Liferay Symposium 2009

On 5th October 2009, Liferay conducted a symposium in Bangalore at Hotel Leela Palace. My company, Nous Infosystems is a Silver Partner to Liferay.

I had a one hour slot to talk. Myself being an Identity guy, to present something relevant to Liferay, I chose to integrate Liferay with Sun Identity Manager. Post experiment with the integration I have presented a paper on the same.

Highlights:

We leveraged the Liferay API for the following functions

• Retrieve a list of all the Roles available in the Liferay System
• Retrieve a list of all the User Groups available in the Liferay System
• Retrieve a list of all the Communities available in the Liferay System
• Override the User Create function to create user with a given set of parameters
• Create web service calls for all the functions

Using these web services calls we retrieved the list of user groups, roles, communities from the Liferay system dynamically every time Liferay was selected as a resource for any users. Upon combining the policies for mapping roles to communities and User groups, the user was provisioned to the Liferay User table using a webservice; this webservice calls a function which overrides the basic Liferay Api create user function. Similar are updates and deletes.

All comments and discussions are welcome. The presentation can be found here.

Note: The one in the suit is not me :-)

Metaview deprecated - SUN Identity Manager 8.0

The best thing I feel SUN developers did was they removed the Metaview feature. This reportedly had couple of bugs and I was once caught by them :-(

SUN Identity Manager 8.0 is released

SUN Identity Manager 8.0 is out

For all the enthusiasts - come download and experience the amazing product

A brief overview of this release:

Sun Identity Manager 8.0 is the latest version of the Sun Identity Manager product offering with expanded Role support, enhanced reporting capabilities, and updated resource adapter and application server support. This update improves upon the industry-leading Identity Manager 7.1 solution with:

# Role Enhancements

• Role life cycle management can require approvals on Role creates, edits and deletes, and Role changes can be applied to all assigned Users.
• User-to-Role life cycle management improvements enable support for future and temporary Role assignments.
• Default Role types including Business Roles, IT Roles, Applications, and Assets are now provided to encourage best practices with regards to Role management.
• Business Roles can contain roles required by all, conditional for some, and optional (by request and optional approval) for others. A Business Role designer can define coarse grain access, while delegating to the user or a manager the ability to fine tune the access within the scope of a Business Role.

# Enhanced Reporting with Data Exporter

• Manager operational data can be made available for use by other processes and applications.
• Data held by and flowing through Identity Manager can be periodically exported to a customer-managed data warehouse or third-party business intelligence and reporting tools.
• Exported data can be used to answer historical questions regarding 'Who had access to a system, and who approved that access?'. It can also be used to provide reports on operational behavior over time, such as 'Provision Operations by Resource' and 'Workflow Approval Response Times'.

# Attribute Configuration

• Extended, queryable, and summary attributes can now be configured for roles as well as users.
• The new extended attribute configuration supports specification of value syntax (STRING, INT, DATE, or BOOLEAN), whether the attribute can have a single or multiple values, and a text description for the attribute.

# Other Notable Updates

• UNIX resource adapters now support SSH connections using private/public key pairs for authentication to managed resources.
• Service Provider user password changes will be checked against the password policy configured on the user directory.

# Supported Resource Additions and Updates

• Exchange 2007 (New)
• Microsoft Active Directory Application Mode (ADAM) (New)
• RSA SecurID 6.1.2 (Updated)
• Siebel CRM 8.0 (Updated)
• Oracle E-Business Suite on Oracle Applications 12 (Updated)
• HP OpenVMS 8.3 (Updated)

# Supported Application Server Updates

• Sun Java System Application Server 9.1 (GlassFish v2 UR1, 32-bit and 64-bit)
• Oracle Application Server Enterprise Edition 10g Release 3 (10.1.3)
• Oracle Application Server Standard Edition 10g Release 3 (10.1.3)
• BEA WebLogic Server 10
• JBoss Application Server 4.2

# Bug Fixes and Platform Support Updates

For more information about the features in this release, see the Identity Manager 8.0 Release Notes or the Identity Manager documentation set.

8 - The wait is over

Yes the wait is over. Very soon the latest version, 8.0 of Identity Manager will be out. Keep checking for updates on the same.

Open Source at SUN - Identity Management

The Identity Manager IDE has been open-sourced. As a side note, this also means that the Eclipse
plugin is officially out there. The versions of IdM that are supported include 6.0 (sp3/sp4), 7.0, 7.1.x.x, 8.0 (after the release).

Is NetBeans Plugin Supported by SUN?

Good Question isn't it?

Answer:

Sun only officially supports the Netbeans plugin through standard support tickets and only if you have a support contract for Identity Manager.

SUN Identity Manager - A Tip

When a resource is created (ex: LDAP) you may test this. Enter the credentials to connect except the password. Amazingly you will find that the Test Connection succeeded. Now save it to have problems later :-)

So if there is a problem in retrieving data or something similar anytime, you better check your resource for password.

Thought it would help some.

Login.jsp redirects to Configure: Import Exchange File

Product: Sun Identity Manager

You have hit the idm admin URL and you are redirected to the Configure: Import exchange file page? Did this ever happen to you? A snapshot of that looks like this.

Did you observe the logged in as field? Yes this is something funny that can happen to you.

Reason: Your IdM is unable to locate the database, if someone has removed your database or something of the same sort has happened then you see this page.

Solutions:

1. Recover your database

2. If its ok to have a fresh identity manager i.e. if you lose nothing, then just import the init.xml from idm-installation-dir\sample\init.xml

Still hanging around with any version below 7?

Folks looks like the next version of Sun Identity Manager release is not too far. If you are still working with any version below 7? then you may wait to upgrade your skills, directly to ?????? Ahaaa ... wait for the release and the number.

Sun Identity Manager is affected by multiple security vulnerabilities with varying impacts

Three Cross-site Scripting (XSS) vulnerabilities may allow local or remote unprivileged users the ability to execute unauthorized scripting code in a user's browser when that user clicks a link to Sun Java System Identity Manager. In addition, a further vulnerability may allow a local or remote unprivileged user to inject unauthorized HTML code into a user's browser when that user clicks a link to Sun Java System Identity Manager. Two additional vulnerabilities may allow a local or remote unprivileged user to redirect the browser to unintended remote sites or to inject frames containing data from unintended sites.

For more information

SUN Identity Manager: Deserialization failed for xmlString

Did you ever see this error when accessing the repository objects via the BPE? Ok this was an error recently my friend got. I thought I should mention the reason so that someone who get it sometime can quickly refer.

What my colleague did?:
He imported the netbeans plugin for idm into netbeans and configured a project. When he was configuring the repository, he gave the existing repository as the one that needs to be used by netbeans. Thats it, NetBeans changed the serial numbers of few tables of the Identity manager repo. Thus this error.

Solution:
I think we need to do an LH SETREPO and things should be working.

Are you using the Metaview of SUN Identity Manager?

Are you? If your answer is a NO, then it is suggested that you better stick with it. This feature currently has few bugs, which are yet to be corrected in the SUN Identity Manager release 8.0. It really plays with your attributes in such a way, that you hardly have an idea of what is happening.

I was using this feature recently and only landed in horrible times. When I referred to my seniors at SUN, they said they never use it as it has problems.

So to my suggestion to all SUN IdM folks out there is ... do not use Metaview please.

MetaView of SIM vs MIIS

Metaview feature of Sun Identity Manager, I don't know how many of the Identity professionals use it. However I wanted to take you through the architecture of it. It would be great for people who know MIIS.

The features are ...

Identity Attributes:
This feature allows you to configure the incoming and outgoing attributes. You will be able to create a new attribute, choose whether it should be stored in the identity manager, choose its source and destinations (resource). This is a feature that is exactly available in MIIS. You can also set the precedence for the source, like you may choose the first source and then the next which would be able to populate this attribute, again a feature of MIIS.

Identity Events:
Have you been into the third tab of Microsoft Identity Integration Server, where you can configure the delete rule? Yes, its the same way here. You will be able to configure the events like DELETE, DISABLE, ENABLE etc. You need to create a new event type, specify a rule on how it should be recognized and then actions to be performed.

These features are very specific to active sync because that is what a Synchronization engine works for.

Recently I have been working with these features and every moment I was feeling the MIIS features.

Bulk Loading

This may look novice to experienced professionals.

Have you ever did a bulk load of users into Sun Identity Manager? The findings I have are ...

Every attribute that comes under the waveset should be represented in the global namespace and the other attributes should be addressed as accounts[RESOURCE].attrName.

ex:
command,user,global.firstname,global.lastname,password.password,password.confirmPassword,waveset.resources
create,henryea,Earl,Henry,P@ssw0rd,P@ssw0rd,AD

Hope this should be useful to someone.

Using "lh console" when your SUN Identity Manager Application is down

I have just encountered a different kind of a problem. I have set the trace parameters in my Sun Identity manager. I have configured it to trace few adapters and finally gave a large number for the file size. Restarted the server and it failed saying ...

java.lang.NumberFormatException: For input string: "9999999999

So to correct this error I have got two options

1. Changing the System Configuration file using the lh console command

go to wshome\bin
Execute the following commands:
./lh console and press enter
You'll get to the configurator> prompt
Atthe promt, type
export -v c:\syscon.xml CONFIGURATION
now open the file c:\syscon.xml and scroll down till you find the required attribute to change.

com.mysql.jdbc.packetTooBigException

Did you ever get this? I got it when I was working with Sun Identity Manager. The best solution is to edit the the mysql file, my.ini (windows) to add max_allowed_packet parameter under [mysqld] section and restart the MySql server.

# SERVER SECTION
# ----------------------------------------------------------------------
#
# The following options will be read by the MySQL Server. Make sure that
# you have installed the server correctly (see above) so it reads this
# file.
#
[mysqld]

max_allowed_packet=32M

SUN's strength in Role Mining just got bigger and better - acquired Vaau

SUN just acquired VAAU.

Vaau's solution is very good at Role Mining and Role Classification, the RBACx product suite is very robust in this respect. However Vaau's solution is always dependent on some Identity management solution like SUN Identity Manager.

As I wrote in previous blog about the strength of SIM 8.0, which would be very strong in Role mining, role engineering etc.

The acquisition of Vaau really completes Sun's story around Enterprise Identity Management and Role-Compliance and will keep Sun in the forefront of Enterprise Identity Management.

Read More

What is org.apache.jasper.JasperException?

I have been successfully running an instance of the SUN Java Identity Manager 7.1 since long. Suddenly one day after I reboot my machine I see this error.


I am very curious to know why exactly this happens with something which was working perfectly.

I shall post the solution once I find it, however if someone can throw some light on this it would be great. Thanks

CEC - SIM v7.x?

Are you hanging with any version other than 7_1_1???? If you are then get ready to be completely outdated soon. Yes you got it right ... it Sun Identity Manager 8.0 set to release very soon.

I have written the new features of 7.1 after it got released. This time I have the privilege of writing about 8.0 even before its release. The top best feature of this version would be Role Management.

Features:

Flexible Role Modelling
Bi - Level RBAC
Business Roles
IT Roles
Also provision for Multilevel RBAC
Offers Role Subtypes, defaults being Business, IT, Application and Asset
New Sub-Types can be created
Extended attributes on Role Subtypes

Now you will also be able to search on Role Subtypes, for example "all application roles" etc.

New Role Features ...

Activation:

• Required: Get activated directly
• Conditional: Rule based, i.e. if the user object is getting an update and it requires few other privileges then it is allocated
• Manual: Implicit
  

Role start date and End date: What other granularity can one ask for?

Role Change Approval Process: If the actual Role definition itself is set to change then it should go through an approval process.

These are very few of the amazing features of 8.0. Keep waiting for it to release.

SUN Identity Manager rocks.

CEC - Identity Management

Monday evening I attended the session on Identity managment. Johnny cope was there taking the session. It was supposed to be a deep dive session, however everyone started asking/discussing solutions to their client problems. However their team is currently, I was informed, are making a team which only takes care of preparing images and deploying on public access servers. Thus the presales guy who visits the client can directly login with his id and give them a demo. Also licenses to try the product online for a week or couple are being to be sold so that the clients can check the product for a while before taking the decision.

SUN Identity Manager rocks.

NetBEANS Plugin:

Many of us know the BPE will be scrapped off, phase wise and finally everyone is expected to use NetBeans to create all custom objects in Sun Identity Manager. Every version of NetBeans vs IdM war file there is a .nbm file that needs to be imported into the Netbeans. I got my hands dirty using the NetBeans 5.5 and SUN Identity Manager war file for 7.1.1. Its awesome to use Netbeans instead of BPE, except the heavy memory requirement NetBeans has.

Tuesday I would be attending wonderful sessions like RBAC, VIDT, Security Considerations for IDM etc. Will post it soon.