Identity and Access Management

Dir Identity V9.0
Identity Management and GovernanceUser and Access Management aligned with Business Processes
The challenge of user andaccess management
Today‘s business environment is achallenging one for user and accessmanagement in the enterprise. Business relationships are growing more
complex, blurring the line between
internal and external business processes. They are also more dynamic,
requiring greater flexibility andresponsiveness in the enterprise‘sbusiness practices, policies and processes. Companies are under pressure to open their IT infrastructure toan ever-increasing number of users,
both inside and outside the company, and to ensure the highest productivity and privacy for these users,
all while controlling IT administrative
costs and leveraging existing investments wherever possible. To this end,
companies are increasingly looking
to external cloud services as a way
to complement their on-premises IT
services and address time-to-market and cost containment concerns.
Now more than ever, granting theright people the right access to theright resources at the right time andmanaging the risks are essential
elements of enterprise security ascompanies strive to protect their corporate data and systems and remain
innovative, productive, responsive,
compliant, and cost-effective business entities.
Several key business objectives are
driving governance over the user andaccess lifecycle on the enterprise IT
network:
Regulatory compliance. Secureuser access to corporate information has become a major legal issue
for business as governments worldwide continue to pass laws intended
to ensure the security, privacy, andintegrity of sensitive data like consumer and financial records. Domestic and international regulations forfinancial services, healthcare organizations, pharmaceutical companies and other industries require asecure access control infrastructure,and non-compliance can result in
legal action against the enterprise,
resulting in heavy financial penalties, even criminal proceedings. The
more global a company‘s reach, themore complex the requirements forregulatory compliance can be andthe greater the cost of failure. To
prove compliance, companies must
be able to show „who did what, andwhen, with what information“, which
requires a single view of a user‘s
access rights to all IT systems, a way
to track this access automatically on
an on-going basis - identity-based
audit and access certification - anda way to archive this information
securely for long-term access andanalysis.
The move to eBusiness. The use of
the Internet to provide content andbusiness processes to employees,
subscribers, customers, and trading partners is now an essential
tool for increasing user productivity
and streamlining business-to-business collaboration. Companies areoffering Web portals and services
for everything from personalized
employee access to company information to B2B access to supply chain
management processes. As a result,more and more IT applications andcontent are going online, and accessto these applications and content isrequired by a larger and more varied
set of users. And, while consuming
the services made available by cloudproviders can off-load the need toprovide them on-premises, it also
issues new challenges to maintain-

ing security governance, managing
risk, demonstrating accountability
and proving regulatory compliance.
Fast and flexible change management. User and access management
need to be flexible and responsive
to dynamic changes in user populations and business processes
brought about by mergers, acquisitions, and the move to eBusiness.
To maximize productivity and guard
against security risks, companies
must be able to react in real time tochanges in their users and the accessrights these users need to do theirjobs. New users and users changing
job functions must immediately get
the access rights they need to be up
and running quickly, while departing
users must have their access rights
revoked immediately to close security holes. The governance of users
and their access rights must remain
consistent and effective across theever-changing business and user
landscape.
Improved information security.
Although eBusiness fosters productivity, personalization, and collaboration, it also exposes the corporate
infrastructure to greater security
threats from malicious users. To
combat this problem, companies
need to clearly define corporate
security policies and implement
access governance – „who is allowed
to access what information, how andwhy“. The governance of user accessis ideally combined with a risk management process that helps to selectthe adequate level of governanceand suggest mitigation actions.
Cost control. Companies need tocontrol or reduce costs to keepcompetitive, and they are increasingly focusing on IT as an area forcost-cutting. Companies are looking
for ways to minimize the number ofcalls made to their help desks andhotlines for things like forgotten
passwords, and they are looking
to reduce the administrative costs
associated with user management
and provisioning - the process thatmakes the IT resources available to its
users. Corporate budgets are cutting
investment in IT systems as companies seek to get better returns on the
IT systems they already have. Companies also need transparency into
the assets they provide to their users
and the costs associated with theseassets. Service providers need to
track the costs associated with users
such as disk usage, mailbox size, andapplication packages used and baseremote access fees, while sales organizations need to track the costs ofmobile phones, laptops, pagers, and
PDAs and retrieve these assets fromtheir users when they leave the organization.
The obstacle to realizing these business objectives is the one function-one system structure of thetypical IT network. In the conventional IT infrastructure used in most
big companies today, there is a oneto-one correspondence between
a function or resource available tousers and the IT application/systemthat provides that function. Consequently, user management, accessmanagement, password management and auditing are carried out
on a per-IT system basis. IT staff
must administer users and theiraccess rights on each IT system in
the network or in the cloud, usually
by manual administration. Users get
one account and one password foreach IT system they need to use. EachIT system has its own audit or monitoring function to track changes tousers and their access rights on thatsystem. This structure has negative
consequences for user and accessmanagement:• Decentralized user management
and provisioning means that user
and access data is duplicatedacross IT systems and usually
becomes inconsistent over time,making it difficult to find correct
and up-to-date information andto de-provision users.
• Decentralized auditing and monitoring make it difficult to trackchanges to users and their accessrights. There is no way to tell whata single user‘s total access rights
are across the enterprise - even his
account names are different foreach IT system he uses - making

2 | DirX Identity V9.0

it very hard to audit for regulatory
purposes.
• One password per IT applicationmeans that users must remember
a lot of different passwords, one
for each system they need to use.
Password proliferation leads tomore help desk calls, lost productivity as users wait for password
reset, and increased IT administration costs.
• Manual administration is expensive and error-prone and leads todelays in provisioning and de-provisioning users, which decreases
productivity, jeopardizes security
and compliance, and introduces
data inconsistencies.
To address the key business drivers
and overcome the present limitations requires an enterprise-wide,cross-platform, centralized andautomated user management, provisioning and access management
system that controls access to IT
resources based on business roles,
policies, and processes. The system
must provide identity and accessgovernance aligned with businessprocesses and must allow off-loading routine administrative functions
and decisions from IT staff to users
and their managers so that decisions
about what users really need aremade by the people who know best.
Identity and access management(IAM) technology has evolved to awell-defined market category andhas reached the depth and breadth
to offer an effective way to satisfy
these requirements.

Identity and Access
Management
Identity and access management(IAM) is an integrated solution thatmakes user and access managementtransparent across the different systems, including cloud solutions, thatmake up the enterprise‘s IT infrastructure. IAM is defined as the services, technologies, products, andstandards that enable the use of digital identities. Identity management
addresses the need to administer
users and security policies acrossthe IT infrastructure, while accessmanagement addresses the realtime enforcement of the security
policies in force for each user of the
IT infrastructure. Audit automaticallyrecords all identity and access management transactions and stores
these records securely.

DirX Identity Features
DirX Identity provides a comprehen-

sive, process-driven, customizable,
cloud-ready, scalable, and highly
available identity management
solution for enterprises and organizations. It delivers risk-based identityand access governance functionality
seamlessly integrated with automated provisioning.
DirX Identity includes powerful,Web-based user self- service anddelegated administration, request
workflows, password management,user management, cross-platform,
real-time provisioning, access certification and metadirectory functionality. The provisioning of users andtheir access rights in various target
systems is driven by powerful, centralized role management supported
by flexible policy, workflow, and segregation of duty engines. In addition,
comprehensive scheduling, monitoring, and auditing are available.
User Management
User management includes all theactivities related to the creation,
consolidation, maintenance and use
of user accounts, user attributes,
roles, entitlements, and other data
relevant for the lifecycle management of users. DirX Identity supports
user management with four types ofobjects:• User: A user object in DirX Identity represents the user with its
personal attributes, roles, entitlements, and accounts. DirX Identity
can manage multiple accounts peruser object, but only one accountper target system.
• User facet: User facets are special
representations of users. They
serve to model multiple privilege
profiles for a user, one for eachposition the user holds within an
organization, for example a student who works both as a teaching assistant and as a tutor. User
facets share the same accounts
with the user. Using user facets
one can define and find out which
privileges have been granted forwhich position.
• Persona: Users may also work in
different functions in the company, for example as administrators or as project managers. The
accounts and the entitlements
for each functional representationof a user might be quite different,
typically more than one accountper target system is required andauditing should be able to distinguish between these functions.
For this purpose, persona objects
can be appropriate.
• Functional User: A functional user

User management consists of two
main tasks: maintaining an accurate
and up-to-date directory of users tobe provisioned and assigning users
to roles. The user directory is kept
up-to-date and consistent throughrequest processes from the users
and/or their managers (user self-service and delegated administration)and by data synchronization workflows (for example, with the enterprise HR system) provided by DirX
Identity’s metadirectory functionality.
In DirX Identity, user managementtasks include:• Adding users, changing the attributes of users and deleting users in
the identity store with DirX Identity
Web Center or Manager• Creating and synchronizing users
on a regular basis from various
sources such as HR, CRM, and ERP
systems or from an existing corporate directory masterTo reflect an enterprise’s Human
Resource management process, DirX
Identity allows for the maintenanceof lifecycle attributes:• A start date at which the user is tobecome active; for example, thedate at which a new employee
starts work
• An end date at which the user is
to be removed, for example, thecontract end date for an outsidecontractor• The start and end date of a leave ofabsence; for example, a maternity
leave
Personas and Functional Users
The lifetime of the user object comprises the lifetime of all associatedpersona objects. The lifetime of a persona object can be shorter than theuser lifetime. This is one possibility tomodel different contracts for a userthat works in the same company but
for different organizational units.
In contrast to a functional user, thepersona objects normally change
their status with the corresponding user object. Re-assignment toanother user does not make sense.
In contrast to a persona, the functional user can survive the user andhas to be re-assigned to anothersponsor (user) if the user is deleted
or no longer responsible for it.

• Making changes to your own data,
including your own passwords

In DirX Identity, persona management tasks include:• Recovering and resetting forgotten passwords through a challenge-response procedure• Adding personas, deleting personas, and changing the attributes of
personas, especially the attributes
associated with persona lifetimeand deactivation periods.
• Synchronizing the DirX Identity
personas with a corporate directory master makes sense if theconcept of different user representations is also supported by
the corporate directory. Otherwise,
only user objects are synchronized,
and personas are maintained in
DirX Identity.
• Assigning privileges to personas.
Assigning privileges is done thesame way and follows the same
rules for personas as for users.
Note: Most of the tasks describedabove also apply to user facet management.
Functional user management tasks
include:• Adding functional users, deleting
functional users, and changing theattributes of functional users.
• Maintaining the sponsor if therelated user for the functional userchanges.
• Assigning privileges to functional
users. Assigning privileges is done
the same way and follows thesame rules for functional users as
for users.
User Self Service
DirX Identity makes several tasks
available for self-service through its
Web Center user interface. User-oriented self-service tasks include:• Registering yourself with one ormore of the corporate services
available for self- registration• Requesting roles for yourself• Checking the status of yourrequests and approvals• Delegating your access rights (orsome of them) for user and role
management to other users
Access policies are used to make surethat a user has appropriate accessrights for self- service tasks.
Delegated Administration
Administrative access to DirX Identity data is controlled by accesspolicies and by personal delegation. By configuring access policies,
administrators grant access rights
to DirX Identity data like users, business objects, roles, target system
accounts and groups, policies andworkflows. For example, an accesspolicy can specify that project teamleaders can edit the user data andassign project-specific roles to themembers of their project team.
Other access policies can specify theapproval responsibility for users androles.
These users in turn can delegate
these rights or a subset thereof, tosomeone else, optionally for a specified period. This especially applies
to manage users and roles, assign
roles to users, or approve requests
for such assignments from theusers. For example, a project leader
who is away for two weeks candelegate the rights to assign project-related roles to the membersof his team to another person in his
group. Optionally the project leader
can permit his substitute to assign
only some roles which he specifies
when he performs the delegation.

Target Systems
User
Management

Role
Management

Risk
Management

User Self -Service

AccessCertification

RequestWorkflows

Delegated
Administration

Business Object
Management

Password
Management

Meta Directory

PolicyManagement

Real -Time
Provisioning

DomainManagement

Identity
Web Services

Audit,
Compliance &Monitoring

Agents and Connectors

object represents a resource thatis assigned to a responsible user
(sponsor). Examples are a global
or group mailbox, a physical roomwith a phone or a working student
entry. Such a resource is managed
by the user.

…

LDAP
Directory

SAP

ActiveDirectory

SharePoint& SkypeNotes &
Exchange

Cloud
Services(REST)

Database

WAM &
ESSO

RACF

PhysicalAccessSOAP &SPML

Health care

Files

LegacyFigure 1 - DirX Identity Functionality

DirX Identity V9.0 | 3

Delegated administration tasks in
Web Center include:• Creating new users, roles, groups,
business objects and policies• Making changes to user, role, business object and policy data
• Assigning roles to existing users• Approving the assignment of roles
to users or business objects or thecreation of users, roles, and business objects• Certifying the assignments of roles
to users• Deleting existing users, roles,
groups, business objects and policies• Running status reports
Access policies are used to control
which of these administrative tasks
a given administrator can perform
and on what users and other data heis allowed to perform them.
Password Management
DirX Identity provides a comprehensive password management solution
for enterprises and organizations.
Providing end users with a quick andflexible way to reset their password
based on strong password policies
or to unlock their account DirX Identity password management helps
organizations to significantly reduce
helpdesk costs and to strengthen
security of password-related authentication processes.
The password management feature
set includes:• Self-service password reset: Users
reset forgotten passwords or
unlock accounts using alternative
credentials.
• Assisted password reset: Administrators or service desk staff reset
forgotten passwords or unlock
accounts for users.
• Password expiration: Remind
users to change their passwords
before they expire.
• User enrollment: Users select andanswer security questions (alsoknown as authentication or challenge questions) as alternative credentials.
• Password Listener for Windows:
catches password changes fromthe Windows desktop.
• Password synchronization: Synchronize password changes totarget systems in real- time.
• Password policy management:
Manage and enforce rules for complexity, expiration and history of
passwords.

4 | DirX Identity V9.0

• Privileged account password management: Manage and control
access to passwords for sharedprivileged accounts.

regation of duties (SoD) policies forregulatory compliance.
The role model used in DirX Identity
is based on American National Standards 359-2004, the information
technology industry consensus standard for RBAC (ANSI/INCITS 359). The
ANSI RBAC reference model organizes the elements of RBAC into fourgroups of incrementally increasing
functionality: core RBAC, hierarchicalRBAC, static separation of duty (SSD)
relations and dynamic separation of
duty (DSD) relations. DirX Identity
supports level 3 RBAC, which consists of hierarchical RBAC with SSD.
However, while ANSI RBAC includes
system resources in its access control
model, DirX Identity leaves the management of the individual resources
to the local administration of thetarget systems.

• Audit and reporting: Keep trackrecords of password-related
actions and generate reports.
For a detailed description of the password management features of DirX
Identity and their benefits see thedatasheet DirX Identity - Secure andflexible Password Management.
Role Management
The goal of role management in DirX
Identity is to establish a logical layer
for the modelling and managementof access control information that is
generic enough to cover many of therelevant IT system’s authorization/access control methods:• Group-based IT systems control
access rights via account membership in groups. Making an accounta member of a group gives it theaccess rights that have been
granted to the group. User groups,
profiles, and application- specificroles are examples of group-based
methods of access control.

Figure 2 illustrates the relationshipbetween DirX Identity‘s role modeland the access control systems of theIT systems. As shown in the figure:• A user represents a person insideor outside of the enterprise for the
purposes of role assignment.
• A target system represents an
IT system that authenticatesand authorizes users. Examplesof target systems are operating
systems, messaging systems,
directories and databases, ERP
applications, Web portals andeBusiness applications, groupware
applications, and mainframe security systems.

• Attribute-based IT systems control access rights via attributes
in the accounts. For example, in
Active Directory, a set of accountattributes defines a user‘s mailbox; there is no concept of groupmembership.
• Some systems, like Microsoft
Active Directory, provide bothtypes of access control.

• An account represents a user ina target system. Users can haveaccounts in many different target
systems. In addition, DirX Identity
can handle privileged accounts
that can be temporarily assigned
to users.

DirX Identity uses a standards-basedrole management model that supports parameterization for granting
different types of access according
to contextual information, provides
request workflows with approvals
and re-approvals and access certification for role authorization andre-authorization and enforces segDirX Identity• A group represents a set of accessrights in a specific target system.
Groups provide the link between– User and Role Model

Users

Target System

Roles
Account
Role

Business
Objects

Policies

Assignment(manual,inheritance,rule -based)Group

Permission
AccessControl

TargetSystems

Account

Group

Figure 2 - DirX Identity User- and Role Model

Resource

the role/permission access modeland the target system‘s access
control model. A group can be
assigned directly to a user or indirectly through permissions androles that include the group (entitlement).
• A permission represents a set ofaccess rights that is target-system-neutral. A permission can be
assigned directly to a user or indirectly through roles that include
the permission. A permission
aggregates a collection of groups
from one or more target systems.
• Roles control users‘ access rights
to IT systems and resources. Roles
are assigned to users either manually (through user self- service oradministrative action) or automatically (via provisioning policies orinheritance from business objects).
DirX Identity supports general role
hierarchies as defined in ANSIRBAC – roles that correspond tojob descriptions can in turn contain (aggregate) simpler roles.
Consequently, a role aggregatesa collection of roles, a collection of
permissions, or both.
When a user is assigned a role, DirX
Identity provisions the target systems to which the role ultimately
applies with authentication data –the accounts – and the authorization
data – the account-group memberships - required to establish the role.
This process is called „role resolution“
and is discussed in more detail in the„Provisioning“ section.
DirX Identity‘s role model supports
parameterized RBAC, where theaccess rights modeled by a genericrole or permission can be customized on assignment to a specific user
based on contextual informationsuch as the value of role or permission parameters. A role parameter isa variable whose value is provided atrole assignment time. For example,
one generic role „Project Member“
can be assigned multiple times to thesame user for several different projects. Each time the role is assigned
to the user, a specific project nameis given for the role parameter. A permission parameter is an attributein a user entry whose values influences the permission‘s resolution
into groups. For example, supposea user in the Sales department of anorganization is assigned the permission „Departmental File Server“. If thepermission is parameterized by the„Department“ user attribute, DirX
Identity can use the „Sales“ value ofthe user‘s „Department“ attribute toresolve the permission into specifictarget systems and groups that are
relevant for the Sales Department
File Server. The permission „Departmental File Server“ is the same forall employees of the organization,
but its resolution to a specific target
system depends on the employee‘s
actual department. Role and permission parameters greatly reduce
the number of permissions and roles
that need to be defined and makerole management and assignment
based on high-level business roles(role-based assignment) appealing
and manageable in the enterprise.
Role-based assignment allows anenterprise to structure access rights
to resources according to well-defined business roles derived fromthe enterprise‘s business semantics
and users. The role-based model
works well when access rights are
more static – when they depend on
the person‘s job, for example, educational services trainer or quality
manager. In this case, roles don‘tneed to change when organizational
attributes change. Role parametersand permission parameters can beused to make role-based provisioning more dynamic.
Business Object Management
A business object is a collection ofdata related to a business structurein the enterprise such as an organizational unit, a cost centre or a project.
Custom objects can be added easily.
Business objects in an identity management system help to automateuser-role assignment and reduce
identity data redundancy.
In DirX Identity, business objects areused to• Build any kind of structure likeorganizational or project structures.

Changes to the information in thebusiness object – including references to roles – are automatically
propagated to the users linked tothe business object.
• Define parameter structures for
related drop- down lists or roleparameters.
In DirX Identity, business object management tasks include:• Adding business objects in a hierarchical structure, changing theattributes of business objects, anddeleting business objects in theidentity store with DirX Identity
Manager or Web Center• Assigning/linking users to theappropriate business objects• Assigning roles (or permissions
or groups) to business objects sothat users linked to the businessobjects can automatically inherit
them• Creating and synchronizing business objects on a regular basis
from various sources such as HR,
CRM, and ERP systems or froman existing corporate directory
master• Defining proposal lists that use thebusiness objects
Privileged Account Management
In addition to accounts that are
related to just one specified identity(user), target systems typically hold asmall number of privileged accounts
that are entitled to target systemmanagement. Such accounts, as forexample the root account in UNIXsystems, are allowed to performcritical actions in the target systemwith a high security risk. Privileged
accounts are not related to a specificuser. Several persons can use themin parallel.

• Manage data consistently. For
example, location can be definedwith all address data only once andlinked automatically to all relateduser entries. This helps to reduce
redundancy of user data in theidentity store by providing a single
point of control for common user
data.

• DirX Identity provides means
to control and audit privileged
accounts:• Automate user-role assignmentby allowing the roles referenced
by the business object to be inherited by the users linked to it (seefigure 2). For example, one canassign roles to an organizational
unit. If a user is assigned to thisunit, he inherits the roles automatically. If he is removed fromthe unit, the corresponding roles
are also removed from the user.

• Users that are assigned to privileged accounts can read the password in clear text to perform thelogin action.

• Any user can be assigned to a
privileged account by assigning arole. All features of role management like request workflows withapprovals and re-approvals, accesscertification or SoD are available.

• They are also entitled to change thepassword of privileged accounts.
• Removal of a user from a privileged
account automatically enforces apassword change.
• Alternatively, one can define that

DirX Identity V9.0 | 5

assignment of a user to a privileged account copies his certificates to the account. This allows
authentication via certificates at
the target system side.
• DirX Identit y automaticallychanges all expired privileged
account passwords.
Segregation of Duties
In a role-based system, conflicts ofinterest can occur as the result of auser receiving access rights associated with conflicting roles. The ANSIRBAC SSD component prevents thistype of conflict by enforcing constraints on the assignment of users toroles. DirX Identity implements thismodel of separation of duties - also
called Segregation of Duties (SoD).
Enterprise SoD policies specify whichuser-role assignments constituteconflicts of interest or pose unacceptable security risks. DirX Identity enforces these policies duringuser-role assignment and will notmake a user-role assignment that it
determines to be an SoD violation
unless special approval has been
performed. SoD policies can also
be defined for user-permission anduser-group assignments.
Policy Management
A policy is a high-level directive that isused to control the decision-making
behavior of the DirX Identity system.
DirX Identity supports the creationof security policies and administrative policies to control its operations.
Security policies manage access toresources, while administrative policies manage the integrity of DirX
Identity user, role, and target systemdata. DirX Identity policies include:• Access policies to control self-ser-

vice and delegated administrative access to DirX Identity data.
An access policy defines a set ofaccess rights to DirX Identity datalike users, business objects or roles.
For example, an access policy canspecify that project team leaders
can edit the user data and assign
project-specific roles to the members of their project team. Accesspolicies allow the enterprise to
structure administration tasks
according to its business or organizational model and to restrict theoperations on DirX Identity user
and role data that particular users
can perform as well as the visibilityof role assignments. Access policies are also used to control, which
menu entries are visible/usable
for users in the DirX Identity Web
Center user interface.
• Audit policies to define which attribute changes of which objects are
relevant to compliance with corporate security policies and government regulations and which
therefore should be tracked.
• Password policies to control therequirements placed by DirX Identity on user passwords, such as
password complexity, expiration
dates, the behavior of the systemafter failed logins, etc.
• Provisioning policies to grant andrevoke roles automatically basedon the values of user attributes
against the conditions of the policy,
which in turn controls the accessrights received in the target systems. Provisioning rules are used
to define this type of policy. For
example, a provisioning rule might
specify that a certain application
can only be used by employees in
the Sales department. The value ofthe user attribute „Department“is evaluated against the rule, andthose employees whose „Department“ value is „Sales“ are granted
the role to use the Sales application. When the value of the user
attribute - in this case, „Department“ - no longer matches thecondition of the rule - in this case,„Sales“ - the „Sales application“ roleis automatically revoked, and theuser is de- provisioned.
• Attribute policies to track changes
to critical attributes and automatically trigger request workflows forapproval.
• SoD policies to specify the combination of roles, permissions andgroups that cannot be assigned toa user in parallel without special
approval.
• Validation policies to compare
target system data against the
information within DirX Identity
to detect and reconcile deviations between the target system‘saccounts, groups, and accountgroup memberships and the same
information in DirX Identity. Validation rules are used to define thistype of policy.
• Consistency policies to check theconsistency of user and role data
within DirX Identity and repair any
inconsistencies, for example, tokeep account and user data consistent. Consistency rules are used
to define this type of policy.
The DirX Identity policy engine processes administrative policies either
dynamically or periodically (depending on the kind of policy), while the
DirX Identity security manager processes security policies dynamically.
Request Workflows
DirX Identity provides several types
of workflows that support user
self-service and delegated administration activities:• Request workflows that create
new identity management data(creation workflows), like users,
roles, permissions, policies, and soon including global id generation
for user creation workflows• Request workflows that change
existing identity management
data (modification workflows).
Examples are attributes of users,
roles, or business objects. Attributepolicies govern which attributechanges have to be approved andwhich workflow for which attributeis to be started.

Figure 3 - DirX Identity Business User Interface - View Roles

6 | DirX Identity V9.0

• Request workflows that create
and maintain relationships
between identity management

data (assignment workflows); forexample, assigning a role to a useror assigning a role to another role(role hierarchies).
• Request workflows that delete
existing identity management
data (deletion workflows), likeusers, roles, permissions, policies,
and so on.
DirX Identity allows requestors andapprovers to digitally sign theirrequests and approvals respectively.
DirX Identity provides template
request workflows. Customers canmake copies of these templates andthen use DirX Identity‘s graphicalworkflow editor to tailor them to theirrequirements.
Management of request workflows
is protected by access policies andcomprises start, stop, suspend, andresume operations as well as change
participant functionality.

Approval
Request workflows can containoptional approval steps that manage
the authorization requirements forthe request.
A user-role assignment, for example, can require initial approval andcan also require re- approval after a
specified period (for example, every
6 months) or on a specified date andtime. Approval and re-approval steps
can be defined for these roles to carryout the approval and/or re-approval
process automatically. The approval
process supports a variety of models
for determining participants, including single individual approver, staticand dynamic approver groups, andpolicy-driven calculation. If required,additional methods can be implemented via Java extensions.
Users request an approval via the
Web Center or the Business User
Interface. The workflow then notifies each person in the approval
path – for example by e-mail – thatan approval request is to be handled.
The approver uses either Web Center,the Business User Interface, or the
Approval App to accept or reject therequest. Escalation mechanisms
help to cope with problems such as
timeouts, etc. In addition to individual approvers, one can assign a groupof approvers, e.g., helpdesk personnel, to handle an approval request. In
this case, the approval is performedby one member of the group on afirst-served basis.
Risk Management
DirX Identity provides risk assess-ment for identities based on an
extensible set of risk factors.
To classify users into risk categories
from low to high, risk factors for users
are regularly calculated and aggregated into a compound risk according to a customizable configuration.
Examples for risk factors are SoD
violations, imported accounts andgroup memberships and total
number of group memberships or
privileged accounts. For any user,
Web Center displays its risk category.
DirX Identity Manager additionallydisplays all individual risk factors.
Compliance officers, line managers
or administrators can then monitor
the risk values and plan actions to
reduce the number of high-risk users
e.g., by running appropriate certification campaigns or by enforcing additional approval steps.
For any requested change in a user’s
privilege assignments, DirX Identity
can compare the compound risk
before and after. If the risk category
would increase by the requested
privilege assignment, additional
approval steps may be required.
Access Certification
Access certification allows attesting that access rights are assigned
to users in compliance with internal security policies and legal regulations. DirX Identity supports
certification campaigns for users
and privileges, e.g., roles or groups, tosupport such compliance processes:• A certification campaign performs access certification for aselectable subset of users or privileges, e.g., for all users in the HR
department or for all sensitive
privileges. For each user or privilege, one or more approvers e.g.,line managers or role owners areautomatically defined. For eachuser or privilege to be certified, theapprovers can see all assignments
and can decide whether to accept
or reject each individual assignment. As an option, privileges thathave been assigned manually andwere rejected in the campaign are
revoked automatically and corresponding users are notified. DirX
Identity supports both one-timeand periodic certification campaigns. Certification campaign
phases are controlled via startdate, due date, end date and expiration date. When a certification
task is approaching the due date,reminder notifications are sent tothe approvers.
• DirX Identity also supports accesscertification of an individual privilege assignment by the re-approval feature. In this case theapproval for selected and criticalprivileges is repeated after a specified time interval. Re-approval isdone either by running the same
workflow as for the initial privilege approval or by a specific one.
If an approver rejects the assignment, the privilege is immediately
revoked. Re-approval for selectedprivileges can be enabled together
with timing conditions.
Real-Time Provisioning
Provisioning is the process of establishing the target system-specificaccess rights to which a user-to-role
assignment ultimately resolves.
Provisioning makes use of all the processes of user, role and policy management discussed in earlier topics.
Provisioning is a two-step process:• Calculating the accounts, thegroups, the target systems towhich the accounts and groups
belong, and the account-groupmemberships that result fromthe role assignments to users andcreating the account, group, andgroup membership data in theidentity store – this process is calledrole resolution and can involve thematching of user attributes toprovisioning policies, permission
parameters or role parameters
where appropriate.
• Using the connectivity infrastructure to physically transfer theaccess rights data immediatelyfrom the identity store to thetarget systems and ensure theconsistency of the target systemdata with the access rights derived
from the role resolution. To optimize support of a huge number oftarget systems (up to 10.000), e.g.,
in outsourced environments, DirX
Identity allows clustering target
systems, i.e., one workflow can provision many target systems.
User-to-role assignments that
require approval are not provisioned until every approval has been
received.
Note that it is the administrator of thetarget system who assigns accessrights to the resources on the system
for a given group. This process is outside of DirX Identity and is accomplished using the target system‘sadministrative tools and enforcedby the access control componentsof the target system. The enterpriseneeds to have an organizational process in place that controls both the

DirX Identity V9.0 | 7

set-up of policies and the role structure and the assignment of accessrights to groups in target systems.
When there is a change in the user‘sroles, permission parameters, orrole parameters, or when there is achange in a user‘s attribute that controls a provisioning policy, DirX Identity automatically and immediately
performs a new role resolution andprovisions all changes to the target
systems.
DirX Identity provisioning services
provide centralized, consistent,
single-point and fully automatedadministration of users and theiraccess rights within the enterprise IT
infrastructure.
DirX Identity supports the execution of any executable or script from
Java-based workflow user hooks.
This allows for example via the PowerShell technology the management of home folders for Microsoft
Active Directory accounts or immediate mailbox enabling for Microsoft
Exchange.
Service Management Support
DirX Identity supports the integration of service management systems such as support ticket systems
or action request systems both assource systems and as target systems:• Service Management as a source:
If a customer has a ticket systemalready in place that is used for any
type of request, it makes sense toreuse that system as a source fororders. A ticket can be used to trigger specific identity management
actions. Examples of such tickets
are requests for user creation or
modification or for role assignments.
• Service Management as a target:
If the customer has a ticket system
in place that is already used to initiate manual provisioning of target
systems, DirX Identity can place
an order by means of a ticket.
Local administrators work on thesetickets from the ticket system andconfirm the completion of theirtasks. Connectors to commonlyused ticket systems (Remedy, HP
OpenView) can be implemented
via custom connectors within acustomer project.
• Manual
provisioning of of f line s ys tems:
If the customer has no ticket
system in place and if there aretarget systems that are not managed by DirX Identity, i.e., the target
system is offline, one can use a
8 | DirX Identity V9.0

manual provisioning approach via
DirX Identity request workflows.
In this case, the provisioning workflows for synchronization establish
a request workflow for each event.
The administrators of the target
systems get these add, modify, ordelete requests via email, performthe actions manually and confirm
the completion of their tasks.
Scheduled Change Management
It allows managing changes that
become effective in the future, e.g., amove of a person to another department scheduled for July 1st.
Consequently, such a change maylead to changes of assigned privileges. At the effective date, DirX Identity changes the person‘s data andprocesses subsequent changes thatare mandated by policies and privilege resolution, Administrators canview pending and processed changeorders made on DirX Identity objects
to track the order status and results.
Metadirectory
DirX Identity metadirectory is the setof services that integrates the disparate directories, user databases,
and application-specific information
repositories into a centralized datastore and provides the connectivity,
management and interoperability
functions that unify the user data(“join”) and ensure the bidirectional
attribute flow (synchronization) in
this fragmented environment. The
metadirectory provides:• Integration services that collectand integrate user data from multiple authoritative sources - humanresources directories, enterprise
resource planning (ERP) systems,
customer relation management(CRM) and Supply Chain Management (SCM) databases - into asingle, unique digital identity that
represents the user to be provisioned in the IT systems.
• Synchronization services thatmaintain an accurate and up-todate identity store of these identities and synchronize identity datafrom the identity store back into
the authoritative sources.
For both integration and synchronization services:• DirX Identity agents and connectors enable data exchange
between the different target systems and the identity store• Execution can be scheduled, triggered by specific events, or initiated by hand by an administrator
and can be monitored and logged

for auditing purposes.
• Flexible data flow and ownershipmodels allow the enterprise to control who owns the data, what data
is synchronized, and how update
operations on the data are carriedout, including authoritative control, filtering, and operations mapping.
Default Applications
A powerful set of default applications
are delivered with DirX Identity. They
hold ready-to- use examples for typical identity creation, maintenanceand synchronization processes thatcan be easily tailored to set up customer solutions.
The default applications• Provide applications for all supported connected directories andagents• Are based on a unique architecture with a standard set of control
parameters and scriptable extensions accessible via wizards• Can easily be upgraded due to aclear separation of standard script
code and customer extensions.
Audit and Compliance
DirX Identity provides configurable,
customizable, and comprehensive
audit trail, status reporting and querymechanisms to help ensure and document regulatory compliance.
The audit trail mechanism can track
all relevant identity management
events, recording information suchas the date/time the event occurred,
the identity that initiated it, the users
who approved it, and whether it was
carried out by hand or automaticallyby a policy. The audit trail mechanism
allows backtracking of an event tothe causing event within a hierarchical event chain. DirX Identity supplies
a set of pre- configured audit policies
and permits customers to define
their own audit policies to satisfy individual corporate requirements. If theaudit logs are not directly supplied to
DirX Audit, they are stored in log files
in XML format to a central location for
centralized visibility and traceability.
The files can be optionally secured
with a system-specific digital signature to make them tamper-proof. A
command-line tool allows for verifying these signatures.
The status reporting mechanism
can generate regulation-specificand custom status reports in XML,
HTML, or pure text format on all DirX
Identity objects on demand or atscheduled intervals. Customers canuse DirX Identity reporting to create
reports on specific objects, object
lists or object collections and their
attributes, user-role, permission, andgroup assignments, delegated users
and administrators, unused roles, theentire role catalogue, the completerole hierarchy, and provisioning
workflow hierarchies. DirX Identity
provides pre-configured reports forcommon regulations and allows customers to use Extensible Stylesheet
LanguageTransformations (XSLT) to customize
them or create their own reports tomeet specific requirements. Accesspolicies can be applied to reports tosafeguard their security.
While a status report typically comprises the content of many related
DirX Identity objects and showsthem as a whole, a query typicallyruns on a specific type of object - forexample, a user or a role - with a specific search filter and returns a set ofobjects to examine. A query can beused, for example, to return a list of
objects in an error state. An administrator can examine each object, fix
the error, then run the query again
to make sure the object is no longer
returned in the list.
DirX Identity provides for seamlessintegration with DirX Audit. DirX
Audit also belongs to the DirX product suite. It provides for centralized,
secure storage, analysis, correlation,and review of identity-related audit
logs via a single user interface providing auditors, security complianceofficers, and audit administratorswith the answers to the „what, when,
where, who and why“ of user accessand entitlements.
DirX Identity auditing, status reporting and query work in concert withother DirX Identity services to permit
fast, cost-effective deployment ofregulatory compliance controls:

and re- approval steps automate
the application of corporate authorization policies, ensuring that they
are applied consistently rather
than on a case-by-case basis• An additional level of compliance control is added by allowing
requestors and approvers to digitally sign their actions in the workflow• Automated, real-time user de-provisioning ensures that accessrights of terminated employees
and contractors are immediately
and accurately revoked on allaffected IT systems• Automated reconciliation services
can detect suspicious accounts
and access rights on corporate
IT systems and eliminate them
automatically or report them tothe appropriate administrator forhandling• Segregation of duties enforcement
by user provisioning services prevents user-role assignments that
violate corporate security policies
or create unacceptable risks• Request workflows with approval

Several sample domains are delivered with DirX Identity which illustrate the typical way to work with
DirX Identity in a customer environment and show most of the features
DirX Identity provides. The sample
domains can be automaticallyinstalled with DirX Identity.

DirX Identity Components
The main components of DirX Identity include• Identity Business Access• Identity Administration Access• Identity Manager• Identity Store• Identity Server• Identity Services• Agents and Connectors• Identity Web Services• Identity REST Services• Identity Integration Framework• Messaging Service• Pre-configured audit policies andreports help to jump-start regulatory compliance efforts

Figure 4 illustrates these components and the relationships between
them.

Domain Management

Identity Business AccessMulti-tenant support is provided by
the concept of DirX Identity domains.
A DirX Identity domain is a high-levelseparation of DirX Identity data thatcan be used to establish different
policies and role models in a single
DirX Identity system. Domain management tasks consist of:• Setting up a domain• Managing DirX Identity administrators• Generating information about adomain (reports)• Metadirectory services allow identities and their access rights tobe centrally managed, providing
greater transparency into identity
management activities and tighter
administrative control with fewer
administrators• Automated role- and policy-baseduser provisioning ensures that corporate security policies are consistently enforced across all points
in the corporate IT infrastructure,
avoiding error-prone, ad hoc application of access rights by many different IT administrators working indifferent parts of the enterprise• Maintaining database consistency

Identity
Manager

IdentityStore

The Identity Business Access provides different user interfaces foradministering the business featuresof DirX Identity:• Identity Business User Interface• Identity Web Center
Identity Business User Interface
The features provided by the DirX
Identity Business User Interface
focus on the most common use
cases of business users. The userinterface is designed for tablets andsmartphones as well as for desktop
computers. The Business User Inter-

Business Access

Admin Access

WS/REST-Application

Identity
Services

Identity
Services

Integration
Framework

Scheduling

PolicyExecution

Web Services and
Identity Web API

Notification

Role
Resolution

Connector Integration
Framework

RequestWorkflows

Risk
Assessment

Agent Integration
Framework

Supervisor

Provisioning
Workflows

Auditing, Logging& Monitoring

Certification
Campaigns

TargetSystem…

TargetSystemAgentsandConnectors

SCIM 2.0, SPML, LDAP, SOAP, Messaging

Figure 4 - DirX Identity Server Architecture

DirX Identity V9.0 | 9

face is based on the HTML5 responsive design approach. It supports thefollowing major use cases:• Login with Password, OAuth,
Smart Card or DirX Access• Display and edit of own profile• Request a new role or permission(like a group)• Display and edit role parameters ofassigned roles• Delegate the approval function toanother user
• Show pending role or permission
requests incl. cancel pending
requests• Approve role, permission, group,
profile change or business objectchange requests• Team Management: edit profile,
request roles (or permissions) or
reset password for other users in
the team.

• Identity Server Admin

DirX Identity.

• User Management: create, modify,
and delete of user identities

Identity Web Admin

Identity Manager

Identity Web Admin is a Web-based
management interface for the Identity Server built on the Java Management Extensions (JMX) technology
for creating management and monitoring tools. Customers can use Web
Admin or any other JMX client for
example, Oracle’s JConsole - to monitor and tune the Java-based Identity
Server from the Web. Web- based
administration tasks include supervising server status, observing server
statistics, viewing process instances,and optimizing for load distribution
and performance.

The Identity Manager provides aneasy-to-use, Java-based graphicaluser interface for transparently configuring and managing all aspects of
DirX Identity, including:• Certification Campaigns: Display,
approval, or rejection of (re-)certification requests
Identity Web Center
The Identity Web Center is the component that enables user self-service
and delegated administration froma Web browser. Customers can integrate some of or all the Web Center‘sfunctions into their Web portals, andthey can customize the layout of the
Web Center‘s HTML pages.
The Identity Web Center provides
Web single sign-on integration withSAP NetWeaver and leading Web
access management products, e.g.,
DirX Access and Entrust GetAccess.
Generic mechanisms allow single
sign-on integration with many otherWeb access management products.
In addition, DirX Identity Web Center
supports Microsoft Windows single
sign-on.
For integration with SAP NetWeaver
Portal, the Identity Web Center isprovided as a complete URL-iView.

Figure 5 - DirX Access Manager - Example of Administrator User Interface

The Java-based Identity server maintains a dead letter queue that stores
erroneous („dead“) messages andevents that have encountered problems. Administrators can use Web
Admin to examine the information
about an item in the queue, determine the cause of the problem, reconfigure the server accordingly,
and process the message (or event)again. Administrators can also use
Web Admin to delete messages in
the queue that are no longer needed.

The Identity Web Center for Password Management (available with
the Password Management Option)
provides an enhanced and specialized interface for password management functionality.

Special Web interfaces allow controlling and monitoring the workflow
engines, e.g., monitoring workflow
statistics, and the Java- based identity server.

Identity Administration Access

The Web application Server Adminallows to monitor the health stateof DirX Identity servers and to movetasks between servers for load balancing or ensuring business continuity. The Server Admin is available
with the High Availability Option of

The Identity Administration Accessprovides different user interfaces for
managing and monitoring the DirX
Identity servers:• Identity Web Admin

10 | DirX Identity V9.0

Identity Server Admin• Users and services• Roles and policies• Integration, synchronization, andrequest workflows• Target systems and authoritative
sources
Identity Manager can also be used
to monitor provisioning, all types ofworkflows, role resolution and policy
execution.
Identity Manager supports the SSL(Secure Socket Layer) protocol forauthenticated, encrypted communication with the Identity Store.
Identity Manager supports strong
authentication with smart cards. It
provides authentication/ login via
all CardOS smart cards that are supported by Atos CardOS API.
Identity StoreThe Identity Store is an LDAPv3
directory (DirX directory server) thatserves as the consolidation point (thedirectory „join“) for identity integration from authoritative sources andas the distribution point for provisioning and synchronization of thetarget systems in the enterprise IT
infrastructure.
The Identity Store is the repository
for all DirX Identity configuration
data, including user data, businessobjects, roles, policies, target system

account, group, and account-groupmembership data and the configuration and operational data requiredby the metadirectory integration andsynchronization services. The Identity Store provides the central point
for management of this data and forits synchronization back to the target
systems and authoritative sources.
To provide for distribution and scalability, parts of the configuration andmonitoring data can be distributed
to other directory servers.
Identity Server
The Identity Server provides a comprehensive runtime environment
for event-triggered and scheduled
provisioning workflows. The server
provides components for:• Handling event-triggered provisioning tasks like the real-time synchronization of provisioning eventsor password synchronization• Scheduling provisioning and realtime workflow runs, including
recovery and retry operations if
problems occur• Notifying administrators via email
and SMS about provisioning workflow events• Messaging services, message
queue support and JMS clients• Auditing, logging, and collecting
statistics to help administrators
and auditors to analyze and control
DirX Identity‘s execution environment
Server components can be distributed across different systems in theenterprise network to provide forload-balancing, high availability, andscalability.
DirX Identity provides two types of
Identity Server: a Java-based Identity
Server that handles Java application
programming interfaces (APIs) and a
C++-based Identity Server that handles C and C++ APIs.
The Java-based Identity Serveris designed to handle primarily
event-triggered provisioning processes. These types of processes are
required, for example, by password
management: the real-time provisioning of user password changes
made through the Identity Web
Center or coming from the Windows
Password Listener. When a userchanges his or her password, theJava-based Identity Server ensuresthat the new password is synchronized immediately with the user‘s
accounts in the appropriate target
systems.
The Java-based Identity Server also

Figure 6 - DirX Identity Manager – Account-Group-Membershipsupports the real-time provisioningof changes that are calculated, forexample, by role resolution.
Changes to a user‘s role assignmentsor parameters may require changes
to accounts and account-groupmemberships in one or more target
systems. The DirX Identity systemsends these changes as events toJava-based Identity Server workflows, which transfer the information
immediately to the target systems.
Another example is the change of abusiness object, for example an organizational unit.
Changed attributes are propagated via events to all users that areassigned to this unit.
Assignment of roles to the unit
results in immediate inheritance of
these roles to all these users.
This technology is completely built
on the Services Provisioning Markup
Language (SPML) standard. Javabased Identity Server workflows canalso run in scheduled mode, mainly
to guarantee the Identity Store‘s consistency.
The Java-based Identity Server offers
features for load distribution andscalability, error handling - including
notification services - and configurable auditing and logging.
The C++-based Identity Server isdesigned to handle provisioning infull and delta mode: the provisioningof complex objects or a large numberof objects at a scheduled time, forexample, a group of new employees
all hired on the same date, a groupof new employees that have moved
from one department to another, or a
new subscriber database that needs

to be integrated and provisioned.
The C++-based Identity Server is theruntime environment for executing
workflows that use the DirX Identity
meta controller and agents. It canalso host connectors that handle
C++-based interfaces to target systems that are used by the Java-based
Identity Server‘s event-triggered
and scheduled workflows. The C++based Identity Server supports distributed and nested workflow runs
in a heterogeneous network as well
as exception handling and recovery
mechanisms including restart ofworkflows according to previously
set automatic checkpoints.
Identity Services
DirX Identity Services run in the Identity Server environment and include:• The policy execution service, whichruns rules against various objects
for automated role assignmentand consistency and validation
checks, including automatic reconciliation.
• The role resolution service, whichcalculates from abstract role structures the detailed access rights
required in the necessary target
systems.
• The request workflow service,
which handles actions related
to configured request workflow
activities; for example, attribute
input from users and approval ofrole assignments or objects by thepeople in an approval list or by calculated approvers.
• Event-triggered provisioning
workflow services, which perform
fast, immediate real- time provisioning or password synchronization.

DirX Identity V9.0 | 11

• Scheduled provisioning workflow
services, which perform complex
identity creation, maintenance,
and target system provisioning
tasks.
• A campaign generator to run andmonitor certification campaigns.
Agents and Connectors
DirX Identity agents and connectors
enable data exchange between the
different target systems and theidentity store during integration andsynchronization operations.
A connector is a Java component
that implements the connector
interface and performs update
and search operations for a specifickind of target system. It runs in the
Identity Server and is called by theprovisioning real-time workflow to
exchange data between a target
system and the identity store.
An agent is a stand-alone executable that supports the interfaces toa specific target system to enable
data exchange between that target
system and the identity store. It may
be realized by a connector embedded in the Identity connector framework.
Agents can only work with scheduled
provisioning services, while connectors can work with both scheduled
and event-triggered provisioning
services.
In addition to native DirX Identity
connectors, DirX Identity provides
connector bundles that run in OpenICF connector servers. DirX Identity
leverages an OpenICF connector
server as provisioning proxy. The
integration of DirX Identity withOpenICF connector server is accomplished by the native DirX Identity
OpenICF proxy connector.
Identity Web Services
The Identity Web Services are used tointegrate DirX Identity‘s provisioning
features into SOA- compliant application environments. One can handle
users, roles, permissions, groups,
accounts, target systems and business objects completely via DirX
Identity’s Web Services interface.
They implement the OASIS SPML
standard. In addition to the SPML
standard operations (add, modify,
delete, lookup, search) the services
support the following capabilities:• User: add including global id generation, role assignment, disable/
enable, password change• Role: role parameters• Permission: match rules
12 | DirX Identity V9.0

• Group: account-group memberships.
• Account: disable/enable and set
password, account-group memberships, read password policy,
authentication via security questions or signature of requests• Target system: tombstone featureand references• Business objects: references toroles and other business objects.
For all object types a user hook canintercept requests and responses
and perform custom operations
such as moving entries, creating orchecking unique identifiers.
DirX Identity also provides SOAPbased workflow services to control
the execution of request workflows:
methods to create, modify andmanage workflows are provided. Clients can retrieve worklists and information about workflow definitions
and instances and approve theirtasks.
The SOAP-based Identity Web Services provide Web single sign-on
integration with SAP NetWeaver
and leading Web access management products, e.g., DirX Access andEntrust GetAccess.
Identity REST Services
The Identity REST Services are used
to integrate DirX Identity into application environments which want
to use the standard HTTP protocol
and the performance and scalability advantages of REST-based services. Especially, they can be used bymodern, HTML5-based Single-Pageapplications; one example is the DirX
Identity Business User Interface.
The REST services adhere to SCIM 2,
the System for Cross-Domain Identity Management. They provide thefollowing functionality with JSON asdata format:• Approval – Users can approve theirtasks and accept or refuse themeither task-by-task or in bulk mode.
• Self Service – Users can request
roles (or other permissions), viewand edit their profile and change
their password.
• User Service – Users can request
roles (or other permissions) for
other users, view and edit the profiles of other users, and reset theirpassword.
• Delegation Service – Users can delegate tasks to other users.
• Domain Service – Users canmanage any type of objects in a
generic way.

• Certification Service – Users canview running campaigns and open
certifications.
• Ticket Service – Users can view anddelete tickets.
• Workflow Service – Users can view,
create, edit, and delete workflows.
Identity Integration Framework
The Identity Integration Frameworkcomprises the public interfaces of
DirX Identity. This framework allows
customers to:• Use the Identity Web Services or
REST Services.
• Use the SPML-standardized set ofinterfaces and common utilities in
the connector integration framework to implement custom connectors to access target systems
via Java or C++ based interfaces.
• Use the agent integration framework to integrate executables orbatch files as agents into batch-oriented workflows• Integrate parts of the Identity Web
Center into their portal applications or use the Identity Web API
to add extra functionality.
Supervisor
The authentication and authorization
mechanisms of the respective LDAP
directory allow protecting attributes
and passwords. DirX Identity provides additional security features:• All components can optionallywork in SSL/TLS mode when using
LDAP connections.
• Data transfer via the messaging service can be optionallyencrypted to provide high security
during network transfer.
• Most attributes, especially passwords can be stored in strong
encrypted mode in the Identity
store. DirX Identity guarantees
that data transfer and logging issecure up to the interface of theconnected target directory.
Messaging Service
Der Messaging Service stellt Funktionen für die Ausfallsicherheit zur
Verfügung wie “Store and Forward”
und automatische Wiederzustellung
von Nachrichten. Er ist konform zum
Java Message Service. DirX Identity
nutzt Apache ActiveMQ als Messaging Service.

Standards support
DirX Identity components support
several standards for connectivity,
storage, and data formatting:• The identity store and configuration repositories use Lightweight
Directory Access Protocol (LDAP)
and the connectivity services
use LDAP to communicate with
LDAP-enabled target systems

Scalability• The role management model
implements the ANSI RBAC reference model (ANSI/INCITS 359).

DirX Identity provides features forstatic and dynamic load balancing
on these instances:• All provisioning components workwith Services Provisioning Markup
Language (SPML) 1.0 requests
and responses internally: data
exported and imported from/to
external systems are converted toand from SPML.

• For static load balancing, Javabased Workflows can be assigned
to selected Java-based server
instances according to their type:
Request Workflows, Provisioning,
Password Change and Event Maintenance.

• Identity Web Services implement
the OASIS SPMLv2 specification
using the SPMLv2- DSML profile.
• The Identity Integration Framework (Java, C++, C#) supports SPML
1.0 for the construc- tion of custom
connectors that transform internal
requests to proprietary APIs.
• The Identity Services and Identity
Server messaging queues comply
with Java Messaging Service (JMS).
• The Identity Web Admin is built
on Java Management Extensions(JMX) technology. As a JMX agent
the Identity Java Server can be
managed via JMX.
• DirX Identity connectors provision
target systems via Simple Object
Access Protocol (SOAP) version 1.2
and SPML version 1.0 and 2.0, andworkflow and provisioning services are called via SOAP.
• DirX Identity RESTful API services and connectors use SCIM v2
standard and are described anddocumented in OpenAPI v3 specification.

Security
The authentication and authorization
mechanisms of the respective LDAP
directory allow protecting attributes
and passwords. DirX Identity provides additional security features:• All components can optionallywork in SSL/TLS mode when using
LDAP connections.
• Data transfer via the messaging service can be optionallyencrypted to provide high security
during network transfer.
• Most attributes, especially passwords can be stored in strong
encrypted mode in the Identity
store. DirX Identity guarantees
that data transfer and logging issecure up to the interface of theconnected target directory.
•

To achieve scalability in a DirX Identity deployment, one can set up multiple instances of Java-based andC++-based servers.

• For dynamic load balancing,
Java-based Workflows can bedispatched among multiple Javabased server instances that havebeen statically assigned for therespective workflow type.
• Classic, Tcl-based batch workflows
can be distributed to all installed
C++-based DirX Identity servers to
distribute load.

Deployment
DirX Identity provides mechanisms
to reduce deployment time ensuringsmooth transition from one environment to another, e.g., from staging
systems such as development or test
systems to production systems aswell as configuration management
systems. This also allows for rapid
deployment of multiple DirX Identity
instances.

Business Continuity
With the High Availability Option
DirX Identity supports continued
operations for the message service,
for Tcl-based workflows, and for Javabased workflows.
The Server Admin Web application
provides an overview of the stateof all Java- and C++-based servers
as well as the message brokers andallows moving functionality between
them. DirX Identity supports bothadministrative failover and automatic failover. In case of administrative failover administrators can move
• A Java JMS adaptor and thus theassociated workflows to another
Java-based Identity Server.
• The request workflow processing
to another Java-based Identity
Server.
• The scheduler service to another
Java-based Identity Server

failover via circular monitoring: eachJava-based Identity Server monitors
the state of another one, altogether
building a circle. If the monitored
server is not available anymore, themonitoring server takes over its functionality. One of the Java-based Identity Servers monitors the C++- based
servers. If it is not available anymore,
it moves the workflows to anotherC++-based Identity Server.
The automatic failover solution iscontrolled by a Groovy Script that canbe adapted to project specific needs.
DirX Identity provides backup andrestore capabilities to help ensure
data availability and reliability. This
includes a synchronized, joint backup
and restore for the Java-based Identity Server and the DirX DirectoryServer.

Nagios Support
DirX Identity provides a set of specialized Nagios plugins and commands
for the JNRPE Nagios add-on thatcan be used in an existing Nagios
environment to monitor the statusof DirX Identity service resources andoperations and to collect statistics
about these items for later analysis.
The DirX Identity Nagios plugins
allow monitoring:• All information provided via JMX,
especially from Java-based Identity Server and other JMX-enabled programs such as Apache
ActiveMQ and Tomcat• The C++-based server using internal DirX Identity interfaces.
The DirX Identity Nagios plugins provide input parameters for specifying
warning and critical thresholds to bemonitored for DirX Identity service
operations, offering DirX Identity
administrators the opportunity torespond to problems detected by theplugins and displayed by the Nagios
server before they become severe,and to track their resolution.
DirX Identity provides commands for
the Nagios JNRPE add-on to check:• The state of the Java-based Identity server• The outstanding responses of a
specific JMS adaptor• A statistics attribute of a specified
workflow• JVM memory usage• The state of the C++-based server• The Tcl-based workflows toanother C++- based Identity Server
DirX Identity supports automatic
DirX Identity V9.0 | 13

Customization
DirX Identity is designed to be highly
customizable with regard to its functions, objects and to the display of its
objects in its user interfaces. Customization includes• Configuration via LDAP, XML, flags,
parameter, etc.
• Extensibility using JavaScript, Java,C++ or by integrating other processes.

License Options
DirX Identity is available with two
options for the base license: Business Suite and Professional Suite.
The Professional Upgrade option
allows a customer to extend the Business Suite license to a Professional
Suite license. The base licenses canbe extended by the following add-on
license options: Connectivity Packages, Password Management Optionand High Availability Option.
Table 1 at the end of this document
provides an overview of the mainfeatures of the Business Suite, theProfessional Suite, and the Password
Management Option.
DirX Identity Business Suite
DirX Identity Business Suite provides user lifecycle management,
rule-based provisioning of accounts
and groups in target systems, validation, and reconciliation of target
systems, metadirectory functionality, Web-based user self-service tomanage own data, business object
management, domain managementand default connectivity. It also provides report functionality on users,
accounts groups, target systems,
and access policies.
DirX Identity Professional Suite

the Password Management Option
provides a specialized Web Center for
Password Management that allows
password change by end-users fora subset of their accounts, displayof the password change status, andchallenge/response procedures toreset forgotten passwords by administrators or help desk. This option also
includes the Password Reset Clientfor Windows.
DirX Identity High Availability
OptionThe High Availability Option supports
continued operations with automatic and administrative failover.
The supervisor monitors the servers
and allows for automatic failover.
The Web application Server Admin
provides for administrative failoverby manually moving tasks between
servers.

DirX Identity Connectivity
Packages
DirX Identity provides connectivity to
many target systems that are structured in connectivity packages.
Default Connectivity
DirX Identity provides default
connectivity to DirX Access, toSPML-enabled applications, to LDAP
directories and to DirX Identity
domains.
DirX Access• Customization / extension possible• Error reporting and tracing• Runs on Microsoft Windows and all
supported Linux platforms
DirX Identity Domain
A specialized real-time connector
supports the provisioning of a DirX
Identity domain. It directly leverages the features of the service
layer, namely the rules of the object
descriptions, assignment of roles
even with role parameters and the
direct role resolution. This connector especially simplifies importing ofusers by calculating default values
for attributes, applying provisioning
rules for automatic role assignment,
and requesting approvals where necessary.
• Connectivity to a DirX Identity
domain• Support of all entry types fromusers to business objects, roles,
groups, and accounts• Evaluates object descriptions andprocesses their rules to calculate default values and values ofdependent attributes• Assignment of privileges with startand end date and of roles withparameters• Seamless integration by shared
LDAP user repository• Password changes for users andaccounts• Real-time provisioning and password synchronization• Searches paged and non-paged• Runs on Microsoft Windows and all
supported Linux platforms
SPML-enabled Applications

DirX Identity Password Management Option• Connectivity to any LDAPv2 or
LDAPv3 compliant system

14 | DirX Identity V9.0

• Agent and agentless mode possible (in this case the connector runsin the Java Server)• Supports DirX Access V9.0 or
higher

DirX Identity Professional Suite isbased on the Business Suite andadditionally provides Identity andAccess Governance (IAG) functionality such as role management withassociated policy management andreporting functionality, segregationof duty support, request workflows,
approval and re-approval, accesscertification, rule-based and manual
assignment of roles to users, password management functionality,
audit services to audit password
changes and administrative changes
in DirX Identity.

In addition to the basic password
management functionality provided with the Professional Suite,

word synchronization• Support of LDAP filters and multivalue attributes• Supports SPML V1.0 and V2.0
• Supports add, modify, delete,search and getSchema operations• Real-time provisioning and password synchronization• Agent and agentless mode possible (in this case the connector runsin the Java Server)• Error reporting and tracing• Runs on Microsoft Windows and all
supported Linux platforms
LDAP Directories• Full and delta import and export of
all object classes and all attributes• Real-time provisioning and pass-• Applies provisioning and consistency rules after all changes.
• Performs role resolution immediately after entitlement-relevantchanges
CSV Import/Export• Full import and export of CSV files
Connectivity Package for Microsoft
Active Directory/Exchange• Supports Microsoft Active Directory for Windows Server via theMicrosoft ADSI LDAP provider as
agent and via LDAP interface as
connector• Integrated handling of Microsoft
Exchange mailboxes• Integrated post-processing, e.g.,creation of shares• Full and (native) delta import andexport of all ADS object classes

(e.g., users and groups)• Real-time provisioning and password- synchronization (connector)• Suppor t s ser ver-les s binding, paging on export (for large
amounts of entries), LDAP filters,
multi-value attributes and moveof objects between different trees• Delta support for deleted entries• Ready-to-use management ofhome folders for Microsoft Active
Directory accounts or immediate
mailbox enabling for Microsoft
Exchange via PowerShell technology• Error reporting and tracing• Agent runs on Microsoft Windows
platforms; connector runs on all
supported platforms
Note: Provisioning of local Windows
accounts can be done with the OpenICF connector bundle for Windows
Local Accounts which is available in
the Proxy Connectivity Package.
SharePoint• Supports Microsoft Office SharePoint Server• The solution uses the Windows
Active Directory accounts• Provisioning of groups and groupmemberships in SharePoint• Import of groups and group memberships from SharePoint sites,
used for initial load and target
system validation• Handles SharePoint’s organizationof sites and groups i.e. each SharePoint site has an own set of groups
with a different set of access rights(called roles in SharePoint)• Real-time provisioning• Error reporting and tracing• Runs on Microsoft Windows and all
supported Linux platforms
Windows Password Listener
The Windows Password Listenercatches the user password changes
in a Windows domain, encrypts theinformation, and generates password change events. These trigger
the event manager and the corresponding password change workflows.
The Windows Password Listeneris suitable for Microsoft Windows
servers and is provided as a separate
installation unit.

Connectivity Package for Database systems
ODBC• Supports ODBC (without cursors)
and accesses any ODBC-accessible source/destination• Uses and requires an ODBC driver
installation• Requires DataDirect ODBC 4.0 or
higher on Linux platforms• Full and delta export of selectedrows from a table or a join of tables• Full and delta import to a single
table, (limited import facility forjoined tables). Relationships oftables can be followed (referential
integrity)• Support of stored procedures forimport operations• Error reporting and tracing• Runs on Microsoft Windows and all
supported Linux platforms

supported Linux platforms
Connectivity Package for Physical Security systems
SiPass• Supports SiPass 2.4, 2.5 and 2.6 anduses the SiPass Human Resources
Interface (COM technology)• Full export of card holders andworkgroups from a SiPass system• Delta import of users with creation,
modification and deletion operation including assignment to workgroups• Error reporting and tracing• Runs on Microsoft Windows• Requires the .NET framework to becorrectly installed on the machine
Connectivity Package for SAP
systems
SAP ERP HR and OM

JDBC• Compliant to SAP ECC 6.0 respectively SAP ERP 6.0 and higher• Supports JDBC and accesses any
JDBC- accessible source/destination• Implemented as an ERP application with GUI components (for the
SAPgui)• Uses and requires a JDBC driver
installation• Integrated usage of ERP batch jobs
for ad- hoc and scheduled execution• Full export of selected rows fromtable
• Full and delta import to a single
table. Relationships of tables canbe followed (referential integrity)• Support of stored procedures forimport and export operations• Real-time provisioning and password synchronization• Error reporting and tracing• Runs on Microsoft Windows and all
supported Linux platforms• Full and delta export of data fromSAP HR and SAPoffice components• Full and delta export of data fromSAP OM (Organizational Management) with data either integrated
into HR data or provided separately• Supports Unicode• Supports multiple, criteria-based
selection of data records andrecord fields (Infotypes) as well as
multi-valued attributes

Connectivity Package for Healthcare systems• Client-specific configuration andexecution

medico//s• Configurable advanced data security constraints• Supports medico//s release 16 withappropriate service pack/patch• Error reporting and tracing• Uses the standard DirX Identity
SPML connector• Runs on all NetWeaver (ABAPstack) platforms• Full and delta import of loginIds
and Persons with creation, modification and deletion operation

SAP ECC User Management• Full and delta import of groups,
profiles and roles with creation,
modification and deletion operation• Handling of memb erships
between loginIds and groups, profiles and roles• Compliant to SAP ECC respectively SAP ERP 6.0 and S/4HANA
On-Premises (1709 FPS1) andhigher• Uses and requires an SAP Java
Connector installation (SAP JCo
3.1.4 or higher for Windows/Linuxsystems)• Error reporting and tracing• Is built on DirX Identity‘s SPMLbased connector integration
framework• Runs on Microsoft Windows and all• Supports stand-alone systems and• Real-time provisioning

DirX Identity V9.0 | 15

Central User Administration (CUA)• Full and delta synchronization ofuser, profile (read only) and SAProle (read only) data to the SAP ECC
user management• Support of user hooks to trigger
custom ABAP extensions• Real-time provisioning and password synchronization• Error reporting and tracing• Runs on all platforms that are supported by both SAP JCo and DirX
Identity
SAP NetWeaver User Management• Compliant to SAP NetWeaver andEnterprise Portal 6• Is built on DirX Identity‘s SPMLbased connector integration
framework• Full and delta synchronization ofuser and role information (readonly) to the SAP NetWeaver andEnterprise Portal user management

bute selection• Full and delta import of addresses,
groups and other forms including
creation of mailboxes (optionallywith replicas) and user registrationin Notes• Supports AdminP functionality• Real-time provisioning and password synchronization for the Internet password• Support of multi-valued attributes• Error reporting and tracing• Runs on Microsoft Windows platforms
Connectivity Package for IBM
systems
RACF• Supports z/OS and OS/390 V2R8
using the LDAP interface of IBM’s
LDAP server to access RACF
• Full and delta export of all RACF
object classes• Full and delta import of RACF users
and groups• Real-time password synchronization• Real-time password synchronization• Error reporting and tracing• Support of LDAP filters and multivalue attributes• Runs on Microsoft Windows and all
supported Linux platforms
Connectivity Package for Unified
Communication
Unify Office by RingCentral• Supports Unify Office and RingCentral• Full and delta import and exportof Users per SCIM API with create,
update, delete and search operations• Error reporting and tracing• Runs on Microsoft Windows and all
supported Linux platforms
Connectivity Package for Enterprise Single Sign-On systems
Evidian Enterprise SSO• Supports Evidian Enterprise SSO
9.01b5901 or newer• Based on the standard DirX Identity RESTful SCIM connector• Evidian Enterprise SSO user data
can be stored either in Microsoft
Active Directory or in an LDAP
directory• Supports automated management and mass provisioning ofusers and telephone numbers• Evidian Enterprise SSO is provisioned via the Evidian User AccessWeb Service• Real-time provisioning• Handles Evidian Enterprise SSO
account objects, i.e., application/login name/password tuples• Error reporting and tracing• Runs on Microsoft Windows and all
supported Linux platforms• Add, modify, and delete operations
are supported

Connectivity Package for HCL
systems• Full export of accounts from DirX
Identity to Evidian Enterprise SSO

Notes / Domino• Real-time provisioning for accountobjects• Supports V8.5 and higher using
Notes C++ and C APIs

tory API• Connectivity is based on HTTP protocol• Full import of accounts, groups,
and group memberships• Real-time provisioning of accounts,
groups, and group memberships• Real-time password synchronization• Error reporting and tracing• Runs on Microsoft Windows and all
supported Linux platforms
Citrix ShareFile• Connector uses the Citrix ShareFile
API• Connectivity is based on HTTP protocol• Full import of accounts, groups,
and group memberships• Real-time provisioning of accounts,
groups, and group memberships• Error reporting and tracing• Runs on Microsoft Windows and all
supported Linux platforms
Microsoft Office 365• Connector uses the Microsoft
Graph API version v1.0 on URL
https://graph.windows.net• Connectivity is based on HTTP protocol.
• Full import of users, groups, roles,
service plans with assignments• Real-time provisioning of users,
groups, roles, with assignments• Assignment of users to plans – thisenables users to use the licensed
Office 365 features like Office applications, Exchange, Teams, etc.
• Real-time password synchronization• Error reporting and tracing• Runs on Microsoft Windows and all
supported Linux platforms
Salesforce• Connector uses the Force.com
REST API• Connectivity is based on HTTP protocol• Full import of accounts, contacts,
users, permissions sets and profiles• Remote Access to HCL Domino
Directory Server for Notes Clients• Runs on Microsoft Windows platforms• Real-time provisioning of accounts,
contacts and users including
assigned ProfileId and permission
sets• Requires co-located HCL Notes
Client on the same system

Connectivity Package for Cloudsystems• Real-time password synchronization• Full and delta export of addresses,
groups and other forms with specification of search filters and attri-

16 | DirX Identity V9.0

• Error reporting and tracing

Google Apps
• Connector uses the Google Direc-• Error reporting and tracing• Runs on Microsoft Windows and all
supported Linux platforms

Proxy Connectivity Package
Remote Upload Connector• Supports scenarios where DirX
Identity is deployed as part of acloud service infrastructure suchas IDMaaS (Identity Management
as a Service) and Active Directoryor any other LDAP directory isavailable at a remote customer site
to upload identities• Connectivity is based on HTTP protocol• Connector uses native LDAP toaccess on- site Active Directoryof Microsoft Windows Server 2016
and Windows Server 2019 or any
other LDAP directory• Requires Java Runtime Environment 11 or newer and Apache
Tomcat 9 or newer at the service
site• Requires Java Runtime Environment 8 or newer at the remotecustomer site
• Full import of accounts (identities)• Error reporting and tracing• Runs on Microsoft Windows and all
supported Linux platforms
OpenICF Proxy Connector

groups, and group memberships• Error reporting and tracing• The connector bundle is deployed
in a Java- based OpenICF connector server.
• Runs on all Microsoft Windows andLinux platforms that are supportedby the OpenICF connector server.
OpenICF Connector Bundle fürWindows Local Accounts• Real-time provisioning of accounts,
groups and group membershipsthat are in a local SAM database of
a Microsoft Windows computer• Real-time password synchronization• Full import of accounts, groups,
and group memberships• Works with Microsoft Windows
Server 2016, Windows Server 2019,and Windows 10• Error reporting and tracing• The connector bundle is deployed
in a .NET- based OpenICF connector server running on any Windows
server.
• Runs on all Microsoft Windows
platforms that are supported by
the OpenICF connector server.

• The Java-based OpenICF proxyconnector runs inside the Identity Java Connector Integration
Framework.
• It communicates with an OpenICF
connector server (Java- or .NETbased) using an internal OpenICF
protocol.
• The connector can dynamicallyobtain information about required
configuration parameters anddata schema from that connector
server.
• The connector converts provisioning operations and data between
DirX Identity and OpenICF formats.
• The connector is required to integrate any of the OpenICF connector bundles with DirX Identity.
Note: In addition to provisioning withthe delivered OpenICF-based workflows, provisioning of other target
systems that are supported by OpenICF connector bundles is also supported. This requires customizationof the delivered workflows.
OpenICF Connector Bundle for
Unix• Real-time provisioning of Unix
accounts, groups, and groupmemberships• Real-time password synchronization• Full import of Unix accounts,
DirX Identity V9.0 | 17

Table 1 - DirX Identity Business Suite, Pro Suite, Password Management Option Overview

Professional
Suite

Business
Suite

Password
Management
OptionWeb-based User Self-Service via Web Center

Yes

Yes

-

- Managing own data

Yes

Yes

-

- Managing own passwords

Yes

1)

-

- Managing delegations

Yes

-

-

- Requesting roles

Yes

3)

-

Delegated Administration via Web Center

Yes-

Password Management

Yes

Yes

Yes

- Password Policies

Yes

-

Yes

- Password change by end-user via Web Center

Yes

-

Yes

- Password change by end-user for a subset of their accounts

-

-

Yes

- Display the password change status

-

-

Yes

- Challenge/response procedures to reset forgotten passwords (self-service)

Yes

-

Yes

- Challenge/response procedures to reset forgotten passwords (via administrators or service desk)

-

-

Yes

- Administrative password reset

Yes

-

Yes

2)

2)

2)

- Real-time password synchronization

Yes

Yes

Yes

- Password Reset Client for Windows

-

-

Yes

User Management

Yes

Yes

-

- Managing users

Yes

Yes

-

- Managing personas

Yes

-

-

- Managing user facets

Yes

-

-

- Managing functional users

Yes

-

-

Role Management

Yes

Yes

-

- Managing accounts

Yes

Yes

-

- Managing groups

Yes

Yes

-

- Managing permissions and permission parameters

Yes

-

-

- Managing roles and role parameters

Yes

-

-

- Segregation of duties

Yes

-

-

Business Object Management

Yes

Yes

-

Request workflows, approval and re-approval

Yes

-

-

Risk Management

Yes

-

-

Access Certification

Yes

-

-

Support for outsourced environments

Yes

Yes

-

- Privileged account management

Yes

Yes

-

- Workflows for clustered target systems

Yes

Yes

-

- Windows Password Listener1)

In conjunction with Windows Password Listener over Microsoft Windows native tools/interfaces, not via Web Center

2)

Requires DirX Identity Microsoft Connectivity Package

3)Groups instead

18 | DirX Identity V9.0

Table 1 - DirX Identity Business Suite, Pro Suite, Password Management Option Overview

Professional
Suite

Business
Suite

Password
Management
OptionPolicy Management

Yes

Yes

-

- Access policies

Yes

Yes

-

- Audit policies

Yes

-

-

- Provisioning policies for groups

Yes

Yes

-

- Provisioning policies for roles and permissions

Yes

-

-

- Validation policies

Yes

Yes

-

- Consistency policies

Yes

Yes

-

Provisioning

Yes

Yes

-

- Policy-/Rule-based assignment of groups to users

Yes

Yes

-

- Policy-/Rule-based assignment of permissions and roles to users

Yes

-

-

- Manual assignment of groups to users

Yes

Yes

-

- Manual assignment of permissions and roles to users

Yes

-

-

- Inheritance of groups from business objects to users

Yes

Yes

-

- Inheritance of permissions and roles from business objects to users

Yes

-

-

- Real-time provisioning of accounts and groups to target systems

Yes

Yes

-

Service Management Support

Yes

Yes

-

Metadirectory

Yes

Yes

-

- Default Applications

Yes

Yes

-

- Bi-directional synchronization of structured files (XML, LDIF, DSML, CSV)

Yes

Yes

-

Auditing Services

Yes

Yes

-

- Reports on users, accounts, groups

Yes

Yes

-

- Reports on target systems, delegations, access policies, rules

Yes

Yes

-

- Reports on roles and permissions

Yes

-

-

- Audit trail of administrative changes in DirX Identity

Yes

-

-

- Audit trail of password changes and password lookup

Yes

-

-

- Audit trail of Web Center login/logout

Yes

-

-

- Validation and reconciliation of target systems

Yes

Yes

-

Domain Management

Yes

Yes

-

Default Connectivity

Yes

Yes

-

Identity Manager

Yes

Yes

-

Business User Interface

Yes

Yes

Web Center

Yes

Yes

4)

Java- and C++-based Identity Server and Web Admin

Yes

Yes

-

Web Services, incl. REST Services

Yes

Yes

-

Identity Integration Framework

Yes

Yes

-

4)

Password Management functionality only

DirX Identity V9.0 | 19

System Requirements
Hardware• Intel server platform for Microsoft
Windows Server 2019 and 2022

For DirX Identity Web Center/
Web Admin/Server Admin• Microsoft Internet Explorer 11• Red Hat Enterprise Linux• Mozilla Firefox 78 or newer• SUSE Linux Enterprise Server• Google Chrome 96 or newer(Request Signing via Java Applet
is not supported)

Memory Requirements:
Main memory:

minimum 8 GB

Disk Space:		minimum 4 GB plus
disk space for data

Software
DirX Identity is supported on the following platforms with latest patches/
service packs for the selected platform:• Microsoft Windows Server 2016
LTSC (x86-64 Intel architecture)• Microsoft Windows Server 2019(x86-64 Intel architecture)• Red Hat Enterprise Linux 7 (x8664)• Red Hat Enterprise Linux 8 (x8664)• SUSE Linux Enterprise Server 12(x86-64)• SUSE Linux Enterprise Server 15(x86-64)• Microsoft Windows 10 (x86-64),
client components Identity Manager, client signature only
• Java SE 11 (LTS) / OpenJDK• Apache Tomcat 10
Virtual Machine Support:• VMWare ESXi, in combination
with guest operating systems
listed above that are supported by
VMWare ESXi
Note: C++-based components of DirX
Identity run as 32-bit application on
64-bit platforms. Java-based components run as 64-bit application on
64-bit platforms.
For DirX Identity Store• DirX Directory V8.10 or newer

Documentation
Manuals and Use Case documents
are provided in English.
Manuals• Installation Guide• Migration Guide• Microsoft Edge 96 or newer(Request Signing via Java Applet
is not supported)• Introduction

For DirX Identity Business User
Interface• Connectivity Administration Guide• Mozilla Firefox 78 or newer• Application Development Guide• Google Chrome 96 or newer• Customization Guide• Microsoft Edge 96 or newer• Integration Framework

For DirX Identity Manager• For smart card support: Atos
CardOS API V5.4 in combination
with CardOS smart cards that aresupported by Atos CardOS API
V5.4.
For OpenICF Connector Bundles• For Unix: An OpenICF Java Connector Server installation, version
1.1.1.0 or newer• For Windows Local Accounts: An
OpenICF.NET Connector Server
installation, version1.4.0.0 or newer
For Nagios support• Nagios Core Version 4.0.8• JNRPE Server Version 2.0.5• JNRPE Plugins Version 2.0.3

User interface• Tutorial• Provisioning Administration Guide• User Interface Guide• Web Center Reference• Web Center Customization Guide• Meta Controller Reference• Connectivity Reference• Troubleshooting Guide• Business User Interface User Guide• Business User Interface Configuration Guide
Use Case documents• Configuring the Maintenance
Workflows for User Facets• Creating a Custom Target System
Type• Enabling Smart Card Login for
Identity Manager• High Availability• Java Programming in DirX Identity• Monitoring DirX Identity Servers
with Nagios• Admin Access: English• Password Management• Business Access (Web Center andBusiness User Interface): English/
German/customizable• Service Management• Real-time Synchronization within
an Identity Domain• Certification Campaigns• Configuring User-specific Proposal
Lists for Role Parameters• Using Domains• Using Segregation of Duties• Web Center File Upload

20 | DirX Identity V9.0

DirX Product Suite
The DirX product suite provides the basis for fully integrated identityand access management; it includes the following products, which canbe ordered separately.

DirX Identity
DirX Identity provides a comprehensive, process-driven,customizable, cloud-enabled, scalable, and highly available identity management solution for businesses andorganizations. It provides overarching, risk-based identity and access governance functionality seamlessly
integrated with automated provisioning. Functionality includes lifecycle management for users and roles,
cross-platform and rule-based real-time provisioning,
web-based self-service functions for users, delegatedadministration, request workflows, access certification,
password management, metadirectory as well as auditing and reporting functionality.

DirX Directory
DirX Directory provides a standards-compliant, high-performance, highly available, highly reliable, highly scalable,
and secure LDAP and X.500 Directory Server and LDAP
Proxy with very high linear scalability. DirX Directory canserve as an identity store for employees, customers, partners, subscribers, and other IoT entities. It can also serve asa provisioning, access management and metadirectory
repository, to provide a single point of access to the information within disparate and heterogeneous directories
available in an enterprise network or cloud environment
for user management and provisioning.

DirX Access
DirX Access is a comprehensive, cloud-ready, scalable,
and highly available access management solution providing policy- and risk-based authentication, authorization based on XACML and federation for Web applications
and services. DirX Access delivers single sign-on, versatile authentication including FIDO, identity federation
based on SAML, OAuth and OpenID Connect, just-intime provisioning, entitlement management and policy
enforcement for applications and services in the cloud or
on-premises.

DirX Audit
DirX Audit provides auditors, security compliance officers and audit administrators with analytical insight andtransparency for identity and access. Based on historical identity data and recorded events from the identityand access management processes, DirX Audit allows
answering the “what, when, where, who and why” questions of user access and entitlements. DirX Audit features
historical views and reports on identity data, a graphicaldashboard with drill-down into individual events, an analysis view for filtering, evaluating, correlating, and reviewing of identity-related events and job management forreport generation. With its analytical features, DirX Audit
helps enterprises and organizations to ensure sustainable
compliance and provide business intelligence for the riskbased identity and access management processes.

Eviden is a registered trademark © Copyright 2023, Eviden SAS – All rights reserved.

DS-230613-GW-DirX_Identity_V9.0_Datasheet_EN