Symantec Access Management

Expand all | Collapse all

Revised - 999 Global User CustomFields SDK Process for CA Identity Suite/Identity Manager Provisioning Tier

  • 1.  Revised - 999 Global User CustomFields SDK Process for CA Identity Suite/Identity Manager Provisioning Tier

    Posted 04-23-2018 05:16 PM

    Team,

     

    Since early days of the CA Identity Suite solution, there has been a provisioning SDK that would allow an approved process to extend the CA Identity Manager's IMPD (provisioning directory) schema from the default of 99 user custom fields to 999 user custom fields.   These 99 user custom fields are in addition to the standard 40-50 default user profile fields, e.g. givenName (First Name), sn (LastName), userID, telephone #, etc.

     

     

    Typically, CA Identity Suite (Identity Manager) Provisioning Tier does NOT attempt to be a meta-directory, but act as a virtual directory to the 1000's of managed endpoints/userstores/applications.   As long as the "explore" operation was successful, there will be a "pointer" object that references the correct location of the endpoint accounts.  And when a "correlation" operation occurs, this endpoint account "pointer" object is attached (via inclusion referential objects), to the associated global user ID.    

     

    By using this "virtual directory" architecture, it is possible for IM business rules or 3rd party tools to directly view the 1000's of managed endpoints "real data" and not a "stored" representation of this data.

     

     

    However, some clients do wish to "collect" the native data, and store this within the IMPD provisioning store, as SNAPSHOT data, to monitor for non-approved / OOB (out-of-band) access.   If some fields are dedicated to select endpoints, the default of 99 custom fields may quickly run out.

     

    The CA Identity Suite contains a Provisioning SDK download, and there is a readme file included within the install.

     

    After running through the exercise of adding 999 user custom fields, I wanted to clarify some of the steps in the readme file, and outline a step-by-step process.   & include screen shots of the process.

     

     

     

     

     

    #### ######  REVISED STEPS HERE #### ####

    #### ######  REVISED STEPS HERE #### ####

    #### ######  REVISED STEPS HERE #### ####

     

    Updated the steps mentioned in the README.txt file found in CA\Identity Manager\Provisioning SDK\admin\samples\COSX


    #######################################
    #### README FILE UNDER COSX FOLDER ####
    #######################################

    The COSX Sample shows how to extend the number of custom global user attributes in your CA Identity Manager or eTrust Admin installation. Follow the steps listed here and you will introduce from 1 to 900 new custom global user attributes. For instance, if you decided to add 30 new attributes, those new global user attributes would be named

    eTCustomField100 through eTCustomField129 and corresponding "name" attributes would be defined in the SystemSettings object named eTCustomFieldName100 through eTCustomFieldName129

     

    If you later want to increase the number to 60 over the standard 99 attributes, you would just follow this procedure again. However, reducing the number of attributes shouldn't be done if you've ever assigned values to the attributes you want to delete.

     

    The steps you'll follow are to be performed on Windows:

     

    NOTE: Steps 0-3b may be performed on a remote MS Windows Workstation with Internet Access.

     

    0a. Install MS Visual Studio 2010 VC Express (free) or full MS Visual Studio 2010 (Fee/License required)
    - Note: NOT MS VS 2010 VB Express
    - 4/2018 Note: Use https://my.visualstudio.com/Downloads?q=visual%20studio%202012&wt.mc_id=o~msft~vscom~older-downloads
    - The MS VS 2010 VC Express is available as web-download; will need INTERNET access.
    - Recommend this exercise be done on a workstation with INTERNET access & then copy the resulting output files to the CA Directory/IMPS servers.
    - Size: nmake is 70KB, but requires the supporting VC folder of 7 MB. The download includes other files; and will require 1.1 GB free install space.

     

    0b. Add MS VS 2010 VC Bin folder to the Win OS PATH

     

    1. Install the CA Provisioning SDK package, including this sample.
    - cd C:\Program Files (x86)\CA\Identity Manager\Provisioning SDK\admin\samples\COSX
    - open command line window as OS Administrator to avoid "Access Denied" messages from the creation of a new output file.
    - Right click CMD process, and select "Run as Administrator"

     

    2. Run "gencosx 30" to create the parser table input file cosxparse.pty
    that defines the 30 new attributes.
    - Note: Max in batch file is limited to 900.
    - May take 5-10 minutes depending on how large the number selected is.
    - Output file: cosxparse.pty

     

    3a. In same command line window, execute the MS VS 2010 VC variable batch file, to ensure win32.mak dependency "nmake" file is found.
    "C:\Program Files (x86)\Microsoft Visual Studio 10.0\VC\vcvarsall.bat"
    - Otherwise: set INCLUDE=%INCLUDE%;"C:\Program Files (x86)\Microsoft SDKs\Windows\v7.0A\Include"

     

    3b. Run 'nmake' to compile the parser table input file into a compiled
    parser table cosxparse.ptt (placed automatically in the ..\..\data folder).

     

    4a. Use ftp or copy program to place the new cosxparse.ptt file under the IMPS_HOME/data/ folder
    - If using the Identity Suite vApp, use the config user to place this file under /tmp
    - then "su - imps" & copy this file to the data folder: cp -r -p /tmp/cosxparse.ptt ./data/cosxparse.ptt

    4b. Copy the cosxparse.ptt file that was just built from the place where it
    was created
    ..\data\cosxparse.ptt
    to its installed location
    ....\Provisioning Server\data\cosxparse.ptt

     

    5a. As the imps user, run 'schemagen -n COSX' to create the COSX schema files:
    etrust_cosx.schema -- the SLAPD schema file
    etrust_cosx.dxc -- the ETD schema file

     

    5b. Use ftp or copy program to place the two (2) new files on the remote MS Windows box for future placement.
    - Keep three (3) files together, for tracking purposes: cosxparse.ptt, etrust_cosx.schema, etrust_cosx.dxc

    6. Install these files wherever schema and parser table files are normally installed:

    a. *.dxc files go to CA Directory systems. And if not already
    linked in, you'll need to edit the impd.dxg file to include
    this new etrust_cosx.dxc file.
    - Include CA Directory router for the IMPS servers, if CA Directory IMPD data DSA are on remote server.
    - May validate with Jxplorer, that the new schema is viewable.
    - Use grep: grep etrust_cosx impd.dxg under DXHOME/config/schema to validate this schema is sourced: source "etrust_cosx.dxc";
    - Important: Restart or Re-init DSA_NAMES

    b. *.schema files go on provisioning server systems and C++ connector
    server systems (but not manager workstations). And if not already
    linked in, you'll need to edit the etrust_admin.conf file to
    include the new etrust_cosx.schema file.
    - Use grep: grep -i cosx etrust_admin.conf under IMPS_HOME/data to validate this schema is referenced:
    include "/opt/CA/IdentityManager/ProvisioningServer/data/etrust_cosx.schema"
    - Important: Restart these servers: [ imps stop/imps start | net stop im_ccs/net start im_ccs ]

     

    c. *.ptt files go on provisioning server systems, C++ connector server
    systems and remote manager workstations.
    - Important: Restart these servers: [ imps stop/imps start | net stop im_ccs/net start im_ccs | shutdown/restart IMPM GUI]
    - Validate with IMPM GUI - Should see 999 object under "System/Global Properties/Custom User Fields."
    - Scroll down to the last field: Add a label.
    - Navigate to a Global User, right click to view properties, to view larger screen.
    - Select "Custom Fields" TAB. Should see the 999 object with the new label.

     

    7.   To expose these new user custom fields to the upper tier of the Identity Manager IME, the Provisioning Server (Directory.xml) must be exported & then updated with the 999 new fields.

     

    8.  To associate these 999 new fields to IME userstore fields, the IME Provisioning Mapping (Advance Settings) in the IM Management Console, will need to be updated.

     

     

    ####### REVISED STEPS ABOVE ##### #####

    ####### REVISED STEPS ABOVE ##### #####

    ####### REVISED STEPS ABOVE ##### #####

     

     

     

     

    Step 0:     MS Visual Studio 2010 VC Express  [ May be done on a workstation to generate the primary file]

     

     

     

     

    Exercise may be done on a workstation, to avoid adding one-time files/installation.

     

     

     

     

    Two (2) new files created from processes:  gencosx.bat   & nmake

     

     

     

     

    Copy the cosxparse.ptt file to the IMPS server, and execute the command to generate the schema files

     

     

    Copy the etrust_cosx.dxc to ALL CA Directory servers (including the routers) - validate impd.dxg does reference this file already (newer version of Identity Suite).

     

    Copy all files together to all better tracking of where to place these files:

     

    Update the IMPM GUI (Provisioning Manager GUI) data folder:

     

     

     

    In the following order, bounce the following services:

     

    1) CA Directory Data DSA for IMPD:    dxserver stop all   /  dxserver start all    (or re-init   dxserver init all )

     

     

    2a) CA CPP / C++ Servers:  Windows  (net stop im_ccs / net start im_ccs)

     

    2b) CA IAMCS (JCS) with embedded CPP / C++ Servers:  Windows  (net stop im_jcs / net start im_jcs)

     

    3) CA Provisioning Servers:   Linux ( su - imps;   imps stop   / imps start) |  Windows  (net stop im_ps / net start im_ps)

     

    4) CA Provisioning Manager GUI:  Stop & Re-Start.

     

     

     

    Step 7 & 8 are common processes, that already have excellent examples.

     

     

     

     

     

    If you find this of use, please leave some feedback.

     

     

     

    Cheers,

     

    Alan



  • 2.  Re: Revised - 999 Global User CustomFields SDK Process for CA Identity Suite/Identity Manager Provisioning Tier

    Posted 04-16-2019 05:14 PM

    If I don't create custom attributes, how would I go about accessing the "Real Data" to update it through a template



  • 3.  Re: Revised - 999 Global User CustomFields SDK Process for CA Identity Suite/Identity Manager Provisioning Tier

    Posted 04-17-2019 11:25 AM

    If I'm understanding you correctly, you're asking how you could access additional data fields in your endpoints without adding the eTCustomField attributes as described above.

     

    In that case, you would simply map the additional endpoint data to existing attributes in your Provisioning and User directories, steps that are referenced above as #7 and #8.  Those steps are not detailed above, but a good place to start is the "Configuring" section of the CA IM documentation for your version.  It requires coordinating the attributes in both the User Store and the Provisioning Directory and ensuring there are no collisions, so if you have more than just a handful of attributes, I recommend charting them all out via spreadsheet.