6.9 Configuring the User Application

The User Application install enables you to set User Application configuration parameters. Most of these parameters are also editable with configupdate.sh or configupdate.bat after installation; exceptions are noted in the parameter descriptions. For a cluster, specify identical User Application configuration parameters for each member of the cluster.

  1. Click Next through the first User Application Configuration page.

  2. Set the basic User Application configuration parameters described in Table Table 6-1, then continue with Step 3.

    Table 6-1 User Application Configuration: Basic Parameters

    Type of Setting

    Field

    Description

    eDirectory Connection Settings

    LDAP Host

    Required. Specify the hostname or IP address for your LDAP server and its secure port. For example:

    myLDAPhost
    

    LDAP Non-Secure Port

    Specify the non-secure port for your LDAP server. For example: 389.

    LDAP Secure Port

    Specify the secure port for your LDAP server. For example: 636.

    LDAP Administrator

    Required. Specify the credentials for the LDAP Administrator. This user must already exist. The User Application uses this account to make an administrative connection to the Identity Vault. This value is encrypted, based on the master key.

    LDAP Administrator Password

    Required. Specify the LDAP Administrator password. This password is encrypted, based on the master key.

    Use Public Anonymous Account

    Allows users who are not logged in to access the LDAP Public Anonymous Account.

    LDAP Guest

    Allows users who are not logged in to access permitted portlets. This user account must already exist in the Identity Vault. To enable the LDAP Guest, you must deselect Use Public Anonymous Account. To disable the Guest User, select Use Public Anonymous Account.

    LDAP Guest Password

    Specify the LDAP Guest password.

    Secure Admin Connection

    Select this option to require that all communication using the admin account be done using a secure socket. (This option can have adverse performance implications). This setting allows other operations that don't require SSL to operate without SSL.

    Secure User Connection

    Select this option to require that all communication using the logged-in user’s account be done using a secure socket. (This option can have adverse performance implications). This setting allows other operations that don't require SSL to operate without SSL.

    eDirectory DNs

    Root Container DN

    Required. Specify the LDAP distinguished name of the root container. This is used as the default entity definition search root when no search root is specified in the directory abstraction layer.

    Provisioning Driver DN

    Required. Specify the distinguished name of the User Application driver. For example, if your driver is UserApplicationDriver and your driver set is called myDriverSet, and the driver set is in a context of o=myCompany, you would type a value of:

    cn=UserApplicationDriver,cn=myDriverSet,o=myCompany
    

    User Application Admin

    Required. An existing user in the Identity Vault who has the rights to perform administrative tasks for the User Application user container specified. This user can use the Administration tab of the User Application to administer the portal.

    If the User Application Administrator participates in workflow administration tasks exposed in iManager, Novell Designer for Identity Manager, or the User Application ( Requests & Approvals tab), you must grant this administrator appropriate trustee rights to object instances contained in the User Application driver. Refer to the IDM User Application: Administration Guide for details.

    To change this assignment after you deploy the User Application, you must use the Administration > Security pages in the User Application.

    Provisioning Application Admin

    The Provisioning Application Administrator uses the Provisioning tab (under the Administration tab) to manage the Provisioning Workflow functions. These functions are available to users through the Requests and Approvals tab of the User Application. This user must exist in the Identity Vault prior to being designated the Provisioning Application Administrator.

    To change this assignment after you deploy the User Application, you must use the Administration > Security pages in the User Application.

    eDirectory DNs (continued)

    Roles Administrator

    This role is available in the Novell Identity Manager Roles Based Provisioning Module. This role allows members to create, remove, or modify all roles, and grant or revoke any role assignment to any user, group, or container. It also allows its role members to run any report for any user. By default, the User Application Admin is assigned this role.

    To change this assignment after you deploy the User Application, use the Roles > Role Assignment page in the User Application.

    User Container DN

    Required. Specify the LDAP distinguished name (DN) or fully qualified LDAP name of the user container. This defines the search scope for users and groups. Users in this container (and below) are allowed to log in to the User Application.

    IMPORTANT:Be sure the User Application Administrator specified during User Application driver setup exists in this container if you want that user to be able to execute workflows.

    Group Container DN

    Required. Specify the LDAP distinguished name (DN) or fully qualified LDAP name of the group container.

    Used by entity definitions within the directory abstraction layer.

    eDirectory Certificates

    Keystore Path

    Required. Specify the full path to your keystore ( cacerts) file of the JDK that the application server application server is using to run, or click the small browser button and navigate to the cacerts file.

    On Linux or Solaris, the user must have permission to write to this file.

    Keystore Password/Confirm Keystore Password

    Required. Specify the cacerts password. The default is changeit.

    Email

    Notify Template Host Token

    Specify the application server hosting the Identity Manager User Application. For example:

    myapplication serverServer
    

    This value replaces the $HOST$ token in e-mail templates. The URL that is constructed is the link to provisioning request tasks and approval notifications.

    Notify Template Port Token

    Used to replace the $PORT$ token in e-mail templates used in provisioning request tasks and approval notifications.

    Notify Template Secure Port token

    Used to replace the $SECURE_PORT$ token in e-mail templates used in provisioning request tasks and approval notifications.

    Notification SMTP Email From:

    Specify e-mail to come from a user in provisioning e-mail.

    Notification SMTP Email Host:

    Specify the SMTP e-mail host that provisioning e-mail is using. This can be an IP address or a DNS name.

    Password Management

    Use External Password WAR

    This feature enables you to specify a Forgot Password page residing in an external Forgot Password WAR and a URL that the external Forgot Password WAR uses to call back the User Application through a Web service.

    If you select Use External Password WAR, you must supply values for Forgot Password Link and Forgot Password Return Link.

    If you do not select Use External Password WAR, IDM uses the default internal Password Management functionality, . /jsps/pwdmgt/ForgotPassword.jsf (without the http(s) protocol at the beginning). This redirects the user to the Forgot Password functionality built into the User Application, rather than to an external WAR.

    Forgot Password Link

    This URL points to the Forgot Password functionality page. Specify a ForgotPassword.jsf file in an external or internal password management WAR.

    Forgot Password Return Link

    If you are using an external password management WAR, supply the path that the external Password Management WAR uses to call back the User Application through Web Services, for example https:// idmhost:sslport/idm .

  3. If you want to set additional User Application configuration parameters, click Show Advanced Options. (Scroll to view the whole panel.) Table Table 6-2 describes the Advanced Options parameters. If you do not want to set additional parameters described in this step, skip to Step 4.

    Table 6-2 User Application Configuration: All Parameters

    Type of Setting

    Field

    Description

    eDirectory Connection Settings

    LDAP Host

    Required. Specify the hostname or IP address for your LDAP server. For example:

    myLDAPhost

    LDAP Non-Secure Port

    Specify the non-secure port for your LDAP server. For example: 389.

    LDAP Secure Port

    Specify the secure port for your LDAP server. For example: 636.

    LDAP Administrator

    Required. Specify the credentials for the LDAP Administrator. This user must already exist. The User Application uses this account to make an administrative connection to the Identity Vault. This value is encrypted, based on the master key.

    LDAP Administrator Password

    Required. Specify the LDAP Administrator password. This password is encrypted, based on the master key.

    Use Public Anonymous Account

    Allows users who are not logged in to access the LDAP Public Anonymous Account.

    LDAP Guest

    Allows users who are not logged in to access permitted portlets. This user account must already exist in the Identity Vault. To enable LDAP Guest, you must deselect Use Public Anonymous Account. To disable Guest User, select Use Public Anonymous Account.

    LDAP Guest Password

    Specify the LDAP Guest password.

    Secure Admin Connection

    Select this option to require that all communication using the admin account be done using a secure socket. (This option can have adverse performance implications). This setting allows other operations that don't require SSL to operate without SSL.

    Secure User Connection

    Select this option to require that all communication done on the logged-in user's account be done using a secure socket. (This option can have severe adverse performance implications). This setting allows other operations that don't require SSL to operate without SSL.

    eDirectory DNs

    Root Container DN

    Required. Specify the LDAP distinguished name of the root container. This is used as the default entity definition search root when no search root is specified in the directory abstraction layer.

    Provisioning Driver DN

    Required. Specify the distinguished name of the User Application driver. For example, if your driver is UserApplicationDriver and your driver set is called myDriverSet, and the driver set is in a context of o=myCompany, you type a value of:

    cn=UserApplicationDriver,cn=myDriverSet,o=myCompany
    

    User Application Admin

    Required. An existing user in the Identity Vault who has the rights to perform administrative tasks for the User Application user container specified. This user can use the Administration tab of the User Application to administer the portal.

    If the User Application Administrator participates in workflow administration tasks exposed in iManager, Novell Designer for Identity Manager, or the User Application ( Requests & Approvals tab), you must grant this administrator appropriate trustee rights to object instances contained in the User Application driver. Refer to the IDM User Application: Administration Guide for details.

    To change this assignment after you deploy the User Application, you must use the Administration > Security pages in the User Application.

    Provisioning Application Admin

    The Provisioning Application Administrator manages Provisioning Workflow functions available through the Requests and Approvals tab of the User Application. This user must exist in the Identity Vault prior to being designated the Provisioning Application Administrator.

    To change this assignment after you deploy the User Application, you must use the Administration > Security pages in the User Application.

    Meta-Directory User Identity

    User Container DN

    Required. Specify the LDAP distinguished name (DN) or fully qualified LDAP name of the user container.

    This defines the search scope for users and groups.

    Users in this container (and below) are allowed to log in to the User Application.

    IMPORTANT:Be sure the User Application Administrator specified during User Application driver setup exists in this container if you want that user to be able to execute workflows.

    User Object Class

    The LDAP user object class (typically inetOrgPerson).

    Login Attribute

    The LDAP attribute (for example, CN) that represents the user’s login name.

    Naming Attribute

    The LDAP attribute used as the identifier when looking up users or groups. This is not the same as the login attribute, which is used only during login, and not during user/group searches.

    User Membership Attribute

    Optional. The LDAP attribute that represents the user’s group membership. Do not use spaces in this name.

     

    Roles Administrator

    This role is available in the Novell Identity Manager Roles Based Provisioning Module. This role allows members to create, remove, or modify all roles, and grant or revoke any role assignment to any user, group, or container. It also allows its role members to run any report for any user. By default, the User Application Admin is assigned this role.

    To change this assignment after you deploy the User Application, use the Roles > Role Assignment page in the User Application.

    Meta-Directory User Groups

    Group Container DN

    Required. Specify the LDAP distinguished name (DN) or fully qualified LDAP name of the group container. Used by entity definitions within the directory abstraction layer.

    Group Object Class

    The LDAP group object class (typically groupofNames).

    Group Membership Attribute

    The attribute representing the user’s group membership. Do not use spaces in this name.

    Use Dynamic Groups

    Select this option if you want to use dynamic groups.

    Dynamic Group Object Class

    The LDAP dynamic group object class (typically dynamicGroup).

    eDirectory Certificates

    Keystore Path

    Required. Specify the full path to your keystore ( cacerts) file of the JRE that the application server application server is using to run, or else click the small browser button and navigate to the cacerts file.

    The User Application installation modifies the keystore file. On Linux or Solaris, the user must have permission to write to this file.

    Keystore Password

    Confirm Keystore Password

    Required. Specify the cacerts password. The default is changeit.

    Private Key Store

    Private Keystore Path

    The private keystore contains the User Application’s private key and certificates. Reserved. If you leave this empty, this path is /jre/lib/security/cacerts by default.

    Private Keystore Password

    This password is changeit unless you specify otherwise. This password is encrypted, based on the master key.

    Private Key Alias

    This alias is novellIDMUserApp unless you specify otherwise.

    Private Key Password

    This password is nove1lIDM unless you specify otherwise. This password is encrypted, based on the master key.

    Trusted Key Store

    Trusted Store Path

    The Trusted Key Store contains all trusted signers’ certificates used to validate digital signatures. If this path is empty, the User Application gets the path from System property javax.net.ssl.trustStore. If the path isn’t there, it is assumed to be jre/lib/security/cacerts.

    Trusted Store Password

    If this field is empty, the User Application gets the password from System property javax.net.ssl.trustStorePassword. If the value is not there, changeit is used. This password is encrypted, based on the master key.

    Novell Audit Digital Signature and Certificate Key

     

    Contains the Novell Audit digital signature key and certificate.

     

    Novell Audit Digital Signature Certificate

    Displays the digital signature certificate.

     

    Novell Audit Digital Signature Private Key

    Displays the digital signature private key. This key is encrypted, based on the master key.

    Access Manager and iChain Settings

    Simultaneous Logout Enabled

    If this option is selected, the User Application supports simultaneous logout of the User Application and either Novell Access Manager or iChain. The User Application checks for a Novell Access Manager or iChain cookie on logout and, if the cookie is present, reroutes the user to the ICS logout page.

    Simultaneous Logout Page

    The URL to the Novell Access Manager or iChain logout page, where the URL is a hostname that Novell Access Manager or iChain expects. If ICS logging is enabled and a user logs out of the User Application, the user is rerouted to this page.

    Email

    Notify Template HOST token

    Specify the application server hosting the Identity Manager User Application. For example:

    myapplication serverServer
    

    This value replaces the $HOST$ token in e-mail templates. The URL that is constructed is the link to provisioning request tasks and approval notifications.

    Notify Template PORT token

    Used to replace the $PORT$ token in e-mail templates used in provisioning request tasks and approval notifications.

    Notify Template SECURE PORT token

    Used to replace the $SECURE_PORT$ token in e-mail templates used in provisioning request tasks and approval notifications.

    Notify Template PROTOCOL token

    Refers to a non-secure protocol, HTTP. Used to replace the $PROTOCOL$ token in e-mail templates used in provisioning request tasks and approval notifications.

    Notify Template SECURE PROTOCOL token

    Refers to a secure protocol, HTTPS. Used to replace the $SECURE_PROTOCOL$ token in e-mail templates used in provisioning request tasks and approval notifications.

    Notification SMTP Email From:

    Specify e-mail from a user in provisioning e-mail.

    Notification SMTP Email Host:

    Specify the SMTP e-mail host that provisioning e-mail is using. This can be an IP address or a DNS name.

    Password Management

     

     

    Use External Password WAR

    This feature enables you to specify a Forgot Password page residing in an external Forgot Password WAR and a URL that the external Forgot Password WAR uses to call back the User Application through a Web service.

    If you select Use External Password WAR, you must supply values for Forgot Password Link and Forgot Password Return Link.

    If you do not select Use External Password WAR, IDM uses the default internal Password Management functionality, . /jsps/pwdmgt/ForgotPassword.jsf (without the http(s) protocol at the beginning). This redirects the user to the Forgot Password functionality built into the User Application, rather than to an external WAR.

    Forgot Password Link

    This URL points to the Forgot Password functionality page. Specify a ForgotPassword.jsf file in an external or internal password management WAR.

     

    Forgot Password Return Link

    If you are using an external password management WAR, supply the path that the external Password Management WAR uses to call back the User Application through Web Services, for example https:// idmhost:sslport/idm .

    Miscellaneous

    Session Timeout

    The application session timeout.

    OCSP URI

    If the client installation uses the On-Line Certificate Status Protocol (OCSP), supply a Uniform Resource Identifier (URI). For example, the format is http://host:port/ocspLocal. The OCSP URI updates the status of trusted certificates online.

    Authorization Config Path

    Fully qualified name of the authorization configuration file.

     

    Create eDirectory Index

     

     

    Server DN

     

    Container Object

    Selected

    Select each Container Object Type to use.

    Container Object Type

    Select from the following standard containers: locality, country, organizationalUnit, organization, and domain. You can also define your own containers in iManager and add them under Add a new Container Object.

    Container Attribute Name

    Lists the Attribute Type name associated with the Container Object Type.

    Add a New Container Object: Container Object Type

    Specify the LDAP name of an objectclass from the Identity Vault that can serve as a container.

    For information on containers, see the Novell iManager 2.6 Administration Guide .

    Add a New Container Object: Container Attribute Name

    Supply the attribute name of the container object.

  4. After you finish configuring the settings, click OK, then continue with Section 6.10, Verify Choices and Install.