6.4 NURM (OES User Rights Management)
The OES User Rights Map (NURM) utility is used by administrators to map the Access Control List (ACL) of NSS resource that is owned by an identity in eDirectory to an identity in Active Directory. It maps the users and groups from eDirectory to Active Directory using a common name or any other field that is selectable by the tool. With this utility, the administrators can:
-
Create User Maps: Map eDirectory and Active Directory users and groups.
-
Leverage Existing IDM-based User Maps: Leverage NetIQ Identity Manager 4.5 or later maps that are created using IDM Designer (but not the IDM iManager plug-in).
-
Map User Rights: Assign rights to Active Directory users on NSS resources.
-
View Rights: View the rights of Active Directory and eDirectory users on a given volume.
-
Synchronizing Rights: Synchronize the rights of Active Directory and eDirectory users using the user-rights-map command line utility.
6.4.2 Accessing OES User Rights Map Utility (NURM)
Along with the installation and configuration of NSS AD, the NURM utility gets installed.To access NURM:
-
Open the OES server welcome page, then click .
OR
Point your browser to https://<OES server IP address or the host name>/storm.
-
Specify the user name or the FQDN of the eDirectory administrator in the , specify the password, then click .
The NURM welcome page should look similar to the following:
NURM is also available as a command line utility (user-rights-map). For more information on the CLI utility, see Section 6.4.6, NURM Command Line Utility.
6.4.3 Mapping Users
In an NSS AD environment, OES servers are joined to an Active Directory domain to provision AD users and groups native NSS resources access. To aid this, identities from Active directory will have to be mapped with identities on eDirectory and assigned the same rights as that of the eDirectory identities. NURM helps in creating this identity map, which is called a user map
. User maps are used to assign rights to AD identities on the NSS resources.
Using the Map Users feature, administrators can do the following:
-
Create new user maps: Map eDirectory and Active Directory (AD) users and groups.
-
Import user maps
-
Export user maps
-
Refresh user maps
-
Delete user maps
Before creating user maps, ensure that you are connected to an AD server.
Connecting to an Active Directory Server
To connect to the target AD server, click , specify the following details, then click .
-
User Name: Specify the AD Administrator user name or the FQDN.
-
Password: Specify the AD Administrator password.
-
Domain Name: Specify the realm of the AD domain.
-
Port: Specify the port with which you would like to connect to the AD server. If you would like this connection to be secure, select Use SSL. Some of the standard LDAP ports for Active Directory are 389, 636, 3268, and 3269.
After you successfully establish the connection with the AD server, the 
icon is displayed. The NURM screen should look similar to the following:
To disconnect from the target AD server, click > 
.
NOTE:NURM supports multiple AD forests. Login to the respective forest before generating the user map.
Creating a New User Map
The user map could be created using any of the following methods:
-
Propose Map: Use this method to view, validate, and edit the generated user map before saving it on the server.
-
Save Map: Use this method when the number of records to be mapped are high and when you anticipate the user map generation to take more than five minutes. You can initiate the user map generation operation and continue using the application. The user map generation operation continues on the server side, and on completion, the generated user map is saved on the server and gets listed in the Map Users page.
-
Click , then specify the following details:
-
Match Type: Select an object mapping (user to user, group to group, or container to group). In the , specify the wildcard-based search criteria.
For example, if you want to match a group from the source identity store with a group on the target identity store that differs in naming conventions, you can use the .
For example, assume that you have the following groups on the source identity: eng-group-acme, sales-group-acmeUS, and so on; and technology-acme, sales-acmeUS, and so on in the target identity. In the , specifying *-acme finds the match from eng-group-acme and technology-acme groups.
-
LDAP Attributes: Select Common Name to Common Name (CN to CN), Common Name to SAM-Account-Name (CN to SAM), or Custom Attributes matching criteria.
If you choose custom attributes, you will have to specify the eDirectory and Active Directory object attributes.
Examples of eDirectory object attributes include User Name (uid), Common Name (cn), Last Name (sn), and First Name (givenName).
Examples of Active Directory object attributes include SAMAcountName, First Name (givenName), Last Name (sn), and email address (email).
-
eDirectory Context: Specify or browse and select the eDirectory tree search base context. If you would like to do a subtree search, select .
-
Active Directory Context: Specify or browse and select the AD server context. If you would like to do a subtree search, select .
-
-
Click to generate the user map.
-
Validate the user mapping. If you need to modify any user mapping:
-
Click , then specify or browse the AD server context.
-
To replace or add an AD user in the proposed user map, select a row in the proposed user map, then from the search results, click
(add) found next to the search result.
-
To remove a user from the proposed user map, click
(remove). To undo the deletion, click 
(undo).
HINT:
-
To modify an existing user mapping, click the user map name in the Map Users page, then follow the instructions in Step 3.
-
Pagination and Filtering: When the number of records to be displayed are huge, they are paginated, and each page holds up to 1000 records. The filter option works based on records in all the pages.
-
Sorting: Click any column title to sort the data either in ascending or descending order.
-
If the number of records to be displayed are more than 1000, pagination is displayed at the bottom of the page for ease of navigation. Pagination includes the following:
-
Number of Pages: Displays the total number of pages. For example, Pages 4.
-
First: Displays the first page.
-
Last: Displays the last page.
-
<: Displays the previous page.
-
>: Displays the next page.
-
Page Numbers: Clicking on these numbers, displays the respective page.
-
Go To Page: If you would like to navigate directly to a particular page, click the drop-down arrow, specify the page number, then click Go.
Importing a User Map
-
Click , then select the user map XML file using the button.
-
Specify an appropriate name for the user map, then click .
Exporting a User Map
Select the user map of your choice, click , then save it to a location of your choice on your computer.
Refreshing a User Map
If you feel that the mapping have changed since the time you have created a user map, you could refresh them using the same conditions that were used while creating them.
To refresh an old user map, select the desired user map and then click Refresh. If there are any differences since the time there were created, those entries are highlighted with an information icon (undo). If you would like to revert changes, use the undo icon. After verifying the changes, click Save Map.
Delete a User Map
Select the user maps that you want to delete, then click .
6.4.4 Mapping Rights
Using this feature, you can map rights to AD users on a specific NSS volume. While doing so, you can choose to remove eDirectory trustees from the NSS file system and migrate the eDirectory IDs (owner, modifier, archiver, metadata modifier, and deletor) to AD users.
To map rights:
-
Select a volume on which you want to map rights to AD users.
-
Select the source of user mapping:
-
NetIQ IDM: If you select this option, then directly go to Step 3.
NOTE:When IDM is used, the connection to eDirectory is established with secure SSL port 636. For information on creating user map using IDM, see the NetIQ Identity Manager 4.5 Documentation.
-
User Map: If you select this option, choose the appropriate user map name, then click . The user map is displayed along with the rights that will be assigned to the AD users. You can hide or display the user map and rights details using the and buttons.
-
-
Select the following options as needed:
-
Apply to Salvage: Applies rights to AD users on the salvaged files and folders.
-
Remove eDirectory Trustees: After assigning AD users as trustees, the eDirectory users will be removed from the NSS file system as trustees.
-
Migrate IDs: Assign eDirectory trustee IDs (owner, modifier, archiver, metadata modifier, and deletor) to AD users.
-
-
Click .
To delete the mapped rights, select the Map Rights, then click .
NOTE:After deletion, you can no longer synchronize rights on the volume using the deleted map rights.
To view the log information of the mapped rights, click link under the column.