentials. This management includes role-based access requests, role membership, and shared credential access. 12 IBM Security Identity Manager Version 6.0: Product Oeriew Guide

25 Auditing of shared credential actiity to monitor accountability and compliance. Single sign-on with automated checkin and checkout of shared IDs. Automation of checkout and checkin is achieed when IBM Security Identity Manager is deployed as part of the IBM Security Priileged Identity Manager product solution. Management of shared credentials that are not connected to accounts. Ability to connect credentials to an account so that the password can be changed at checkin; ability to disconnect credentials from an account. The following items are deprecated: Adding credentials to the ault through Manage Users, Manage Serices > Accounts, ormanage Groups > Manage Members. Instead, use Manage Shared Access > Manage Credential Vault. The #Credentials type identifier is deprecated and is proided for users with existing CSV files from a preious release. If you use this type identifier, read the column header descriptions because some of them hae changed. It is suggested, howeer, that you use the #Credentials_2 type identifier instead of the #Credentials type identifier in your CSV files for shared access bulk load. The USE_GLOBAL_SETTINGS column header in the CSV file is changed to USE_DEFAULT_SETTINGS. The following access control items (ACIs) are added: Protection category Name Type Principal Credential Default ACI for Credential: Grant All to Domain Admin ercredential Domain Admin Credential Lease Default ACI for Credential Lease: Grant All to Domain Admin ercredentiallease Domain Admin Account Default ACI for Account: Grant Connect to Domain Admin and Account Owner eraccountitem Domain Admin Account Owner Credential Serice Default ACI for Credential Serice: Grant All to Domain Admin ercvserice Domain Admin Person Default ACI for Person: Grant Search and role assignment to Priileged Administrator Group erpersonitem Priileged Admin The following ACIs are remoed: Protection category Name Type Principal Identity Manager User Default ACI for ITIM User: Grant Delegate to Priileged Administrator Group ersystemuser Priileged Admin Identity Manager User Default ACI for ITIM User: Grant Add to Priileged Administrator Group ersystemuser Priileged Admin Recertification Policy Default ACI for Recertification Policy: Grant All to Priileged Administrator Group errecertificationpolicy Priileged Admin Report Default ACI for Pending Recertification Report: Grant Run to Priileged Administrator Group Pending Recertification Report Priileged Admin Chapter 3. What's new in this release 13

26 Protection category Name Type Principal Report Static Organizational Role Default ACI for Recertification Policies Report: Grant Run to Priileged Administrator Group Default ACI for Role: Grant All to Priileged Administrator Group Recertification Policies Report errole Priileged Admin Priileged Admin Role management For more information, see: Shared access on page 26 IBM Security Priileged Identity Manager product documentation website. Role management now includes management of extended role attributes and role assignment attributes. Extended role attributes The IBM Security Identity Manager administrator can define, set, and modify extended role attributes when creating or modifying a role. These actions are achieed by using a new form template introduced in the form designer for role customization. Both static and dynamic roles support extended role attributes. Note: Before you can use extended role attributes, you must first set the extended role attributes in LDAP by extending the role definition schema. After you add the extended role attributes in LDAP, use the form designer to customize and sae form templates for roles in the IBM Security Identity Manager administratie console. Role assignment attributes The role administration component is enhanced to include the ability to define role assignment attributes, which are associated with the person-role relationship. Only static roles support assignment attributes. Only the string type and text widget of assignment attributes are supported. Optional role assignment attributes tasks include: Defining role assignment attributes when creating or modifying a static role. Associating a custom label with each assignment attribute. Specifying assignment attribute alues when adding user members to the role. Specifying assignment attribute alues to the existing user members of the role. ACI capabilities for role assignment attributes Both the default and new ACIs supports attribute-leel permissions for role assignment attributes like other attributes in the role definition. You can now modify or create ACIs. You can set attribute-leel permissions for granting or denying usage of these role assignment attributes within the role definition. Only authorized users can read or write assignment attributes. Additionally, you can: Set ACIs to read or write assignment attribute alues when adding a user to the role. Set assignment attribute alues to the existing user members. 14 IBM Security Identity Manager Version 6.0: Product Oeriew Guide

27 ACI works the same way as it does for other entities. There is not ACI on specific role assignment attributes. The following attributes are aailable: erroleassignmentkey is on the role that dictates the permission to define role assignment attributes on the role and an attribute. erroleassignments is on the person that dictates the permission to assign alues for the assignment attributes. You cannot define ACI on the assignment attribute that you defined on the role. JaaScript capabilities for role assignment attributes You can access these capabilities for role assignment attributes within the JaaScript interface: The role assignment attributes of the role schema. The role assignment attributes and their alues for users in role membership. New JaaScript APIs include: Person Role RoleAssignmentAttribute RoleAssignmentObject For more information, see the reference pages in the IBM Security Identity Manager Reference Guide. Role assignment attributes and the self-serice console For more information about adding or modifying role assignment attributes for a user profile in the self-serice console, see the IBM Security Identity Manager Technotes. Additional information For more information on role assignment attributes, see the following topics: Table 9. More information on role assignment attributes Topic title Role assignment attributes Role assignment attribute tables Person Role RoleAssignmentAttribute RoleAssignmentObject IBM Security Identity Manager documentation Administration Guide Database and Directory Serer Schema Reference Reference Guide Serice management and proisioning Serice management and proisioning now supports a new account form, an adanced connection mode, new serice status information, and serice tagging. See: Serice leel form on page 16 Chapter 3. What's new in this release 15

28 Serice connection mode Serice status and failure retry on page 17 Serice tagging on page 17 Serice leel form You can specify different account forms for each serice instance of a particular serice type. You can define an account form for a serice in the console. For example, you can customize the form for the account type, such as Windows Local Account Form. This feature can specify different account forms for each serice instance of a particular serice type. This feature remoes the restriction of needing to use the same form for eery serice instance of a particular type. You can use your new form to request a new account or modify an existing account. You can also use your new form for proisioning policy parameters. If you hae an account form customized for a serice, and you select serice specific entitlements for that serice in the proisioning policy, the specific widget for that attribute that you customized is displayed. You can also use the new form for repeat account creation or modification in the administration console or the self serice console. See "Customizing account form templates for a serice instance" in the IBM Security Identity Manager Configuration Guide. Serice connection mode This release introduces a new serice form attribute for connection mode. Use this attribute to create a serice that can function like either an automated or a manual serice. You can now specify a serice connection mode of manual or automated. The connection mode setting dictates the IBM Security Identity Manager behaior for account management, and minimizes the configuration required for transition between different connection modes to end points. The new attribute for connection mode is erconnectionmode. This attribute enables you to create a serice and to specify a manual account request route before installing the adapter for the managed resource. The adantage of using connection mode is that you do not need to create and later remoe a manual serice. After installing the adapter, you can change the serice so that the managed resource handles the account requests. Use the change serice task to change connection mode from manual to automatic. After changing the serice type to automatic, it is the default setting for any serices of that serice type. Connection mode is not supported on ITIM serice or any type of identity feed serice, hosted serice, or manual serice types. Do not add the erconnectionmode attribute to the forms for those serice types. See the following topics in the "Serices administration" chapter of the IBM Security Identity Manager Administration Guide: "Enabling connection mode" 16 IBM Security Identity Manager Version 6.0: Product Oeriew Guide

29 "Creating a serice that has manual connection mode" "Changing connection mode from manual to automatic" Serice status and failure retry The IBM Security Identity Manager administratie console is enhanced to display status information for each serice, to search for serices with a specific status, and to proide an option to retry blocked requests. The alues in the serice status reflect the ability of the IBM Security Identity Manager serer to contact the managed resource for the serice for proisioning actions. The user interface also allows searching for serices with a specific status alue. You can use the alue to locate serices that failed or are recoering from a failure. This release proides a new action, Retry Blocked Requests, that you can use to immediately restart the blocked requests from the Manage Serices panel. This action tests a serice to see whether the problem is corrected. If the test is successful, it restarts any blocked requests for a failed serice. For more information, see the topic "Serice status" in the IBM Security Identity Manager Administration Guide. Serice tagging You can define multiple tags for a serice in the serice form. You can use serice tags to fine-tune proisioning policy entitlement for a serice type. You can specify that entitlement is only applicable for serices with matching tags. On the administration console, you can trigger automated proisioning of new accounts and policy enforcements on all accounts of a serice. Use the Manage Serices console entry point, select Search, and then open the twistie for a serice and click Enforce Policy. See the topic "Serice tagging" in the "Serices administration" chapter of the IBM Security Identity Manager Administration Guide. Enhanced adapter testing Serice management and proisioning now support enhanced adapter testing. Enhanced adapter testing proides more information and more status information of the adapter that is configured for the resource. To start the adapter test, click Test Connection in the serice form. Some examples about more information are adapter ersion, adapter installation platform, profile ersion, and other information. Some examples about status information are time stamp of preious test, memory usage, other information. For more information, see the Adapter documentation section in the IBM Security Identity Manager product documentation. Chapter 3. What's new in this release 17

30 Account and access management IBM Security Identity Manager extends account and access management to support multiple access leels, and to support account search in the self serice console. See: Multiple leel access types Account search in the self serice console Multiple leel access types IBM Security Identity Manager supports multiple leel of access types that simulate a hierarchical tree structure with a set of linked nodes. A hierarchy represents access leels. The access types are categorized in the form of parent-child access types. This structure aids in the administration of large deployments. An administrator can do these actions: Manage access types in a hierarchical tree structure. Search an access type by categories during an access request by using the tree structure. Specify an access type from any leel to associate with a group or role. Translate organizational access types into system-defined access types in a hierarchical tree structure. Categorize multiple access types in an organization for a particular access category. For example, access to all financial applications can be categorized under Application > Finance. A user can search, filter, or request for an access based upon the access types. See the topic Access type management in the IBM Security Identity Manager Configuration Guide, and the topic Creating an access type based on role in the IBM Security Identity Manager Administration Guide. Account search in the self serice console Account search function is now aailable in the self serice console You can now search accounts when using the following features in the self serice console: Viewing or changing accounts Deleting accounts Changing passwords You can base the account search on ownership type, account ID, serice type (account profile), serice (account type), or organizational container. Authentication with an external user registry configured with WebSphere The IBM Security Identity Manager authentication mechanism is integrated with the container-based security capabilities of WebSphere Application Serer. 18 IBM Security Identity Manager Version 6.0: Product Oeriew Guide

31 Vertical cluster support IBM Security Identity Manager users can authenticate against a WebSphere Application Serer user registry, and then be mapped to an IBM Security Identity Manager user. The login support includes: Forgotten password, with challenge response Password expiration Account suspension with maximum logon attempts You can use an external user registry when doing an initial installation of IBM Security Identity Manager. Alternatiely, you can install IBM Security Identity Manager with the custom registry, and then later reconfigure to use an external user registry. Use of an external user registry requires configuration of the WebSphere security domain. IBM Security Identity Manager proides documentation of an example configuration of how to configure an external user registry. The example documentation is in the extensions directory in the product distribution. If you want to use an external user registry during an initial installation of IBM Security Identity Manager, you must do configuration steps before the installation. If you want to configure an external user registry after the IBM Security Identity Manager installation, you must finish the installation with the default custom user registry and then manually configure the external user registry. For more information, see the topic "Using an external user registry for authentication" in the IBM Security Identity Manager Security Guide. You can now install IBM Security Identity Manager in a WebSphere deployment that uses ertical clusters. A ertical cluster has cluster members on the same node, or physical machine. A horizontal cluster has cluster members on multiple nodes across many machines in a cell. You can now install an IBM Security Identity Manager into both horizontal and ertical cluster topologies. For more information, see the following topics in the IBM Security Identity Manager Installation Guide: "Clustered configuration" "Creating the WebSphere clusters for the IBM Security Identity Manager application" Application programming interfaces IBM Security Identity Manager supports additional application programming interfaces. New additions include Web Serices API, new APIs to manage recertification policies, and new logging APIs for use in JaaScript. See: Web Serices API on page 20 Extensions to the Recertification Policy API on page 20 Chapter 3. What's new in this release 19