How to Create Custom Reports in Identity Manager R12 · PDF fileimr_actiontype . Action type nvarchar(65) (Allocation\Reallocation\Dealloca tion) imr_actionindex . int . Action item

$Page 1: How to Create Custom Reports in Identity Manager R12 · PDF fileimr_actiontype . Action type nvarchar(65) (Allocation\Reallocation\Dealloca tion) imr_actionindex . int . Action item$
How to Create Custom Reports in Identity Manager R12

Contents

Chapter 1: Introduction

1.1 Report Architecture

1.2 Report Snapshot Database

1.3 Default Reports

Chapter 2: How to Create a Custom Report

Step 1: Create a Custom Report Template in Crystal Report Developer XI

Step 2: Create a Parameter XML file for the Custom Report

Step 3: Uploading the Custom Report Template and Parameter XML File

Step 4: Customize the Snapshot Parameter XML File (Optional)

Step 5: Create a Snapshot Definition and Capture a Snapshot for Custom Report

Step 6: Create a Admin Task for the Report

Step 7: Setting up Custom Report Task Access

Step 8: Scheduling the Custom Report

Step 9: Viewing the Custom Report

Appendix A: Parameter XML File XSD

Appendix B: Writing Java Custom Code for Report Parameters

Chapter 1: Introduction

1.1 Report Architecture In Identity Manager, the reporting setup requires the three major components in the following diagram:

For detailed installation instructions, please refer to CA Identity Manager Installation Guide. 1.2 Report Snapshot Database A snapshot reflects the state of objects in Identity Manager at a given time, and extracts this data, which can be used in one or more reports. Snapshots are stored in the Snapshot Database. You must create a snapshot definition before you can export data to the Reporting Database, which we will talk about later.

This is what the snapshot database may look like in a MS-SQL database system:

Below are the table details in the database. Table Name Description imrptsnapshots12 This table contains all the IM reports generated. Column Name Column Type Description imr_rptname nvarchar(255) Report name imr_snapshotname nvarchar(255) Name of the snapshot definition

specified for the report imr_envname nvarchar(255) Environment name in which the

snapshot was taken IMR_RPT_TASK_TAG_NAME nvarchar(255) Report task tag name Table Name Description Imreport6 This table contains all the snapshots taken. Column Name Column Type Description imr_reportid int Snapshot (report instance) id imr_reportname nvarchar(255) Snapshot (report instance)

name imr_reporttime datetime The date and time the snapshot

is captured. imr_reportuser nvarchar(628) User ID of the user who initiates

the snapshot capturing. imr_envoid nvarchar(64) envoid in which the snapshot is

taken

imr_envname nvarchar(255) Environment name in which the snapshot is taken

imr_keepsnapshot int Number of snapshots to archive imr_snapshotsource nvarchar(255) The initiator of the imrexport

operation (In our case, it is the IdentityManager product)

imr_snapshotstatus nvarchar(64) Snapshot capture status Table Name Description Imraccountattrs6 This table contains all the attributes of the accounts

associated with each snapshot. Column Name Column Type Description imr_reportid int Snapshot (report instance) id imr_accountdn nvarchar(628) Account DN imr_accountattr nvarchar(256) Account attribute name imr_accountattrvalue nvarchar(628) Account attribute value Table Name Description Imrgroup6 This table contains all the groups associated with

each snapshot. Column Name Column Type Description imr_reportid int Snapshot (report instance) id imr_groupdn nvarchar(628) Group DN imr_name nvarchar(255) Group name imr_description nvarchar(255) Group description imr_parentorgdn nvarchar(628) Group's parent organization DN

(which organization the group belongs to)

imr_selfsubscribing nvarchar(64) Does the group allow self-subscribing (Boolean values - 0/1)

imr_dynamicgroupmembership nvarchar(255) Dynamic group membership rules

Table Name Description Imrgroupadmin6 This table contains the administrator(s)’ DN(s) of

the groups associated with each snapshot. Column Name Column Type Description imr_reportid int Snapshot (report instance) id imr_groupdn nvarchar(628) Group DN imr_admindn nvarchar(628) Group’s administrator’s DN Table Name Description Imrgroupattr6 This table contains all the attributes of the groups

associated with each snapshot. Column Name Column Type Description imr_reportid int Snapshot (report instance) id

imr_groupdn nvarchar(628) Group DN imr_attrname nvarchar(255) Group attribute name imr_attrvalue nvarchar(628) Group attribute value Table Name Description Imrgroupmember6 This table contains the member(s)’ DN(s) of the

groups associated with each snapshot. Column Name Column Type Description imr_reportid int Snapshot (report instance) id imr_groupdn nvarchar(628) Group DN imr_memberdn nvarchar(628) Group’s Member’s DN Table Name Description imridentitypolicy6 This table contains all the identity policies associated

with each snapshot. Column Name Column Type Description imr_reportid int Snapshot (report instance) id imr_policyid nvarchar(64) Identity policy ID imr_policyname nvarchar(255) Identity policy name imr_policyindex int Identity policy index in identity

policy set imr_apptype nvarchar(64) apply always or once imr_compliance nvarchar(64) Standard or compliance imr_ruleevaluationtype nvarchar(64) Rule evaluation type (Policy

Store/Directory/Internal/Java Plugin)

imr_rule nvarchar(3000) XML representation of the rule imr_policysetid nvarchar(64) Identity policy set ID Table Name Description imridentitypolicyactions6 This table contains the action items defined in each of

the identity policies associated with each snapshot. Column Name Column Type Description imr_reportid int Snapshot (report instance) id imr_policyid nvarchar(64) Identity policy ID imr_actiontype nvarchar(65) Action type

(Allocation\Reallocation\Deallocation)

imr_actionindex int Action item index in identity policy

imr_actionevaluationtype nvarchar(65) Rule evaluation type (Policy Store/Directory/Internal/Java Plugin)

imr_action nvarchar(3000) XML representation of the action Table Name Description imridentitypolicyset6 This table contains the identity policy sets associated

with each snapshot.

Column Name Column Type Description imr_reportid int Snapshot (report instance) id imr_policysetid nvarchar(64) Identity policy set ID imr_policysetname nvarchar(255) Identity policy set name imr_category nvarchar(255) Identity policy set category Table Name Description imridentitypolicyusersync6 This table contains the status of the user

synchronization tasks issued for the identity policies associated with each snapshot.

Column Name Column Type Description imr_reportid int Snapshot (report instance) id imr_policysetname nvarchar(255) Identity policy set name imr_policyid nvarchar(64) Identity policy ID imr_userdn nvarchar(255) User DN imr_syncstatus nvarchar(255) Identity Policy user

synchronization status (Allocation\Reallocation\Deallocation)

Table Name Description Imrorg6 This table contains the organizations associated with

each snapshot. Column Name Column Type Description imr_reportid int Snapshot (report instance) id imr_orgdn nvarchar(628) Organization DN imr_orgname nvarchar(255) Organization name imr_parentorgdn nvarchar(628) Organization parent DN Table Name Description imrorgattr6 This table contains all the attributes of the

organizations associated with each snapshot. Column Name Column Type Description imr_reportid int Snapshot (report instance) id imr_orgdn nvarchar(628) Organization DN imr_attrname nvarchar(255) Organization attribute name imr_attrvalue nvarchar(628) Organization attribute value Table Name Description Imrrole6 This table contains all the roles associated with each

snapshot. Column Name Column Type Description imr_reportid int Snapshot (report instance) id imr_oid nvarchar(64) Role ID imr_name nvarchar(255) Role imr_description nvarchar(255) Role description imr_type nvarchar(64) Role type

(admin\access\provisioning) imr_isenabled int Is role enabled? imr_isassignable int Is role assignable? imr_isadminassignable int Is role admin assignable? Table Name Description Imrroleadmin6 This table contains the administrator(s)’ DN(s) of the

roles associated with each snapshot. Column Name Column Type Description imr_reportid int Snapshot (report instance) id imr_roleoid nvarchar(64) Role ID imr_userdn nvarchar(628) Role’s administrator’s DN Table Name Description Imrrolemember6 This table contains the member(s)’ DN(s) of the roles

associated with each snapshot. Column Name Column Type Description imr_reportid int Snapshot (report instance) id Imr_roleoid nvarchar(64) Role ID imr_userdn nvarchar(628) Role’s owner’s DN Table Name Description Imrroleowner6 This table contains the owner(s)’ DN(s) of the groups

associated with each snapshot. Column Name Column Type Description imr_reportid int Snapshot (report instance) id Imr_roleoid nvarchar(64) Role ID imr_userdn nvarchar(628) Role’s owner’s DN Table Name Description imrrolerule6 This table contains the rules of the roles associated

with each snapshot. Column Name Column Type Description imr_reportid int Snapshot (report instance) id imr_roleoid nvarchar(64) Role ID imr_ruleorder int Rule order imr_ruletype nvarchar(64) Rule type imr_constraintvalue nvarchar(3800) XML representation of rule

constraint Table Name Description imrrolescoperule6 This table contains the scoping rules of the roles

associated with each snapshot. Column Name Column Type Description imr_reportid int Snapshot (report instance) id imr_roleoid nvarchar(64) Role ID

imr_ruleorder int Rule order imr_scopeobjecttype nvarchar(64) Rule's scope object type imr_constraintvalue nvarchar(3800) XML representation of rule

constraint Table Name Description imrroletask6 This table contains the tasks defined for the roles

associated with each snapshot. Column Name Column Type Description imr_reportid int Snapshot (report instance) id Imr_roleoid nvarchar(64) Role ID imr_taskoid nvarchar(64) Task ID Table Name Description imrtask6 This table contains all the tasks associated with each

snapshot. Column Name Column Type Description imr_reportid int Snapshot (report instance) id imr_oid nvarchar(64) Task ID imr_name nvarchar(255) Task name imr_description nvarchar(255) Task description imr_type nvarchar(64) Task type imr_category nvarchar(255) Task category imr_workflowprocess nvarchar(255) Task workflow process imr_application nvarchar(255) Application imr_externalurl nvarchar(255) External URL imr_tasktag nvarchar(255) Task tag imr_reserved1 nvarchar(255) Reserved1 imr_reserved2 nvarchar(255) Reserved2 imr_reserved3 nvarchar(255) Reserved3 imr_reserved4 nvarchar(255) Reserved4 imr_reserved5 nvarchar(255) Reserved5 imr_reserved6 nvarchar(255) Reserved6 imr_reserved7 nvarchar(255) Reserved7 imr_reserved8 nvarchar(255) Reserved8 imr_reserved9 nvarchar(255) Reserved9 imr_reserved10 nvarchar(255) Reserved10 Table Name Description Imruser6 This table contains all the users associated with each

snapshot. Column Name Column Type Description imr_reportid int Snapshot (report instance) id imr_userdn nvarchar(628) User DN imr_isenabled int Is user enabled? imr_userid nvarchar(255) User ID imr_fullname nvarchar(255) User’s full name imr_lastname nvarchar(255) User’s last name imr_firstname nvarchar(255) User’s first name

imr_parentorgdn nvarchar(628) User’s organization DN imr_email nvarchar(255) User’s email Table Name Description imruseraccounts6 This table contains all the user accounts associated

with each snapshot. Column Name Column Type Description imr_reportid int Snapshot (report instance) id imr_userdn nvarchar(628) User DN imr_username nvarchar(64) User name imr_accountdn nvarchar(628) Account DN imr_accountname nvarchar(64) Account name imr_endpoint nvarchar(64) Endpoint name imr_accountcontainer nvarchar(64) Account container DN imr_accounttype nvarchar(64) Account type imr_accountdomain nvarchar(64) Account domain imr_accountreason nvarchar(256) Reason for creating the account

(not in use) imr_accountcreator nvarchar(256) Account’s creator imr_accountcreationdate datetime Date and time when account is

created imr_accountlastmodified datetime Date and time when account is

last modified imr_accountapprover nvarchar(256) Approver assigned to the

account imr_accountpolicy nvarchar(256) Account policy imr_accountsyncwithroles int Is the account synchronized

with roles? imr_isenabled int Is the account enabled? Table Name Description imruserattr6 This table contains all the attributes of the users

associated with each snapshot. Column Name Column Type Description imr_reportid int Snapshot (report instance) id imr_userdn nvarchar(628) User DN imr_attrname nvarchar(255) User attribute name imr_attrvalue nvarchar(628) User attribute value 1.3 Default Reports Identity Manager provides 16 default out-of-box reports. To configure a default report to run, you need to create a snapshot definition, capture a snapshot, associate the snapshot to the report task, run the report task and then you can view the report from the IM report GUI page. For detailed instructions, please refer to the Reporting chapter of the Identity Manager Administration Guide. The following are the default content of the out-of-box reports’.

Report Description

Role Members Displays the roles in the report database and lists the members of those roles.

Roles Displays the following information for each role in the report database:

Tasks associated with the role

Member policies and role members

Administrator policies and role administrators

Owner policies and role owners

Tasks Roles Displays the tasks in the report database and the roles with which they are associated.

User Roles Displays the users in the report database and lists each user’s roles.

Non-Standard Accounts Trend Displays non-standard accounts trends for orphan accounts, system accounts, and exception accounts

Non-Standard Accounts Displays all orphan, system, and exception accounts

Orphan Accounts Displays all endpoint accounts with no global user in the Provisioning Server

Policies Displays all identity policies

User Profile Displays the following information for users:

Name

User ID

Groups where the user is a member or administrator

Roles where the user is a member, administrator, or owner

Endpoint Accounts Displays accounts per endpoint (you can choose which endpoint to view)

Report Description

Role Administrators Displays roles and their administrators

Role Owners Displays roles and their owners

Snapshots Displays all exported snapshots

User Account Displays a list of users and their accounts

User Entitlements Displays user’s roles, groups and accounts

User Policy Sync Status Displays the user’s status per policy (which policies should be allocated, deallocated or reallocated)

You can customize the default reports to your needs or create your own custom reports. We will talk about that in the following chapters.

Chapter Two Identity Manager allows you to create and customize reports to suit your business needs. We will create a sample report called ‘Group Membership’ to show you the steps you may take in order to create a custom report. The ‘Group Membership’ report will display all the groups in your IM environment and the members that belong to each group.

Step 1: Create a Custom Report Template in Crystal Report Developer XI

In order to use custom reports in Identity Manager, you need to create a report template file (RPT file) or customize the default out-of-box report templates in Crystal Report Developer XI.

Here is an example of how to create a report template.

1) Launch Crystal Report Developer XI from the Windows startup menu.

2) Click ‘File’, ‘New’, ‘Standard Report’. We are going to create a standard report using the Standard Report Creation Wizard:

3) First let’s create a database connection to the IM R12 Report Snapshot Database:

4) Make sure to choose the JDBC connection type. You may find the JDBC connection string from the report configuration screen in the IM Management GUI or manually type in your JDBC String as jdbc:sqlserver://machiner12ga:1433;databaseName=r12IMDB

5) Type in the user name and password for the JDBC connection:

6) The JDBC connection is established. Expand the tree and you will see all the IM R12 report tables showing up:

7) Select the tables ‘imreport6’, ‘imgroup6’, ‘imgroupmember6’ and ‘imuser6’ and use the right arrow to move them to the ‘Selected Tables’ box. Click ‘Next’.

8) You will be taken to the Database Links page. Manually create a relationship link between table ‘imgroup6’’s ‘imr_groupdn’ column and table ‘imrgroupmember6’’s ‘imr_groupdn’ column, and another between table ‘imruser6’’s ‘imr_userdn’ column and ‘imrgroupmember6’’s ‘imr_memberdn’ column:

9) In the next step, you will select the columns you want to display in the report:

10) In the ‘Grouping’ page, select the group name ‘imrgroup6.imr_name’ as the group by index:

11) Click ‘Next’:

12) Click ‘next’ as we are not going to define any sub-selections:

13) Select a themed template if you like for your custom report. Click ‘Finish’:

14) A preview of the report is displayed:

15) Manually do some modification to the display to make it look nicer by dragging-and-dropping certain fields to where we desire. Remove the redundant fields. The screen shot is the final look. The report header section will display the snapshot name and snapshot time, the page header will display the group name and DN and the table will display the group’s members and their DNs:

16) This report data content will be defined by two parameters: snapshot name and snapshot time. Snapshot name will be defined when we create the report task (see Step 6) and passed into the report. While for snapshot time, we would like to give the users the option to choose to generate report based upon the timestamp a certain snapshot was taken. So we are going to manually create a snapshot time parameter to pass that into report in runtime.

Right click on the ‘Parameter Fields’ menu and select ‘New’. We are going to create a parameter to pass in the snapshot time value for a report.

17) Name the new parameter as ‘snapshotTime’, Choose ‘Dynamic’ as ‘the List of Values’. The parameter will match the ‘imr_reporttime’ column. Click ‘OK’.

18) Now we need to add the parameter to the report template. Go to ‘Report’, choose ‘Select Expert’.

19) Choose the report field, ‘imreport6.imr_reporttime’. Click OK.

20) As shown in the screen shot below, choose ‘is equal to’ and ‘{?snapshotTime}’. Click OK:

21) As the last step, save the report we just created as ‘groupmembership1.rpt’:

For more information on how to create a report in Crystal Reports, refer to your Crystal Reports documentation.

Step 2 Report Parameter XML File Why Do We Need the Report Parameter XML File The Report Parameter XML File is used to describe the GUI page that we supply parameters to the report templates in order to generate reports. For example, the parameter page of report ‘Role Members’.

The report developer has to define the parameters in the well-known XML format and the framework will provide the UI based on the supported parameter type. When the page is submitted, the IM reporting framework will collect the parameters for each report, and using Business objects’ API, it will pass the values to the report template to generate the report. Naming the Parameter XML File - The parameter file name should be the same as report file name with the extension .xml. - When it is added in the Business Objects server, the parameter file name and the reporting file name should match. For example, if you decide to name and upload a report template as ‘groupmembership1.rpt’, then you need to provide the Parameter XML file with the name ‘groupmembership1.xml’. Note: The parameter XML’s xsd is in Appendix A.

The Structure of the Parameter XML File Below is the sample XML file ‘groupmembership1.rpt’ we created for our sample report template ‘groupmembership1.rpt’: <?xml version="1.0" encoding="UTF-8"?> <tns:product name="groupmembership1.rpt" xmlns:tns="http://www.example.org/Parameters" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.example.org/Parameters ../../../../reporting/src/com/ca/ims/reporting/utils/Parameters.xsd "> <tns:connection_info id="rptParamConn" conn_type="rptParamConn" classification="conn_mo_type" /> <tns:screen id="1"> <tns:parameters> <tns:param id="snapshotTime" displaytext="Snapshot Time" name="snapshotTime" required="true" type="sqlstr" conn_id="rptParamConn" taskTagName="true" sql="select imreport6.imr_reporttime from imreport6 where imr_snapshotstatus='Completed' and imr_reportname in (select imr_snapshotname from imrptsnapshots12 where imr_rptname = 'groupmembership1' and imr_envname = '#envName#' AND IMR_RPT_TASK_TAG_NAME='#taskTagName#') and imreport6.imr_envname = '#envName#' order by imreport6.imr_reporttime" /> </tns:parameters> </tns:screen> </tns:product>

In the XML file, we defined a parameter ‘snapshotTime’ as a ‘sqlstr’ type of drop-down box (as the ‘snapshotTime’ parameter we created in the previous step). The timestamp value of this parameter will be used to define which snapshot will be used to generate the report accordingly based on the timestamp. This is what the GUI page will look like.

The XML file could consist of the following elements. <product> Main element It is not used right now.

<screen> This element defines the UI elements of

the screen. The screen id is

alphanumeric. Screen id is unique. Each screen definition will display the parameters in a separate screen. The user can navigate between screen with “Prev” and “Next” buttons.

<parameters> The collection of parameters. Details see below in section 4.3.

<param> The individual parameter element that will collect the information for each report parameter and pass it to the report. The following explains the individual attributes used in the <param>.

<id> This is the most important attribute as it identifies which parameter in the report is associated with. Naturally, it will hold the same name that you have given in the crystal report’s parameter name.

<name> This attribute is not used right now. Please fill up the “id” value to the “name” too.

<displaytext> The user- friendly text to be displayed in the screen for the given parameter.

type> The type of the parameter. Based on the type, the UI control will change. Also, some additional attributes need to be provided based on the type. Each supported type and additional attributes for them is explained below

<row> The number of rows visible in a list box control. If the row attribute is not present, the default value will be 5.

<default> The default value to be displayed when the control is displayed for the user input. For ex. you can display “Hello World” in the text box before the user is typing his/her input. This attribute is used in “String” (Refer section 2.3.1), list box (Refer section 2.3.3) and drop-down box (Refer section 2.3.4).

Types of Parameters: String (Text box) The string parameter type is used for entering the data by the user directly. The XML entry for the text can have the following format: <param id="param1" displaytext="First Name" name="User" type="string"/> The UI will look like this:

To display default value “username” in the text box, add the attribute default=”username”. <param id="param1" displaytext="First Name" name="User" type="string" default=”username”/>

Date and Time The date and time control can be represented in the XML as: <param id="dateVal" displaytext="Date" name="dateVal" type="date_str"/> <param id="timeVal" displaytext="Time" name="timeVal" type="time_str"/> <param id="datetimeVal" displaytext="Date & Time" name="datetimeVal" type="date_time_str"/>

The UI will be:

Drop down The drop down control lets the user to select one value from the list of values. The drop down control can be represented in XML as: <param id="lastname1" displaytext="Name" name="lastname" type="dropdown" default="key1%1FMy Value1%1Ekey2%1FMy Value2" selected_value="My Value2"/> The “selected_value” attribute will display the value that is in the list. The UI will be:

Note: In the drop down, if you enter the attribute multiselect="true", it will be changed to list box. Note: The list box values can be loaded using the following options: a) Using SQL (Refer section 2.4) b) Using Java bean (Refer section 2.5) and c) Using a list of string literals separated by delimeters (Refer section 2.6). List box control The list box provides a set of values and keys (hidden) associated to those values to identify which value(s) was selected by the user. The values in the list box can be selected as a single value (with “multiselect” attribute set to “false”) or multiple values (with “multiselect” attribute set to “true”). A typical list box control can be represented in XML as: <param id="lstlastname1" displaytext="Name" name="lastname" type="listbox" rows="10" default="key1%1FSuper%1Ekey2%1Fsql2kSuser01%1E key1F%Super"/>

The UI for the above XML will be:

Note: The list box values can be loaded using the following options: a) Using SQL (Refer section 2.4) b) Using Java bean (Refer section 2.5) and c) Using a list of string literals separated by delimeters (Refer section 2.6). Radio box control The radio box control lets the user to choose a value from a group. The XML can be entered as: <param id="optionslist" displaytext="Option 1" name="Option1" type="radiobox" value="option1"/> <param id="optionslist" displaytext="Option 2" name="Option2" type="radiobox" value="option2"/> <param id="optionslist" displaytext="Option 3" name="Option3" type="radiobox" value="option3"/>

The UI will be:

Check box control The check box control lets the user to select or unselect a value. The XML can be represented as: <param id="enabled" displaytext="Enabled" name="firstname" type="checkbox"/>

The UI will be:

Obtain Report parameter values Dynamically The parameters input values should be dynamically loaded so the user can utilize it to its full potential. The list box and drop down box values should be based on the requirements for the reports parameters. Using SQL The IAM reporting lets the user to define the SQL queries as part of the list box or drop down box XML definitions. IAM reporting will execute the query based on the

reporting parameter connection definition (Refer IAM administration guide on how to setup he reporting connections). To use SQL in the drop-down or list box parameter, provide a valid SQL in the attribute “sql”. For ex. to load a list of users with the last name that starts with “S”, <param id="lstlastname2" displaytext="Name" name="lastnamelst" type="sqlstr" multiselect="true" sql="select lastname, lastname from tblusers where firstname like 'S%/>

This will load all the users’ last name that starts with “S”. However, if you noted above, the condition is still static with the last name that starts with “S”. This is not flexible enough for the user to load the value based on the parameter value entered in one of the previous screen that was used in the same report parameter group. In order to use the value that had been entered in the previous screen, the SQL can be rendered as “##<parameter id##”. For ex. if we had a parameter with the id = “User” which was of type “String” <param id="User" displaytext="First Name" name="firstname" type="string"/> and if you want to use that input value in SQL, the SQL can be <param id="lstlastname2" displaytext="Name" name="lastnamelst" type="sqlstr" multiselect="true" sql="select lastname, lastname from tblusers where firstname like '##User##’/> The IAM reporting will replace ##User## with the value entered for the parameter with the id=User. Note: The parameter value to be substituted cannot be in the same screen as the SQL parameter. For ex. if the “lstlastname2” is in screen 3, the “User” should be in one of the previous screens, not on the same. Using Java bean Some times, using SQL will not be adequate as the business logic for providing the parameter input value need to be computed using non-SQL ways. In this case, the user can use java bean to compute those values and provide the list of <key,value> pair to the IAM reporting framework. The java bean should be in the classpath of the IAM application. To represent java bean in the parameter definition: <param id="lastname2" displaytext="Name using Javabean" name="lastname" type="dropdown" class="com.ca.ims.reporting.unittests.TestDataCollector"/>

The TestDataCollector can retrieve the values in any way it wants to and send the data in the list with key and value are separated by %1F. See Appendix B for more information on implementing java bean. Using String literals The simplest way of representing the parameter values for list and drop down boxes is by string literals. The key value will be delimeterd by %1F and each <key, value> pair will be separated by %1E. <param id="lastname1" displaytext="Name" name="lastname" type="dropdown" default="key1%1FMy Value1%1Ekey2%1FMy Value2" selected_value="My Value2"/>

Hidden parameter The hidden parameters are used to pass sensitive data (for ex. password, session token etc.) within the context of the report. The hidden data can be used by the report or by the SQL to load the value or by the java bean to process some business logic without the knowledge of the end user. To define hidden parameter, <param id="city" displaytext="User1" name="User1" hidden="true" type="string" class="com.ca.ims.reporting.unittests.TestDataCollector"/>

The value of the “city” parameter will be processed by the “TestDataCollector” java bean but it won’t be visible to the end user. Step 3: Uploading the Custom Report Template and Parameter XML Files In previous chapters, we defined our report template file and report parameter file. Now we need to upload both files to Crystal Report Server to in order to create the report. Please follow the steps below to upload the report template and parameter XML files.

1. Goto the “Business Objects administration launch pad”. Usually it resides in http://<server-name>:<port-number>/businessobjects/enterprise115/adminlaunch/launchpad.html

2. Click “Launch the Central Management Console”. The login screen will

appear:

3. Enter the user name and password. You will be directed to the main

console:

4. Click “Folders” and ‘IM Reports’:

5. Click “New Object…”. This will provide options to store files of different types. By default, it always point to Crystal Reports file type:

6. Click “Browse” and choose the .rpt file that you have created. Make sure you have the right folder in the section “Select the folder in which to save the report”. Click “Submit” in the lower right hand corner:

7. Click the folder name on the top left corner and repeat step 5.

8. In the “New Object” screen, choose the file type “Text”:

9. Repeat steps 6 and 7 and add the parameter XML text file:

10. Go to the folder and check whether both the files are available:

Step 4: Customize the Snapshot Parameter XML File (Optional)

The Snapshot Parameter XML File

The Snapshot Paramter XML files are used to define the Identity Management data you want to use in reports.

The default out-of-box snapshot parameter XML files are located at “[Identity Manager Install folder]\IdentityMinder.ear\config\com\netegrity\config\imrexport\sample”. You may optionally choose to modify the existing ones or create your own XML files in the folder based on your needs. The new files will be picked up by IM automatically.

Configure the Snapshot Parameter XML File (Optional)

To control the data that Identity Manager exports, create a Snapshot Parameter XML file. In this file, list the objects to export and, optionally, supply additional export criteria. Only objects that meet the criteria are exported. For example, you can export information about users who have a certain role.

The Snapshot Parameter XML file has the following format:

<?xml version="1.0" encoding="UTF-8"?> <IMRExport xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="jar:file:imrexport.jar!/schema/ImrExportCmd.xsd"> <export object="> <where attr=" " satisfy=" "> <value> </value> </where> <exportattr attr=" "> </export> </IMRexport>

The Snapshot Parameter XML file contains the following elements:

export

Indicates the object to export. For example, the Export element may export user data.

The export element can include one or more exportattr and where elements, which enable you to export only data that meets certain criteria. If there are no exportattr or where elements specified, all of the data for the object is exported. The export element has only the object parameter. The following table lists the possible values for the object parameter and its associated attributes:

Object Attributes

role You can use the |name| attribute.

|name|—the roles that satisfy the filter

For example, to export a list of roles that include Manager in the name, specify the following:

<export object="role"> <where attr="name" satisfy="ANY"> <value op="CONTAINS">Manager</value> </where>

user Any well-known or physical attribute or any of the following attributes:

|groups|—the members of a group

|roles|—the members of a role

|orgs|—users whose profiles exist in organizations that satisfy the filter

group Any well-known or physical attribute or the following attribute:

|groups|—the list of nested groups within a group that satisfies

organization Any well-known or physical attribute

useraccount Any well-known or physical attribute or any of the following attributes:

|groups|—the members of a group

|roles|—the members of a role

|orgs|—users whose profiles exist in organizations that satisfy the filter

For example, to filter by endpoint type, specify the following:

<where attr="Namespace" satisfy="ANY"> <value op="EQUALS">*</value> </where>

For example, to filter by endpoint, specify the following:

<where attr="Endpoint" satisfy="ANY"> <value op="EQUALS">*</value> </where>

exportattr

Indicates a specific attribute to export. Use the exportattr element to export a subset of attributes for the object you are exporting. For example, use the exportattr element to export only a user’s ID.

The exportattr element has only the attr parameter. The following table lists the possible values for the attr parameter:

Attribute Values

role You can use any of the following attributes:

|tasks|—the list of tasks associated with the role

|rules|—the list of member, admin, owner, and scope rules that apply to the role

|users|—the list of members, administrators, and owners for the role

|rolemembers|—the list of role members

|roleadmins|—the list of role administrators

|roleowners|—the list of role owners

Attribute Values

user You can use any of the following attributes:

|all_attributes|—the list all available user attributes. Alternatively, you can list physical attributes to be returned

|groups|—the list of all groups where the user is a member of or admin

|roles|—the list of roles where the user is a member, admin or an owner of.

|identitypolicystatus|—the list of the identity policies that apply to a specific user or set of users

|allocations|—the list of policies that are to be applied to a user for the first time

|reallocations|—the list of policies that will be reapplied to a user

|deallocations|—the list of policies that no longer apply to a user because the user no longer matches the policy condition

group You can use any well-known or physical attribute and any of the following attributes:

|all_attributes|—all of the attributes that are defined for the Group object in the directory configuration file (directory.xml). Alternatively you can list the physical attributes to be returned

|groups|—the nested groups within the group

|users|—the members of the group

|groupadmins|—the users who are administrators of specified group

|groupmembers|—the users who are members of specified group

|users|—the group administrators and members

organization You can use any well-known or physical attribute and any of the following attributes:

|all_attributes|—all of the attributes that are defined for the Organization object in the directory configuration file (directory.xml)

|orgs|—the members of the organization

|groups|—all groups in the organization

|users|—all users in the organization

Attribute Values

identityPolicySet You can use any of the following attributes:

|identitypolicystatus|—a list of the identity policies that apply to a specific user or set of users

|all_attributes|—a list of all policy sets, policies, and actions

|identitypolicyset|—exports the details of an identity policy set

|identitypolicies|—the list of policy sets that meet the filter criteria and the policies associated with each policy set

useraccounts You can use any specific attribute from the mapping file (use imname) or any of the following attributes:

|accountdata|—saving account name, endpoint, container, domain and type

|statistics|—when the account was created and modified

|assignmentinfo|—who created and approved the account and why

|syncwithroles|—whether the account is redundant to user provisioning roles or not

|entitlementattributes|—export all entitlement attributes that exists in the mapping file

|users|—Global users that meets the filter. If you chose to export |users| you can specify any of user object export attributes

|all_attributes|—will export all available user attributes.

|groups|—friendly name of a group. This search will return group members

|roles|—friendly name of a role. This search will return role members

|orgs|—friendly name of an organization. This search will return organization members

|allocations|—This contains the names of any policies which need to allocated to the user for the first time

|reallocations|—This contains the name of policies which need to be reallocated to the user

|deallocations|—This contains the names of policies which need to be deallocated from the user

|identitypolicystatus|—This will trigger the inclusion of allocations, reallocations, and deallocations in the user

value

Defines a condition that an object or attribute in the corresponding where element meet to be exported.

The value element requires the operator (op) parameter. The operator can be EQUALS or CONTAINS.

where

Filters the data that is exported based on specific criteria. You can specify multiple where elements.

The where and value elements are used to form a search filter. A where element must include at least one value element. For example, you can use where and value elements to export the tasks for enabled roles: <export object="role"> <where attr="enabled " satisfy="ALL"> <value op=EQUALS>Yes</value> </where> <exportattr attr="|tasks|"> </export>

You can specify where and value elements for the export and exportattr elements. The following table describes the parameters for the where element:

Parameter Description

attr Indicates the attribute to use in a filter.

For example, if you specify the enabled attribute, Identity Manager checks the value of the enabled attribute to determine whether or not to export the role.

satisfy Indicates whether some or all of the value evaluations must be satisfied for the attribute to be displayed.

ALL—An attribute or object must satisfy all of the value evaluations.

ANY—An attribute or object must satisfy at least one value evaluation.

Step 5 Define a Snapshot Definition and Capture a Snapshot for the Custom Report

A snapshot reflects the state of objects in Identity Manager at a given time, and extracts this data, which can be used in one or more reports. You must create a snapshot definition before you can export data to the Reporting Database.

To create a snapshot definition

1. Click Reports, Manage Snapshot Definition, Create Snapshot Definition.

2. Create a new snapshot or copy an existing snapshot.

3. Enter the following details under the Profile tab:

Snapshot Definition Name

Specifies the unique name given for the snapshot definition.

Snapshot Definition Description

Displays any additional information to describe the snapshot.

Enabled

Specifies that Identity Manager will create a snapshot based on the current snapshot definition at the scheduled time.

Note: If this option is not selected, the snapshot will not be captured at the scheduled time. Also, the snapshot definition will not be listed in the Capture Snapshot Data screen.

Identifier

Specifies the Snapshot Parameters XML file (see page 45) that defines the objects and their attributes, which will be exported into the Reporting Database. ExportAll.xml is the default Identifier file that will export all data for reporting. The sample Identifier files are located in the following directory:

IdentityMinder.ear\config\com\netegrity\config\imrexport\sample

Note: Previously, these files were known as export command files and were used by the imrexport tool. If you used reporting in a previous version of Identity Manager and have existing export command files, move them to the Identifier file directory for management in the User Console.

Keep Last

Specifies the number of successful snapshots to be stored in the Reporting Database. If left blank, IM will store unlimited number of snapshots.

4. Click Submit. Identity Manager is configured to create snapshots of the objects mentioned in the Identifier XML file.

To capture a snapshot If you want to capture snapshot data on demand (instead of scheduling a snapshot definition), run the Capture Snapshot Data task to export the data immediately (defined by a snapshot definition) to the Reporting Database.

In the User Console, go to Reports, Tasks, Capture Snapshot Data, Choose a snapshot definition.

Click Submit. Snapshot data is exported to the Reporting Database.

Step 6: Create a Admin Task for the Report

Before you proceed, make sure you have the report database server connection and the report parameter connections created using Identity Access Manager management console. Please refer to Identity Access Manager Administration Guide on how to create them.

1) Login to Identity Manager. 2) Select “Roles and Tasks” and choose “Create Admin Task:”. In the next

screen, choose “Create a new Admin Task” option.

The following fields should be set in the “Profile” screen. - Name - Tag (if the default value is not needed) - Category (choose the existing one or create a new one). - Category Order (the order in which the top level tab appears) - Category 2 (if the default needs to be changed). - Category Order (the order in which the top level tab appears) - Category 3 (if required) - Category Order (the order in which the top level tab appears) - Priamary Object (“Report Instance”). - Action (“Create)

3) Click “Search” tab next to “Profile”.

4) Click “…” 5) In the next screen, choose “New”.

6) Choose “Report Type Selection Screen”. The following fields are affected:

- Name (Name of the report)

- Tag (if the default value should be changed). the report instance title).

- Titile (This is the text that will be displayed as- Report Type – Choose the report you added in the business objects

server (refer section “Storing Report and its parameter XML”).

lick “Next”. Make sure the search screen you created is selected by default. C

7) Click “Select”. he screen. 8) Click “Tabs” in t

9) Select “Report Snapshot Scheduler”.

10) Click the button to go to the snapshot configuration page.

11) Click ‘Add’ button, the search page shows up, click ‘Search’.

12) Select the ‘groupmembership1’ snapshot we created and click ‘Select’ and then ‘OK’ 13) Click hit “Submit” to submit the task creation.

Step 7: Setting up Custom Report Task Access

In order to view and manage the new report task, you need to set up role access for it, just like setting up access to any Identity Manager tasks. For example, we login as system admin user ‘Superadmin’.

1) Login to Identity Manager. 2) Select “Roles and Tasks” and choose “Modify Admin Role” 3) Select ‘System Manager’ in the ‘Modify Admin Role’ screen.

4) Click ‘Tasks’ tab in the ‘Modify Admin Role: System Manager’ screen.

5) Scroll down to the add-task section of the page. Select ‘reports’ in the ‘filter

tasks’ category drop-down list, and select ‘groupmembership1’ task.

6) Task is added to the ‘System Manager’ role, click ‘submit’.

7) Now when we login as ‘superadmin’, we will see the ‘groupmembership1’ task

show up in the left-hand task menu.

For further details about setting up task access, please refer to IM Administration Guide.

Step 8: Scheduling the Custom Report

1) To schedule/run the report we created, select ‘Report’, then select ‘groupmembership1’.

2) Select a ‘Snapshot Time’, and then click ‘Schedule Report’. You have the option of schedule the report to run now immediately, or run once at a later time.

3) Click ‘submit’ to schedule the report task.

Step 9: Viewing the Custom Report 1)To view a report, select ‘report’, then select ‘view my reports’. 2) In the report search screen, choose ‘groupmembership1’:

3) Click ‘Select’, the report content shows up:

Appendix A Parameters XSD

<?xml version="1.0" encoding="UTF-8"?> <schema xmlns="http://www.w3.org/2001/XMLSchema" targetNamespace="http://www.example.org/Parameters" xmlns:tns="http://www.example.org/Parameters" elementFormDefault="qualified">  <element name="product"> <complexType id="productList"> <sequence> <element name="connection_info" type="tns:connection_info" minOccurs="0" maxOccurs="unbounded"/> <element name="screen" type="tns:screens" maxOccurs="unbounded"/> </sequence> <attribute name="name" type="string" use="required"/> </complexType> </element>  <complexType name="screens"> <sequence> <element name="parameters" type="tns:paramList"/> </sequence> <attribute name="id" type="string" use="required"/> </complexType>  <complexType name="paramList"> <sequence> <element name="param" type="tns:paramAttr" maxOccurs="unbounded"/> </sequence> </complexType> <attributeGroup name="method_access"> <attribute name="class" type="string" use="optional"/> <attribute name="method" type="string" use="optional"/> </attributeGroup> <attributeGroup name="additionalParams"> <attribute name="taskTagName" use="optional" fixed="true"></attribute> </attributeGroup>  <complexType name="paramAttr"> <attribute name="id" type="string" use="required"/> <attribute name="name" type="string" use="required"/> <attribute name="displaytext" type="string" use="required"/> <attribute name="type" use="required"> <simpleType> <restriction base="string"> <pattern value="string|checkbox|radiobox|sqlstr|dropdown|listbox|listbox_to_string"></pattern> </restriction> </simpleType> </attribute> <attribute name="rows" type="string" use="optional"/> <attribute name="multiselect" type="string" use="optional"/> <attribute name="sql" type="string" use="optional"/> <attribute name="hidden" type="boolean" use="optional"/> <attribute name="conn_type" type="string" use="optional"/> <attribute name="conn_id" type="string" use="optional"/> <attributeGroup ref="tns:additionalParams"></attributeGroup> <attribute name="selected_value" type="string" use="optional"/> <attribute name="value" type="string" use="optional"/>  <attribute name="values" type="string" use="optional"/> 

<attribute name="cascade_id" type="string" use="optional"/> <attributeGroup ref="tns:method_access"/> </complexType>    <complexType name="connection_info"> <attribute name="id" type="string" use="optional"/> <attribute name="conn_type" type="string" use="optional"/> <attribute name="classification" use="required"> <simpleType> <restriction base="string"> <pattern value="jdbc_type|rpt_dsn_type|conn_mo_type"></pattern> </restriction> </simpleType> </attribute> <attribute name="server" type="string" use="optional"/> <attribute name="database" type="string" use="optional"/> <attribute name="username" type="string" use="optional" /> <attribute name="password" type="string" use="optional" /> <attribute name="url" type="string" use="optional" /> <attribute name="driverclass" type="string" use="optional" /> </complexType> </schema>

Appendix B Using Java bean in the reporting parameter

As discussed in section 2.4.2, the parameters can be loaded using java bean. The java bean logic can use the reporting plug-in interface IDataCollector or regular java beans.

IDataCollector interface

The customer’s business logic may require the previous screen parameters to be sent to their beans and process them in their business logic before the result set is sent. For ex. if the requirement is to list all the songs by 'Pink Floyd', and if the artist name was selected in the previous screen, that needs to be passed to the java bean which will load all the songs by 'Pink Floyd'.

Also, in some cases, the adopters would like to set up the data sources before they start they execute the business logic to obtain and pass the data to the parameter screen, then clean up all the settings after the job is done.

Basically, the pattern would be to call: 1) pre-data collection - setting up the bean or the adopter's environment before getting the data (for ex. getting all the data sources available and initialize the objects). 2) process-data collection - Gathering the data based on the parameters sent and set the list object to pass it back to the parameter screen; and finally 3) post-data collection - Clean up all the data that was set and used in pre and process methods.

To handle this case, framework reporting provides IDataCollector interface. This interface lives under /reporting/com/ca/ims/reporting/reporting. After all the parameters are entered successfully, the scheduler will appear.

/**

* This interface provides way to add framework adoptor's business logic to

* pass the data to the parameter screens.

*

* The adoptor can implement the interface and provide the information in their parameters

* XML. The ScreenElementProcessor will use that information to call their

* implementation and obtain the data to display it in the parameters screen.

*/

package com.ca.ims.reporting.rptinterfaces;

import java.util.Map;

/**

* @author chara09

*

* This interface provides way to add framework adoptor's business logic to

* pass the data to the parameter screens.

*

* The adoptor can implement the interface and provide the information in their parameters

* XML. The ScreenElementProcessor will use that information to call their

* implementation and obtain the data to display it in the parameters screen.

*/

public interface IDataCollector {

/**

* This method will be called before the data collection starts.

* The adoptor can use this method to set up any configuration here.

*

* @param params Parameter values passed from Screen element object.

*

* @return any data in the form of Object. Not used right now.

*/

public Object preDataCollection(Map params);

/**

* This is where the main business logic for obtaining the data should go.

* The adoptor will implement their own data retrieval mechanism.

*


*

* @return Currently supports List interface.

*/

public Object processDataCollection(Map params);

/**

* This method will be called after the data collection completed.

* The adoptor can use this method to clean up any configuration here.

*


*

* @return any data in the form of Object. Not used right now.

*/

public Object postDataCollection(Map params);

}

An example of implementing this interface is shown below:

/**

*

*/

package com.ca.ims.reporting.unittests;

import java.util.ArrayList;

import java.util.List;

import java.util.Map;

import com.ca.ims.reporting.rptinterfaces.IDataCollector;

/**

* @author chara09

*/

public class TestDataCollector implements IDataCollector {

/* (non-Javadoc)

* @see com.ca.ims.reporting.rptinterfaces.IDataCollector#postDataCollection(java.util.Map)

*/

public Object postDataCollection(Map params) {

// TODO Auto-generated method stub

return null;

}

/* (non-Javadoc)

* @see com.ca.ims.reporting.rptinterfaces.IDataCollector#preDataCollection(java.util.Map)

*/

public Object preDataCollection(Map params) {


return null;

}

/* (non-Javadoc)

* @see com.ca.ims.reporting.rptinterfaces.IDataCollector#processDataCollection(java.util.Map)

*/

public Object processDataCollection(Map params) {


List lst = new ArrayList();

lst.add("Test");

return lst;

}

}

If you don't need any operations to be done in pre and post data collections, you can return null.

Needless to say, your implementation should be in the class path of the application to be loaded. Usually, the best place for putting the jar that contains the implementation will be under user_console_war/WEB-INF/lib.

For the time being, the return values in pre and post data collections are not being used in framework reporting. This is for future enhancement.

Setting up IDataCollector implementation in parameters XML <param id="Test" displaytext="Test" name="Test" type="dropdown" class="com.ca.ims.reporting.unittests.TestDataCollector "/>

However, there will be one difference: the method is not defined here. If it is not defined, framework reporting will go through pre, process and post data collections methods. If the user does not want to go through all those methods, they can define method attribute and define which method of the interface they can call directly. For ex. if you want to call just 'processDataCollection()', the XML definition will be:

<param id="Test" displaytext="Test" name="Test" type="dropdown" class="com.ca.ims.reporting.unittests.TestDataCollector" method="processDataCollection"/>

Default Parameters added to IDataCollector Framework reporting integration will add some of the known default parameters into the parameters map when it is passed to the implementation of IDataCollector. So far, we have identified the database information that is defined in the parameter xml should be passed to the adopter's implementation. The key for getting the dbInfo map is DB_INFO, which is defined in com.ca.ims.reporting.utils.ScreenElementProcessor class.

In the future, we will add more if we decide it is worth for the adopters to use them.

Accessing screen parameters in IDataCollector Sometimes, you may need to use the previous screens' values in the Data collector implementation. For ex. to obtain the list of users whose last name is 'Smith'. The pre/process/post methods receive the parameters map. The screen parameters in that params map is stored as screen_id->map of that screen's params

For ex. to access screen id "1" parameters, you will write the following code in processData().

public Object processDataCollection(Map params) { String screenid = "1"; Map screenParams = params.get(screenid); //use the parameters here }

Additional data can be stored in any key, value pairs but framework reporting integration will always look for the screen parameters as explained above.

Documents

How to Create Custom Reports in Identity Manager R12 · PDF fileimr_actiontype . Action type nvarchar(65) (Allocation\Reallocation\Dealloca tion) imr_actionindex . int . Action item