IBM Security Identity Manager: IBM Security Privileged Identity Manager .

You can change the roles and groups in which the account belongs, including theadministrative domains that the account administers. To apply the changes,manage or add members to the ISPIM role, ISPIM group and ISPIM administrativedomain service groups.Note: When the operation returns a WARNING status, the warning message orthe log file does not show which attributes are not configured. You must view theaccount in the console to see which attributes are successfully set.User unassignment from groupsWhen you use IBM Security Identity Manager to unassign a user from a group, theadapter modifies the user account on the managed resource.The adapter also removes the value of that group from the user account on IBMSecurity Identity Manager.Password changes for user accountsYou can change the password of any of the IBM Security Privileged IdentityManager accounts that exist on IBM Security Identity Manager.For information about changing passwords, see the IBM Security Identity Managerproduct documentation.User account suspensionWhen you suspend a user account, the status of the user account on IBM SecurityIdentity Manager becomes inactive.The user account on the managed resource becomes unavailable for use.Suspending a user account does not remove the user account from IBM SecurityIdentity Manager. For more information about suspending user accounts, see theIBM Security Identity Manager product documentation.User account restorationThe restore operation reinstates the suspended user accounts to IBM SecurityIdentity Manager.After restoring a user account, the status of the user account on IBM SecurityIdentity Manager becomes active and the user account on the managed resourcebecomes available for use. For more information about restoring user accounts, seethe IBM Security Identity Manager product documentation.Deleting user accountsUse the IBM Security Identity Manager deprovision feature to delete user accounts.For more information about deleting user accounts, see the IBM Security IdentityManager product documentation.When you delete a user account from IBM Security Identity Manager, the adapterremoves the user from the managed resource.When you delete an IBM Security Privileged Identity Manager user account, boththe user and the associated IBM Security Identity Manager accounts are deleted onthe IBM Security Privileged Identity Manager.6IBM Security Identity Manager: IBM Security Privileged Identity Manager Adapter User Guide

Chapter 3. ISPIM roles managementIBM Security Identity Manager manages ISPIM roles that are stored on the IBMSecurity Privileged Identity Manager server by using the IBM Security PrivilegedIdentity Manager Adapter.You can perform the following operations:v Add rolesv Modify role attributesv Delete rolesReconciling rolesISPIM roles act as support data for IBM Security Privileged Identity Manageraccounts.To reconcile ISPIM roles, do a full reconciliation or reconcile support data only. See“Reconciling support data without reconciling user accounts” on page 4.Adding rolesYou can add roles at any time. You can change the adapter attributes that definethe role on the role form.Complete the fields in the role form. See “IBM Security Privileged IdentityManager Adapter role form attributes” on page 17 for the required and optionalform attributes.Modifying ISPIM rolesYou can add or remove members to an ISPIM role form. You can also modify otherattributes of a role by changing the attribute value on the role form. You cannotchange the Business unit field (erPIMParentBusinessUnit attibute), the Approvalworkflow on the managed resource field (erPIMRolePIMWorkflow attribute), andthe Role classification field (erPIMRoleClassification attribute).Procedure1. Log on to IBM Security Identity Manager as an administrator.2. In the My Work pane, click Manage Groups.3. On the Manage Groups page, select the IBM Security Privileged IdentityManager profile from the Service type list and click Search.4. Select the service that contains the ISPIM role to be managed and then clickContinue.5. On the Select Group page, select Group Type ISPIM role to display all theISPIM roles that are created for that service and click Search.6. On the Groups table, select the menu of the ISPIM role to be managed andclick the appropriate option.OptionDescriptionIf you want to add ISPIM usersClick Add members.7

OptionDescriptionIf you want to remove ISPIM usersClick Manage members.7. Search for the users who are to be added or removed from the role.OptionDescriptionIf you are on the Add Members pageClick Search. Search results display the listof users who can be made members of therole.If you are on the Manage Group MemberspageSearch results display the list of users whoare currently members of the role.8. Select the users and set the date when the addition or deletion becomeseffective.OptionDescriptionIf you are addingSelect the users and click OK. The Schedulepage is displayed.Select the effective date of the rolemembership addition and click Submit.If you are removingSelect the users and click Remove. TheConfirm page is displayed.Select the effective date of the role memberdeletion and click Remove.Deleting ISPIM rolesYou can delete an ISPIM role only if it does not have any members.Procedure1. Log on to IBM Security Identity Manager as an administrator.2. In the My Work pane, click Manage Groups.3. On the Manage Groups page, select the IBM Security Privileged IdentityManager profile from the Service type list and click Search.4. Select the service that contains the ISPIM role to be deleted and then clickContinue.5. On the Select Group page, select Group Type ISPIM role to display all theISPIM roles that are created for that service and click Search.6. On the Groups table, select the ISPIM role to be deleted and click Delete.7. On the Confirm page, click Delete.8IBM Security Identity Manager: IBM Security Privileged Identity Manager Adapter User Guide

Chapter 4. ISPIM groups managementIBM Security Identity Manager manages ISPIM groups that are stored on the IBMSecurity Privileged Identity Manager server by using the IBM Security PrivilegedIdentity Manager Adapter.You can perform the following operations:v Add groupsv Modify group attributesv Delete groupsReconciling groupsISPIM groups act as support data for IBM Security Privileged Identity Manageraccounts.To reconcile ISPIM groups, do a full reconciliation or reconcile support data only.See “Reconciling support data without reconciling user accounts” on page 4.Adding groupsYou can add groups at any time. You can change the adapter attributes that definethe group on the group form.Complete the fields in the group form. See “IBM Security Privileged IdentityManager Adapter group form attributes” on page 19 for the required and optionalform attributes.Modifying ISPIM groupsYou can add or remove members to an ISPIM group (system role) form. You canalso modify other attributes of a group by changing the attribute value on thegroup form. You cannot change the Group name field (erPIMName attribute) andthe Business unit field (erPIMParentBusinessUnit attribute).Procedure1. Log on to IBM Security Identity Manager as an administrator.2. In the My Work pane, click Manage Groups.3. On the Manage Groups page, select the IBM Security Privileged IdentityManager profile from the Service type list and click Search.4. Select the service that contains the ISPIM group to be managed and then clickContinue.5. On the Select Group page, select Group Type ISPIM group to display all theISPIM groups that are created for that service and click Search.6. On the Groups table, select the context menu of the ISPIM group to bemanaged and click the appropriate option.OptionDescriptionIf you want to add members to the systemgroupClick Add members.9

OptionDescriptionIf you want to remove members from thesystem groupClick Manage members.7. Search for the users who are to be added or removed from the ISPIM group.OptionDescriptionIf you are on the Add Members pageClick Search. Search results display the listof users who can be made members of thesystem group.If you are on the Manage Group MemberspageClick Search. Search results display the listof users who are currently members of thesystem group.8. Select the users and set the date when the addition or deletion becomeseffective.OptionDescriptionIf you are adding members to the systemgroupSelect the users and click OK. The Schedulepage is displayed.Select the effective date of the system groupmembership addition and click Submit.If you are removing members from thesystem groupSelect the users and click Remove. TheConfirm page is displayed.Select the effective date of the system groupmembership deletion and click Remove.Deleting ISPIM groupsYou can delete a ISPIM group only if it does not have any members.Procedure1. Log on to IBM Security Identity Manager as an administrator.2. In the My Work pane, click Manage Groups.3. On the Manage Groups page, select the IBM Security Privileged IdentityManager profile from the Service type list and click Search.4. Select the service that contains the group to be deleted and then clickContinue.5. On the Select Group page, select Group Type ISPIM group to display all theISPIM groups that are created for that service and click Search.6. On the Groups table, select the system group to be deleted and click Delete.7. On the Confirm page, click Delete.10IBM Security Identity Manager: IBM Security Privileged Identity Manager Adapter User Guide

Chapter 5. ISPIM administrative domains managementIBM Security Identity Manager manages ISPIM administrative domains that arestored on the IBM Security Privileged Identity Manager server by using the IBMSecurity Privileged Identity Manager Adapter.You can perform the following operations:v Add ISPIM administrative domainsv Modify ISPIM administrative domainsv Delete ISPIM administrative domainsReconciling administrative domainsISPIM administrative domains act as support data for IBM Security PrivilegedIdentity Manager accounts.To reconcile ISPIM administrative domains, do a full reconciliation or reconcilesupport data only. See “Reconciling support data without reconciling useraccounts” on page 4.Adding administrative domainsYou can add administrative domains at any time. You can change the adapterattributes that define the administrative domain on the admin domain form.See “IBM Security Privileged Identity Manager Adapter admin domain formattributes” on page 19 for the required and optional form attributes.Modifying administrative domainsYou can add or remove administrators from an ISPIM administrative domain. Youcan also modify other attributes of administrative domains by changing theattribute value on the admin domain form. You cannot change the Business Unitfield (erParentBusinessUnit attribute).Procedure1. Log on to IBM Security Identity Manager as an administrator.2. In the My Work pane, click Manage Groups.3. On the Manage Groups page, select the IBM Security Privileged IdentityManager profile from the Service type list and click Search.4. Select the service that contains the administrative domains to be managed andthen click Continue.5. On the Select Group page, select Group Type ISPIM admin domain todisplay all the administrative domains that are created for that service and clickSearch.6. On the Groups table, select the context menu of the administrator domain to bemanaged and click the appropriate option.11

OptionDescriptionIf you want to add administrators to thedomainClick Add members.If you want to remove administrators fromthe domainClick Manage members.7. Search for the users who are to be added or removed from the domain.OptionDescriptionIf you are on the Add Members pageClick Search. Search results display the listof users who can be made administrators ofthe domain.If you are on the Manage Group MemberspageSearch results display the list of users whoare currently administrators of the domain.8. Select the users and set the date when the addition or deletion becomeseffective.OptionDescriptionIf you are adding administratorsSelect the users and click OK. The Schedulepage is displayed.Select the effective date of the administratoraddition and click Submit.If you are removing administratorsSelect the users and click Remove. TheConfirm page is displayed.Select the effective date of the administratordeletion and click Remove.Deleting ISPIM administrative domainsYou can delete a ISPIM administrative domain as long as the administrativedomain does not have any administrators. ISPIM administrative domainadministrators show up as members of the administrative domain service group.Procedure1. Log on to IBM Security Identity Manager as an administrator.2. In the My Work pane, click Manage Groups.3. On the Manage Groups page, select the IBM Security Privileged IdentityManager profile from the Service type list and click Search.4. Select the service that contains the group to be deleted and then clickContinue.5. On the Select Group page, select Group Type ISPIM admin domain todisplay all the ISPIM administrative domains that are created for that serviceand click Search.6. On the Groups table, select the ISPIM administrative domain to be deleted andclick Delete.7. On the Confirm page, click Delete.12IBM Security Identity Manager: IBM Security Privileged Identity Manager Adapter User Guide

Chapter 6. ReferenceReference information is organized to help you locate particular facts quickly suchas adapter attributes, application programming interfaces, files and commands,where applicable.Adapter attributesThe IBM Security Identity server communicates with the adapter by usingattributes, which are included in transmission packets that are sent over a network.You can manage the adapter attributes that are on the various adapter forms.IBM Security Privileged Identity Manager account formattributesYou can manage user accounts from IBM Security Identity Manager.Table 3. Account form attributesAttributesDescriptionBusiness unitThis attribute is required.This field is the organization that containsthe user account. This field maps to theerPIMParentBusinessUnit attribute in theerPIMAccount object class and to theerparent erglobalid attribute on the IBMSecurity Privileged Identity Manager server.User IDThis attribute is required.This field is the unique name for the useraccount. This field maps to the erUidattribute in the erPIMAccount object classand to the uid attribute on the IBM SecurityPrivileged Identity Manager server.Last nameThis attribute is required.This field is the user's surname. This fieldmaps to the erPIMLastName attribute in theerPIMAccount object class and to the snattribute on the IBM Security PrivilegedIdentity Manager server.Full nameThis attribute is required.This field is the user's complete name. Thisfield maps to the erPIMFullName attribute inthe erPIMAccount object class and to the cnattribute on the IBM Security PrivilegedIdentity Manager server.13

Table 3. Account form attributes (continued)AttributesDescriptionChange password at next logon?This attribute is optional.This field indicates whether the user mustchange password on the next log on to theIBM Security Privileged Identity Managerserver. This field maps to theerPIMChangePassword attribute in theerPIMAccount object class and to theerchangepswdrequired attribute on the IBMSecurity Privileged Identity Manager server.First nameThis attribute is optional.This field is the user's given name. This fieldmaps to the erPIMFirstName attribute in theerPIMAccount object class and to thegivenname attribute on the IBM SecurityPrivileged Identity Manager server.InitialsThis attribute is optional.This field is the user's initials. This fieldmaps to the erPIMInitials attribute in theerPIMAccount object class and to theinitials attribute on the IBM SecurityPrivileged Identity Manager server.Home addressThis attribute is optional.The field is the user's home address. Thisfield maps to the erPIMInitials attribute inthe erPIMAccount object class and to thehomepostaladdress attribute on the IBMSecurity Privileged Identity Manager server.Shared secretThis attribute is optional.This field is the user's shared secret that isused to get the password when a newaccount is created. This field maps to theerPIMSharedSecret attribute in theerPIMAccount object class and to theersharedsecret attribute on the IBMSecurity Privileged Identity Manager server.Organizational rolesThis attribute is optional.This field is the roles that the user has. Thisfield maps to the erPIMOrgRoles attribute inthe erPIMAccount object class and to theerroles attribute on the IBM SecurityPrivileged Identity Manager server.14IBM Security Identity Manager: IBM Security Privileged Identity Manager Adapter User Guide

Table 3. Account form attributes (continued)AttributesDescriptionOffice numberThis attribute is optional.This field is the user's office number. Thisfield maps to the erPIMOfficeNumberattribute in the erPIMAccount object classand to the roomnumber attribute on the IBMSecurity Privileged Identity Manager server.Employee numberThis attribute is optional.This field is the user's employee number.This field maps to the erPIMEmployeeNumberattribute in the erPIMAccount object classand to the employeenumber attribute on theIBM Security Privileged Identity Managerserver.ManagerThis attribute is optional.This field is the user's manager. This fieldmaps to the erPIMManager attribute in theerPIMAccount object class and to the managerattribute on the IBM Security PrivilegedIdentity Manager server.Postal addressThis attribute is optional.This field is the user's mailing address. Thisfield maps to the erPIMPostalAddressattribute in the erPIMAccount object classand to the postaladdress attribute on theIBM Security Privileged Identity Managerserver.Administrative assistantThis attribute is optional.This field is the user's businessadministrative assistant. This field maps tothe erPIMAdminAssistant attribute in theerPIMAccount object class and to thesecretary attribute on the IBM SecurityPrivileged Identity Manager server.E-mail addressThe user's email address. This field maps tothe erPIMEmailAddress attribute in theerPIMAccount object class and to the mailattribute on the IBM Security PrivilegedIdentity Manager server.Chapter 6. Reference15

Table

The IBM Security Privileged Identity Manager Adapter automates the management of user accounts and dif fer ent service gr oups such as ISPIM r oles, ISPIM gr oups, . Service group management on the IBM Security Privileged Identity Manager server v Adding gr oups v Modifying gr oups attributes, including adding and r emoving members