Application​

Steps

1. Login to RSA G&L console as System Administrator.
2. Navigate to Resources > Application.
3. Click on Create Application and select Other Application.
4. Enter the details as shown below.
   
   
5. Click Finish.

Identity Collector​

This section explains the process for configuring an account collector for the Workday (RaaS) application. We will use the RSA G&L Generic REST collector for this purpose.

Steps

1. Login to RSA G&L console as System Administrator.
2. Navigate to Resources > Applications.
3. Click on Workday.
4. Navigate to Collectors tab and click on Create Identity Collector. Enter the details as shown below.
   
   
   
5. Click Next and enter the connection details.
   
   
   
6. Click Next. On the User Data page, enter the following configurations.
   
   
   
   
   
   

7. Click Next. On the Map Collector Attributes to User Attributes page, enter the following configurations.
   
   
   
8. Click Next. On the Attribute Evaluation page, enter the following configurations.
   
   
   
9. Click Finish. Use the Test function to make sure the configurations are accurate.

Workday : Setup​

Workday recommends using an Integration System User (ISU) for integration using third party services. RaaS requires basic authentication for REST API invocation.

Refer to Workato connectors - Workday integration connection | Workato Docs for more information on setup.

Troubleshooting​

Validation Error on Report Retrieval (HTTP 400)​

Error Message:

400 : Validation error occurred. Report not found or unauthorized

• Root Cause: The Integration System User (ISU) used by the collector is not designated as an authorized owner or viewer of the Report-as-a-Service (RaaS) report in Workday.
• Resolution:
  1. In Workday, locate the custom report used for collection.
  2. Edit the report permissions and verify the ISU user account has ownership or authorized access to execute the RaaS report.

References​

Workday Documentation

• Workday Reports-as-a-Service (RaaS): Report design, web service enablement, and JSON formatting.
• Workday Integration System User (ISU) Security: Security groups, domain security policies, and authentication configuration.
• Workato Workday Connection Guide: Configuring Integration System Users and permissions.

COL032

Application​

Steps

1. Login to RSA G&L console as System Administrator.
2. Navigate to Resources > Application.
3. Click on Create Application and select Other Application.
4. Enter the details as shown below.
   
   
5. Click Finish.

Account Collector​

This section explains the process for configuring an account collector for the Amazon Redshift application. We will use the PostgreSQL database collector for this purpose.

Steps

1. Login to RSA G&L console as System Administrator.
2. Navigate to Resources > Applications.
3. Click on Amazon Redshift.
4. Navigate to Collectors tab and click on Create Account Collector. Enter the details as shown below.
   
   
   
5. Click Next and enter the Oracle database details. Use the Test Connection to make sure the connection details are accurate.
   
   
   
6. Click Next. Select the appropriate data that you intend to collect.
   
   
   
7. Click Next. On the Account Data page, enter the following query to collect account information.

-- All Users
SELECT pg_user.usename AS accountID
FROM pg_user
GROUP BY 1;‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

The following are the important attributes

-- All Users
SELECT pg_user.usename AS accountID,
       pg_user.usename AS userID
FROM pg_user
GROUP BY 1;‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

The following are the important attributes

-- All Groups
SELECT pg_group.groname AS groupName
FROM pg_group
GROUP BY 1;‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

The following are the important attributes

-- Users and Groups
SELECT pg_group.groname AS groupName,
       pg_user.usename AS accountID
FROM pg_group, pg_user
WHERE pg_user.usesysid = ANY (pg_group.grolist)
GROUP BY 1,2;‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

11. Click Next. In the User Resolution Rules, map the user to account.
    
    
    
12. Click Next. In the Member Account Resolution Rules, map the account collector.
    
    
    
13. Click Finish. Use the Test function to make sure the configurations are accurate.

COL033

Application​

Steps

1. Login to RSA G&L console as System Administrator.
2. Navigate to Resources > Application.
3. Click on Create Application and select Other Application.
4. Enter the details as shown below.
   
   
5. Click Finish.

Account Collector​

This section explains the process for configuring an account collector for the ServiceNow application. We will use the RSA G&L Generic REST collector ¹ for this purpose.

Steps

1. Login to RSA G&L console as System Administrator.
2. Navigate to Resources > Applications.
3. Click on ServiceNow.
4. Navigate to Collectors tab and click on Create Account Collector. Enter the details as shown below.
   
   
   
5. Click Next and enter the connection details.
   
   
   
   
   
   
6. If authentication type ² is Basic, enter the credentials as shown below.
   
   
   
7. Click Next. Select the data types that the collector will be collecting from ServiceNow
   
   
   
8. Click Next. On the Account Data page, enter the following configurations.
   
   
   
   
   
   
   
   
   

9. Click Next. On the Group Data page, enter the following configurations.
   
   
   
   
   
   
   
   
   
   
   

10. Click Next. On the Account Group Membership page, enter the following configurations.
    
    
    
    
    
    
    
    

11. Click Next. In the Map Collector Attributes to Account Attributes, map the collected account attributes.
    
    
    
12. Click Next. In the Map Collector Attributes to Account Mapping Attributes, map the user reference attribute.
    
    
    
13. Click Next. In the Map Collector Attributes to Group Attributes, map the collected group attributes.
    
    
    
14. Click Next. In the User Resolution Rules, map the user to account.
    
    
    
15. Click Next. In the Member Account Resolution Rules, map the account.
    
    
    

💡 Info: This value MUST always be mapped to the Account Name for any generic REST collector.

16. Click Next. In the Group Owner Resolution Rules, map the owner to user attribute.
    
    
    
17. Click Finish. Use the Test function to make sure the configurations are accurate.

Entitlement Collector​

This section explains the process for configuring an entitlement collector to collect admin roles from ServiceNow application. We will use the RSA G&L Generic REST collector ¹ for this purpose.

Steps

1. Login to RSA G&L console as AveksaAdmin.
2. Navigate to Resources > Applications.
3. Click on ServiceNow.
4. Navigate to Collectors tab and click on Create Entitlement Collector. Enter the details as shown below.
   
   
   
5. Click Next and enter the connection details as shown in Step 5 of Account Collector.
6. Click Next. Select the data types that the collector will be collecting from ServiceNow.
   
   
   
7. Click Next. On the App Role Data page, enter the following configurations.
   
   
   
   
   
   
   
   
   
   
   

8. Click Next. On the App-Role Account Membership collection page, enter the following configurations.
   
   
   
   
   
   
   
   
   
   
   

9. Click Next. In the Map Collector Attributes to App Role Attributes, map the collected account attributes.
   
   
   
10. Click Next. In the Account Evaluation, map the account collector to account value.
    
    
    
11. Click Next and then click Finish. Use the Test function to make sure the configurations are accurate.

References​

• ServiceNow Table API: used for sys_user, sys_user_group, sys_user_grmember, sys_user_role, and sys_user_has_role.
• ServiceNow Basic Authentication
• ServiceNow Roles

COL029

Epic Objects​

Application​

Steps

1. Login to RSA G&L console as System Administrator.
2. Navigate to Resources > Application.
3. Click on Create Application and select Other Application.
4. Enter the details as shown below.
   
   
5. Click Finish.

Account Collector​

This section explains the process for configuring an account collector for the Epic EMR application. We will use the SQL Server database collector for this purpose.

Steps

1. Login to RSA G&L console as System Administrator.
2. Navigate to Resources > Applications.
3. Click on Epic EMR.
4. Navigate to Collectors tab and click on Create Account Collector. Enter the details as shown below.
   
   
   
5. Click Next and enter the SQL Server database details. Use the Test Connection to make sure the connection details are accurate. Use the latest Microsoft JDBC Driver for SQL Server if NTLM authentication is required.
   
   
   
6. Click Next. Select the appropriate data that you intend to collect. For the purpose of illustration we will collect accounts and user to account mapping from Epic EMR.
   
   
   
7. Click Next. On the Account Data page, enter the following query to collect account information.

SELECT
  EMP.SYSTEM_LOGIN EMP,
  EMP.PROV_ID AS SER,
  EMP.NAME AS displayName,
  EMP.USER_ID userID,
  CASE
    WHEN USER_STATUS_C = 1 THEN 0
    WHEN USER_STATUS_C = 2 THEN 1
    ELSE NULL
  END AS isDisabled,
  LAST_PW_UPDATE AS lastPasswordSetDate,
  LAST_ACCS_DATETIME AS lastLoginDate
FROM CLARITY_EMP EMP
WHERE EMP.SYSTEM_LOGIN IS NOT NULL

The key column mappings for this step are:

SELECT
  EMP.SYSTEM_LOGIN EMP,
  EMP.USER_ID userID
FROM CLARITY_EMP EMP
WHERE EMP.SYSTEM_LOGIN IS NOT NULL

9. Click Next. In the User Resolution Rules, map the user to account
   
   
   
   
   
10. Click Finish. Use the Test function to make sure the configurations are accurate.

Entitlement Collector​

This section explains the process for configuring an entitlement collector to collect application roles (templates) from Epic EMR. We will use the SQL Server database collector for this purpose.

Steps

1. Login to RSA G&L console as System Administrator.
2. Navigate to Resources > Applications.
3. Click on Epic EMR.
4. Navigate to Collectors tab and click on Create Entitlement Collector. Enter the details as shown below.
   
   
   
5. Click Next and enter the database connection details as shown in Step 5 of Account Collector.
6. Click Next. Select the data types that the collector will be collecting from Epic EMR.
   
   
   
7. Click Next. On the General Column Names, map the attribute names.
   
   
   
8. Click Next. Under Application Role Data section, use the following query to collect admin roles from Epic EMR.

SELECT DISTINCT
  TEMPLT_DSPLY_TITLE AS templateName,
  USER_ID AS template,
  TEMPLT_OWNER_PRIM_C AS owner
FROM CLARITY_EMP_2
WHERE TEMPLT_DSPLY_TITLE IS NOT NULL

The key column mappings for this step are:

SELECT
  TEMPLATE.LNK_TEMPLT_ID AS role_id,
  EMP.SYSTEM_LOGIN AS account
FROM
  CLARITY_EMP EMP
  LEFT OUTER JOIN EMP_AVAIL_TEMPLT TEMPLATE ON TEMPLATE.USER_ID = EMP.USER_ID
WHERE
  TEMPLATE.LNK_TEMPLT_ID IS NOT NULL
  AND EMP.SYSTEM_LOGIN IS NOT NULL
UNION
SELECT
  SUBTEMPLATE.APPLD_SUBTMPLT_ID AS role_id,
  EMP.SYSTEM_LOGIN AS account
FROM
  CLARITY_EMP EMP
  LEFT OUTER JOIN SUBTEMPLATES SUBTEMPLATE ON SUBTEMPLATE.USER_ID = EMP.USER_ID
WHERE
  SUBTEMPLATE.APPLD_SUBTMPLT_ID IS NOT NULL
  AND EMP.SYSTEM_LOGIN IS NOT NULL

10. Click Next. In the User Evaluation, map the account to the ADC.

11. Click Next and then click Finish. Use the Test function to make sure the configurations are accurate.

Troubleshooting​

Test Connection Fails​

• Root Cause: Incorrect database host or port, network firewall restrictions, missing JDBC driver, or unconfigured Windows authentication.
• Resolution:
  1. Verify the SQL Server hostname, port (default 1433), and Clarity database name are correct.
  2. Confirm the service account has network access to the Clarity database server.
  3. Ensure the Microsoft JDBC Driver for SQL Server is installed on the RSA G&L server.
  4. If using Windows or NTLM authentication, append integratedSecurity=true to the connection string.

SQL Query Returns Zero Rows​

• Root Cause: Missing SYSTEM_LOGIN values in CLARITY_EMP or insufficient table permissions.
• Resolution:
  1. Confirm SYSTEM_LOGIN is populated in CLARITY_EMP. Accounts without a system login are excluded by the WHERE clause.
  2. Verify the service account has SELECT permission on CLARITY_EMP, CLARITY_EMP_2, EMP_AVAIL_TEMPLT, and SUBTEMPLATES.

SUBTEMPLATES Table Not Found​

• Root Cause: Schema variation across Epic deployment versions.
• Resolution:
  1. Work with your Epic database administrator to verify the exact table or view name for subtemplates in your environment.
  2. Update the query mapping accordingly.

Collection Errors Mid-Run​

• Root Cause: Database timeouts caused by clinical load spikes or network latency.
• Resolution:
  1. Check the RSA G&L collection logs under Admin → Logs.
  2. Increase the JDBC connection timeout in the collector settings.
  3. Schedule the collector to run during off-peak clinical hours.

References​

Microsoft and Epic Documentation

• Microsoft JDBC Driver for SQL Server: Connection string parameters, authentication configurations, and timeout settings.
• Epic Systems Documentation and Developer Portal: Reporting specifications and Clarity relational data structures.

COL028

Admin Roles in RSA Authentication Manager define permissions and responsibilities for system administrators, allowing them to manage user authentication and security settings.

Tokens in RSA Authentication Manager are physical or software-based devices that generate one-time passcodes. Users enter these passcodes during authentication, enhancing security.

Risk-Based Authentication in RSA Authentication Manager evaluates various factors such as user location, device, and behavior patterns to assess the risk level. Based on this assessment, it adapts the authentication process, adding or reducing security measures accordingly to mitigate potential risks.

Application​

The first step in collecting accounts, tokens information from RSA Authentication Manager is to create a placeholder application to store this information in RSA Identity G&L.

Steps

1. Login to RSA G&L console as System Administrator.
2. Navigate to Resources > Application.
3. Click on Create Application and select Other Application.
4. Enter the details as shown below. If you intend to collect the account status and/or the locked status of the account configure the highlighted options.
   
   
5. Click Finish.

Account Collector​

This section explains the process for configuring a account collector for the RSA Authentication Manager application. We will use the PostgreSQL database collector for this purpose.

Steps

1. Login to RSA G&L console as System Administrator.
2. Navigate to Resources > Applications.
3. Click on RSA Authentication Manager.
4. Navigate to Collectors tab and click on Create Account Collector. Enter the details as shown below.
   
   
   
5. Click Next and enter the PostgreSQL database connection details. Use the Test Connection to make sure the connection details are accurate.
   
   
   
   
   
6. Click Next. Select the appropriate data that you intend to collect. For the purpose of illustration we will collect accounts, groups and user to account mapping from RSA Authentication Manager.
   
   
   
7. Click Next. On the Account Data page, enter the following query to collect account information.

SELECT DISTINCT principalData.loginuid AS account
     ,login.login_date AS login_date
     ,CONCAT (principal.first_name, ' ', principal.last_name) AS full_name
     --1 = enabled, 2 = disabled 
     ,CASE
        WHEN principalData.lockout_flag = '1' THEN '1'
        ELSE '0'
      END AS account_locked
     ,securityDomain.NAME AS securityDomain_domain
     ,CASE
        WHEN principalData.security_ques_answers IS NULL THEN '0'
        ELSE '1'
      END AS securityDomain_questions,
       --1 = user is enabled, 0 = user is disabled
     CASE
        WHEN principalData.enable_flag = '1' THEN '0'
        ELSE '1'
      END AS account_status     
      --1 = user has administrative roles assigned
       --0 = user does not have any administrative roles assigned
     ,principalData.administrator_flag AS privileged
--Basic user settings
FROM IMS_PRINCIPAL principal
--Detailed information about the user
FULL JOIN IMS_PRINCIPAL_DATA principalData
     ON principal.loginuid = principalData.loginuid
--Information about the security domain
JOIN IMS_SECURITY_DOMAIN securityDomain
     ON principalData.owner_id = securityDomain.id
--Last logon date and time of the user      
JOIN IMS_PRINCIPAL_LOGIN_DATE login
     ON principalData.id = login.principal_id ‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

The following are the important attributes

SELECT DISTINCT
     loginuid,loginuid AS account
FROM 
     rsa_rep.IMS_PRINCIPAL_DATA 

The following are the important attributes

SELECT DISTINCT
     (name) AS "group"
     ,description
FROM
     rsa_rep.IMS_GROUP_DATA
-- Optional Filter 
WHERE  
     identity_src_id = 'The Identity Source ID'

The following are the important attributes

SELECT 
     accounts.loginuid AS account
    ,GROUPS.name AS "group"
FROM rsa_rep.IMS_PRINCIPAL_DATA accounts
JOIN rsa_rep.IMS_PRINCIPAL_GROUP groupMembership
     ON accounts.id = groupMembership.principal_id
JOIN rsa_rep.IMS_GROUP_DATA GROUPS
     ON groupMembership.group_id = GROUPS.id
-- Optional Filter
WHERE
     GROUPS.identity_src_id = 'The Identity Source Identitfier' 

11. Click Next. In the User Resolution Rules, map the user to account

12. Click Next. In the Member Account Resolution Rules, map the account collector.

13. Click Finish. Use the Test function to make sure the configurations are accurate.

Entitlement Collector : Admin Roles​

This section explains the process for configuring a entitlement collector to collect admin roles from RSA Authentication Manager application. We will use the PostgreSQL database collector for this purpose.

Steps

1. Login to RSA G&L console as AveksaAdmin.
2. Navigate to Resources > Applications.
3. Click on RSA Authentication Manager.
4. Navigate to Collectors tab and click on Create Entitlement Collector. Enter the details as shown below.
   
   
   
5. Click Next and enter the database connection details as shown in Step 5 of Account Collector.
6. Click Next. Select the data types that the collector will be collecting from RSA Authentication Manager.
   
   
   
7. Click Next. On the General Column Names, map the attribute names.
   
   
   
8. Click Next. Under Application Role Data section, use the following query to collect admin roles from RSA Authentication Manager.

SELECT 
     name AS AppRole
     ,description
FROM
     IMS_ADMIN_ROLE

The following are the important attributes

SELECT 
     users.loginuid AS Account
     ,ROLES.name AS AppRole
FROM IMS_PRINCIPAL_DATA users
JOIN IMS_PRINCIPAL_ADMIN_ROLE admins
     ON users.id = admins.principal_id
JOIN IMS_ADMIN_ROLE ROLES
     ON admins.admin_role_id = ROLES.id

10. Click Next. In the User Evaluation, map the account to the ADC.

11. Click Next and then click Finish. Use the Test function to make sure the configurations are accurate.

Entitlement Collector : Tokens​

This section explains the process for configuring a entitlement collector to collect tokens as account entitlements from RSA Authentication Manager application. We will use the PostgreSQL database collector for this purpose.

Steps

1. Login to RSA G&L console as AveksaAdmin.
2. Navigate to Resources > Applications.
3. Click on RSA Authentication Manager.
4. Navigate to Collectors tab and click on Create Entitlement Collector. Enter the details as shown below.
   
   
   
5. Click Next and enter the database connection details as shown in Step 5 of Account Collector.
6. Click Next. Select the data types that the collector will be collecting from RSA Authentication Manager.
   
   
   
7. Click Next. On the General Column Names, map the attribute names.
   
   
   
8. Click Next.
9. Click Next on the Resource Data page.
10. Click Next. Under Resource Entitlement Data section, use the following query to collect tokens information from RSA Authentication Manager.

SELECT 
     tokens.serial_number AS RESOURCE
     ,CASE
        WHEN tokens.token_type = '0' THEN 'Std Card'
        WHEN tokens.token_type = '1' THEN 'PIN Pad'
        WHEN tokens.token_type = '2' THEN 'SID 700'
        WHEN tokens.token_type = '4' THEN 'Soft Token'
        WHEN tokens.token_type = '9' THEN 'SID 800'
        WHEN tokens.token_type = '10' THEN 'Flex Card'
      END               AS Action
     ,tokens.token_shutdown_date AS Expiration
     ,tokenDetails.last_login_date     AS lastlogin,
     CASE
        WHEN tokens.is_enabled = 'true' OR tokens.is_enabled = 't' THEN 'true'
        ELSE 'false'
     END as tokenEnabled
FROM   AM_TOKEN tokens
     ,AM_TOKEN_OOB tokenDetails
WHERE  tokens.id = tokenDetails.am_token_id‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

11. Click Next. On the Account Data section, enter the query below to collect mappings for account to tokens.

SELECT users.loginuid   AS Account
     ,serial_number AS RESOURCE
     ,CASE
        WHEN token_type = '0' THEN 'Std Card'
        WHEN token_type = '1' THEN 'PIN Pad'
        WHEN token_type = '2' THEN 'SID 700'
        WHEN token_type = '4' THEN device.family_key
        WHEN token_type = '9' THEN 'SID 800'
        WHEN token_type = '10' THEN 'Flex Card'
      END         AS Action
FROM IMS_PRINCIPAL_DATA users
JOIN AM_TOKEN tokens
     ON users.id = tokens.principal_id
LEFT JOIN AM_SW_TOKEN_DEVICE_TYPES device
     ON tokens.sw_token_device_type_id = device.id

12. Click Next. In the Account Evaluation, map the account to the ADC.

13. Click Next and then click Finish. Use the Test function to make sure the configurations are accurate.

Entitlement Collector : Risk Based Authentication​

This section explains the process for configuring a entitlement collector to collect information regarding Risk Based Authentication (RBA) being enabled for an account from RSA Authentication Manager application. We will use the PostgreSQL database collector for this purpose.

Steps

1. Login to RSA G&L console as AveksaAdmin.
2. Navigate to Resources > Applications.
3. Click on RSA Authentication Manager.
4. Navigate to Collectors tab and click on Create Entitlement Collector. Enter the details as shown below.
   
   
   
5. Click Next and enter the database connection details as shown in Step 5 of Account Collector.
6. Click Next. Select the data types that the collector will be collecting from RSA Authentication Manager.
   
   
   
7. Click Next. On the General Column Names, map the attribute names.
   
   
   
8. Click Next.
9. Click Next on the Resource Data page.
10. Click Next. On the Account Data section, enter the query below to collect mappings for account to tokens.

SELECT loginuid AS Account
     ,'RBA'   AS RESOURCE
     ,CASE
        WHEN SUBSTR (authenticator_bit_flags, 7, 1) = '1' THEN 'Yes'
        ELSE 'No'
     END     AS Action
FROM
     IMS_PRINCIPAL_DATA

11. Click Next. In the Account Evaluation, map the account to the ADC.

12. Click Next and then click Finish. Use the Test function to make sure the configurations are accurate.

COL027

Overview​

QSYS2 is the system-wide catalog schema on IBM i. It contains metadata views and tables for the entire relational database, covering all schemas, users, tables, authorities, and system objects in one place. QSYS2 is the IBM i equivalent of INFORMATION_SCHEMA or system catalogs on other databases; it provides centralized, cross-schema views for identity and access management.​

• USER_INFO in QSYS2 lists all user profiles on the entire IBM i system, regardless of which application schemas they own or access.​
• SYSTABLES in QSYS2 lists all tables across every schema/library on the system.​
• AUTHORIZATION_LIST_USER_INFO in QSYS2 lists all authorization lists and memberships system-wide.​
• GROUP_PROFILE_ENTRIES in QSYS2 lists all group memberships for every user on the system.​

You do not need to connect to individual application schemas (like MYAPP, FINANCE, HR) separately. QSYS2 aggregates metadata from the entire system into a single queryable location.

Application​

Steps

1. Login to RSA G&L console as System Administrator.
2. Navigate to Resources > Application.
3. Click on Create Application and select Other Application.
4. Enter the details as shown below.
   
   
5. Click Finish.

Account Collector​

This section explains the process for configuring an account collector for the IBM iSeries (AS400) application. We will use the database collector for this purpose.

Steps

1. Login to RSA G&L console as System Administrator.
2. Navigate to Resources > Applications.
3. Click on IBM iSeries (AS400).
4. Navigate to Collectors tab and click on Create Account Collector. Enter the details as shown below.
   
   
   
   
   

5. Click Next and enter the database details. Use the Test Connection to make sure the connection details are accurate.
   
   
   
6. Click Next. Select the appropriate data that you intend to collect.
   
   
   
7. Click Next. On the Account Data page, enter the following query to collect account information.

SELECT
  u.AUTHORIZATION_NAME      AS user_name,
  CASE WHEN u.STATUS = '*ENABLED' THEN 0 ELSE 1 END AS is_disabled,
  u.PREVIOUS_SIGNON         AS last_signon_timestamp,
  u.DATE_PASSWORD_EXPIRES   AS password_expires_timestamp,
  u.TEXT_DESCRIPTION        AS description
FROM QSYS2.USER_INFO_BASIC u
WHERE u.AUTHORIZATION_NAME NOT LIKE 'Q%'       -- Exclude IBM out-of-the-box system profiles
  AND u.AUTHORIZATION_NAME NOT IN (
        SELECT DISTINCT GROUP_PROFILE_NAME
        FROM QSYS2.GROUP_PROFILE_ENTRIES
      )                                        -- Exclude group-only accounts
ORDER BY u.AUTHORIZATION_NAME

The following are the important attributes

SELECT
  u.AUTHORIZATION_NAME      AS account_name,
    u.AUTHORIZATION_NAME      AS user_name
FROM QSYS2.USER_INFO_BASIC u
WHERE u.AUTHORIZATION_NAME NOT LIKE 'Q%'       -- Exclude IBM out-of-the-box system profiles
  AND u.AUTHORIZATION_NAME NOT IN (
        SELECT DISTINCT GROUP_PROFILE_NAME
        FROM QSYS2.GROUP_PROFILE_ENTRIES
      )                                        -- Exclude group-only accounts
ORDER BY u.AUTHORIZATION_NAME

The following are the important attributes

SELECT
  u.AUTHORIZATION_NAME      AS group_name,
  u.TEXT_DESCRIPTION        AS description,
  u.STATUS                  AS group_status,        -- *ENABLED / *DISABLED
  u.USER_OWNER              AS profile_owner,       -- owner of the *USRPRF object
  u.USER_CREATOR            AS profile_creator,     -- creator of the *USRPRF object
  u.SPECIAL_AUTHORITIES     AS special_authorities, -- e.g., *ALLOBJ, *SECADM
  u.GROUP_ID_NUMBER         AS gid,
  u.CREATION_TIMESTAMP      AS created_at,
  u.LAST_USED_TIMESTAMP     AS last_used
FROM QSYS2.USER_INFO u
WHERE u.GROUP_MEMBER_INDICATOR = 'YES'             -- profiles that function as group profiles
  AND u.AUTHORIZATION_NAME NOT LIKE 'Q%'           -- optional: drop IBM-supplied groups
ORDER BY u.AUTHORIZATION_NAME

The following are the important attributes

10. In the Account Membership Data configuration section enter the following query to collect groups membership information from IBM iSeries (AS400).

SELECT
  e.GROUP_PROFILE_NAME AS group_name,
  e.USER_PROFILE_NAME  AS account_name,
  CASE
    WHEN u.GROUP_PROFILE_NAME = e.GROUP_PROFILE_NAME THEN 'PRIMARY'
    ELSE 'SUPPLEMENTAL'
  END AS membership_type
FROM QSYS2.GROUP_PROFILE_ENTRIES e
LEFT JOIN QSYS2.USER_INFO u
  ON u.AUTHORIZATION_NAME = e.USER_PROFILE_NAME
ORDER BY group_name, user_name

11. Click Next. In the User Resolution Rules, map the user to account
    
    
    
12. Click Next. In the Member Account Resolution Rules, map the account collector.
    
    
    
13. Click Finish. Use the Test function to make sure the configurations are accurate.

Entitlement Collector (DRAFT)​

This section explains the process for configuring an entitlement collector to collect authorization lists from IBM iSeries (AS400) application. We will use the database collector for this purpose.

Steps

1. Login to RSA G&L console as AveksaAdmin.
2. Navigate to Resources > Applications.
3. Click on IBM iSeries (AS400).
4. Navigate to Collectors tab and click on Create Entitlement Collector. Enter the details as shown below.
   
   
   
5. Click Next and enter the database connection details as shown in Step 5 of Account Collector.
6. Click Next. Select the data types that the collector will be collecting from IBM iSeries (AS400).
   
   
   
7. Click Next. On the General Column Names, map the attribute names.
   
   
   
8. Click Next. Under Application Role Data section, use the following query to authorization lists from IBM iSeries (AS400).

SELECT
  AUTHORIZATION_LIST       AS role,
  TEXT_DESCRIPTION         AS description,
  OWNER                    AS owner
FROM QSYS2.AUTHORIZATION_LIST_INFO
WHERE AUTHORIZATION_LIST NOT LIKE 'Q%'
ORDER BY AUTHORIZATION_LIST

The following are the important attributes

SELECT 
  DISTINCT trim(UPUSCL) as resource, '*ALLOBJ' as action 
FROM 
  QGPL.DSPUSRPRF 
WHERE 
  UPSPAU LIKE '%*ALLOBJ%' 
UNION 
SELECT 
  DISTINCT trim(UPUSCL) as resource, '*AUDIT' as action 
FROM 
  QGPL.DSPUSRPRF 
WHERE 
  UPSPAU LIKE '%*AUDIT%' 
UNION 
SELECT 
  DISTINCT trim(UPUSCL) as resource, '*IOSYSCFG' as action 
FROM 
  QGPL.DSPUSRPRF 
WHERE 
  UPSPAU LIKE '%*IOSYSCFG%' 
UNION 
SELECT 
  DISTINCT trim(UPUSCL) as resource, '* JOBCTL' as action 
FROM 
  QGPL.DSPUSRPRF 
WHERE 
  UPSPAU LIKE '%*JOBCTL%' 
UNION 
SELECT 
  DISTINCT trim(UPUSCL) as resource, '* SAVSYS' as action 
FROM 
  QGPL.DSPUSRPRF 
WHERE 
  UPSPAU LIKE '%*SAVSYS%' 
UNION 
SELECT 
  DISTINCT trim(UPUSCL) as resource, '*SECADM' as action 
FROM 
  QGPL.DSPUSRPRF 
WHERE 
  UPSPAU LIKE '%* SECADM%' 
UNION 
SELECT 
  DISTINCT trim(UPUSCL) as resource, '*SERVICE' as action 
FROM 
  QGPL.DSPUSRPRF 
WHERE 
  UPSPAU LIKE '%*SERVICE%' 
UNION 
SELECT 
  DISTINCT trim(UPUSCL) as resource, '*SPLCTL' as action 
FROM 
  QGPL.DSPUSRPRF 
WHERE 
  UPSPAU LIKE '%*SPLCTL%' 
UNION 
SELECT 
  DISTINCT trim(UPUSCL) as resource, '*NONE' as action 
FROM 
  QGPL.DSPUSRPRF 
WHERE 
  UPSPAU LIKE '%*NONE%'‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

10. Click Next. On the Account Data section, enter the query below to collect mappings for account to roles.

SELECT 
  DISTINCT trim(UPUSCL) as resource, '*ALLOBJ' as action, trim(UPUPRF) as LID 
FROM 
  QGPL.DSPUSRPRF 
WHERE 
  UPSPAU LIKE '%*ALLOBJ%' 
UNION 
SELECT 
  DISTINCT trim(UPUSCL) as resource, '*AUDIT' as action, trim(UPUPRF) as LID 
FROM 
  QGPL.DSPUSRPRF 
WHERE 
  UPSPAU LIKE '%*AUDIT%' 
UNION 
SELECT 
  DISTINCT trim(UPUSCL) as resource, '*IOSYSCFG' as action, trim(UPUPRF) as LID 
FROM 
  QGPL.DSPUSRPRF 
WHERE 
  UPSPAU LIKE '%*IOSYSCFG%' 
UNION 
SELECT 
  DISTINCT trim(UPUSCL) as resource, '* JOBCTL' as action, trim(UPUPRF) as LID 
FROM 
  QGPL.DSPUSRPRF 
WHERE 
  UPSPAU LIKE '%*JOBCTL%' 
UNION 
SELECT 
  DISTINCT trim(UPUSCL) as resource, '* SAVSYS' as action, trim(UPUPRF) as LID 
FROM 
  QGPL.DSPUSRPRF 
WHERE 
  UPSPAU LIKE '%*SAVSYS%' 
UNION 
SELECT 
  DISTINCT trim(UPUSCL) as resource, '*SECADM' as action, trim(UPUPRF) as LID 
FROM 
  QGPL.DSPUSRPRF 
WHERE 
  UPSPAU LIKE '%* SECADM%' 
UNION 
SELECT 
  DISTINCT trim(UPUSCL) as resource, '*SERVICE' as action, trim(UPUPRF) as LID 
FROM 
  QGPL.DSPUSRPRF 
WHERE 
  UPSPAU LIKE '%*SERVICE%' 
UNION 
SELECT 
  DISTINCT trim(UPUSCL) as resource, '*SPLCTL' as action, trim(UPUPRF) as LID 
FROM 
  QGPL.DSPUSRPRF 
WHERE 
  UPSPAU LIKE '%*SPLCTL%' 
UNION 
SELECT 
  DISTINCT trim(UPUSCL) as resource, '*NONE' as action, trim(UPUPRF) as LID 
FROM 
  QGPL.DSPUSRPRF 
WHERE 
  UPSPAU LIKE '%*NONE%'‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

10. Click Next. In the User Evaluation, map the account to the ADC.

11. Click Next and then click Finish. Use the Test function to make sure the configurations are accurate.

Setup​

AS400​

User profile information available on the AS400 is not automatically maintained in an accessible table format. The table needs to be created and refreshed by running a simple command on the AS400. Typically, the command is scheduled to be run daily, before collection is initiated from the RSA G&L.

A JDBC based AS400 specific collector can collect and parse the user account data for both account and entitlement information. A user account with read access is required to the AS400.

The high-level steps are as follows:

1. Generate the user table by executing the following command.

**DSPUSRPRF USRPRF(*ALL) TYPE(BASIC) OUTPUT(OUTFILE) OUTFILE(QGPL/DSPUSRPRF) ‍‍‍‍‍‍‍‍‍‍

2. Set up a batch job to run the above command daily, before scheduled collections run on RSA G&L.
3. Create a user account that has read access to the table: QGPL/DSPUSRPRF.

RSA G&L​

This integration uses the AS400 JDBC Driver (com.ibm.as400.access.AS400JDBCDriver) to connect to the database to extract information. The high level steps are as follows:

1. Download the AS400 JDBC driver from https://sourceforge.net/projects/jt400/ and extract the jt400.jar file.
   
   
   
2. Add the jar file to ACM by uploading via the admin console.

COL026

Miro supports both the REST API ¹ and SCIM APIs ². For the purposes of this article, we will use the SCIM APIs.

Application​

Steps

1. Login to RSA G&L console as System Administrator.
2. Navigate to Resources > Application.
3. Click on Create Application and select Other Application.
4. Enter the details as shown below.
   
   
5. Click Finish.

Account Collector​

This section explains the process for configuring an account collector for the Miro application. We will use the RSA G&L Generic REST collector for this purpose.

Steps

1. Login to RSA G&L console as System Administrator.
2. Navigate to Resources > Applications.
3. Click on Miro.
4. Navigate to Collectors tab and click on Create Account Collector. Enter the details as shown below.
   
   
   
5. Click Next and enter the connection details.
   
   
   
6. Click Next. Select the data types that the collector will be collecting from Miro
   
   
   
7. Click Next. On the Account Data page, enter the following configurations.
   
   
   
   
   
   
   
   
   
   
   

8. Click Next. On the Group Data page, enter the following configurations.
   
   
   
   
   
   
   
   
   
   
   

9. Click Next. On the Account Group Membership page, enter the following configurations.
   
   
   
   
   
   
   
   

10. Click Next. In the Map Collector Attributes to Account Attributes, map the collected account attributes.
    
    
    
11. Click Next. In the Map Collector Attributes to Account Mapping Attributes, map the user reference attribute.
    
    
    
12. Click Next. In the Map Collector Attributes to Group Attributes, map the collected group attributes.
    
    
    
13. Click Next. In the User Resolution Rules, map the user to account.
    
    
    
14. Click Next. In the Member Account Resolution Rules, map the account.
    
    
    

💡 Info: This value MUST always be mapped to the Account Name for any generic REST collector.

15. Click Finish. Use the Test function to make sure the configurations are accurate.

Entitlement Collector​

This section explains the process for configuring an entitlement collector to collect user roles and assignments from the Miro application. We will use the RSA G&L Generic REST collector for this purpose.

Steps

1. Login to RSA G&L console as AveksaAdmin.
2. Navigate to Resources > Applications.
3. Click on Miro.
4. Navigate to Collectors tab and click on Create Entitlement Collector. Enter the details as shown below.
   
   
   
5. Click Next and enter the connection details as shown in Step 5 of Account Collector. Leave Use Base URL for all API(s) unchecked.
6. Click Next. Select the data types that the collector will be collecting from Miro.
   
   
   
7. Click Next. On the App Role Data page, enter the following configurations.
   
   
   
   
   
   
   
   

8. Click Next. On the App-Role Account Membership collection page, enter the following configurations.
   
   
   
   
   
   
   
   
   
   
   

9. Click Next. In the Map Collector Attributes to App Role Attributes, map the collected account attributes.
   
   
   
10. Click Next. In the Account Evaluation, map the account collector to account value.
    
    
    
11. Click Next and then click Finish. Use the Test function to make sure the configurations are accurate.

Application Setup​

SCIM​

This section explains the process of setting up Miro for integration with G&L using the SCIM APIs.

Steps

1. Login to the Miro dashboard at https://miro.com/app/dashboard/.
2. Click on profile and select Settings.
   
   
   
3. Navigate to Security & compliance > Authentication page and enable SSO/SAML feature.
   
   
   
4. Navigate to Account > Enterprise integrations page and copy the Base URL and API token
   
   
   

OAuth2​

This section explains the process of setting up Miro for integration with G&L using OAuth2 authentication.

Steps

1. Login to the Miro dashboard at https://miro.com/app/dashboard/.
2. Click on profile and select Settings.
   
   
   
3. Under Profile Settings, click on Integrations tab.
   
   
   
4. Click on Create New App.
5. Provide a suitable name for the application.
6. Select a Developer Team to place the application in. If you do not have a team, go to Teams under User Management and create developer team.
   
   
7. Click on Create App.
8. Copy the Client ID and Client Secret.
   
   
   
9. Add the G&L callback URL to redirect to https://instance/aveksa/oauth/callback
   
   
   
10. Provide the necessary permissions to the app and click Install App and Get OAuth Token.
    
    
    

Authentication​

OAuth2​

This section explains the process of setting up RSA G&L ADC and EDC to acquire the OAuth2 token dynamically from Miro.

Steps

1. Login to RSA G&L console as System Administrator.
2. Create or Edit a generic REST ADC that will be using OAuth2 authentication.
3. On the Connection Details page, configure the following.
   

4. Click on Get OAuth 2.0 Access Token.
5. Click on Proceed For Authorization.
   
   
   
6. Login to Miro account.
   
   
   
7. The below message indicates that RSA G&L has successfully acquired a token.
   
   
   
8. Click Close.
9. Save the collector configuration. Use the Test function to make sure the configurations are accurate.

References​

• Miro REST API 2.0 Reference
• Miro SCIM API
• OAuth 2.0 Authorization Code Grant (RFC 6749)

COL025

Application​

The first step in collecting accounts, tokens information from WebFOCUS is to create a placeholder application to store this information in RSA Identity G&L.

Steps

1. Login to RSA G&L console as System Administrator.
2. Navigate to Resources > Application.
3. Click on Create Application and select Other Application.
4. Enter the details as shown below.
   
   
5. Click Finish.

Account Collector​

This section explains the process for configuring an account collector for the WebFOCUS application. We will use the Oracle database collector for this purpose.

Steps

1. Login to RSA G&L console as System Administrator.
2. Navigate to Resources > Applications.
3. Click on WebFOCUS BI & Analytics.
4. Navigate to Collectors tab and click on Create Account Collector. Enter the details as shown below.
   
   
   
5. Click Next and enter the Oracle database details. Use the Test Connection to make sure the connection details are accurate.
   
   
   
6. Click Next. Select the appropriate data that you intend to collect.
   
   
   
7. Click Next. On the Account Data page, enter the following query to collect account information.

SELECT 
  userid AS account, 
  username AS userID, 
  email, 
  CASE isactive WHEN 1 THEN 0 ELSE 1 AS isDisabled 
FROM 
  WF_MRUSERS‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

The following are the important attributes

8. Click Next. On the User Account Mappings Data configuration page enter the following query to map the WebFOCUS account to user identity.

SELECT 
  userid AS account, 
  username AS userID
FROM 
  WF_MRUSERS‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

The following are the important attributes

9. Click Next. In the Group Data configuration section enter the following query to collect groups from WebFOCUS.

SELECT 
  distinct groupName, 
  groupid 
FROM 
  WF_MRGROUPS‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

The following are the important attributes

10. In the Account Membership Data configuration section enter the following query to collect groups membership information from WebFOCUS.

SELECT 
  userid AS account, 
  groupid 
FROM 
  WF_USRGRPTB 
WHERE 
  userid is NOT NULL‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

11. Click Next. In the User Resolution Rules, map the user to account
    
    
    
12. Click Next. In the Member Account Resolution Rules, map the account collector.
    
    
    
13. Click Finish. Use the Test function to make sure the configurations are accurate.

Entitlement Collector​

This section explains the process for configuring an entitlement collector to collect admin roles from WebFOCUS application. We will use the Oracle database collector for this purpose.

Steps

1. Login to RSA G&L console as AveksaAdmin.
2. Navigate to Resources > Applications.
3. Click on WebFOCUS BI & Analytics.
4. Navigate to Collectors tab and click on Create Entitlement Collector. Enter the details as shown below.
   
   
   
5. Click Next and enter the database connection details as shown in Step 5 of Account Collector.
6. Click Next. Select the data types that the collector will be collecting from WebFOCUS.
   
   
   
7. Click Next. On the General Column Names, map the attribute names.
   
   
   
8. Click Next. Under Application Role Data section, use the following query to collect admin roles from WebFOCUS.

SELECT 
  distinct roleid, 
  rolename AS role, 
  roleflag AS description 
FROM 
  WF_MRROLES‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

The following are the important attributes

9. Click Next. On the Account Data section, enter the query below to collect mappings for account to admin roles.

SELECT 
  users.userid AS account, 
  roles.rolenameAS role 
FROM 
  WF_MRUSERS users 
  INNER JOIN WF_MRROLES roles ON roles.roleid = users.roleid‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

10. Click Next. In the User Evaluation, map the account to the ADC.

11. Click Next and then click Finish. Use the Test function to make sure the configurations are accurate.

COL024

Application​

The first step in collecting accounts, tokens information from Deltek CostPoint is to create a placeholder application to store this information in RSA Governance & Lifecycle.

Steps

1. Login to RSA G&L console as System Administrator.
2. Navigate to Resources > Application.
3. Click on Create Application and select Other Application.
4. Enter the details as shown below.
   
   
5. Click Finish.

Account Collector​

This section explains the process for configuring an account collector for the Deltek Costpoint application. We will use the SQL Server database collector for this purpose.

Steps

1. Login to RSA G&L console as System Administrator.
2. Navigate to Resources > Applications.
3. Click on Deltek CostPoint.
4. Navigate to Collectors tab and click on Create Account Collector. Enter the details as shown below.
   
   
   
5. Click Next and enter the database details. Use the Test Connection to make sure the connection details are accurate. Use the latest Microsoft JDBC Driver for SQL Server if NTLM authentication is required.
   
   
   
6. Click Next. Select the appropriate data that you intend to collect.
   
   
   
7. Click Next. On the Account Data page, enter the following query to collect account information.

SELECT 
  DISTINCT users.USER_ID as accountName, 
  user_details.NAME as displayname, 
  user_details.EMPL_ID as employeeID, 
  user_details.LAST_PSWD_CHNG_DT as passwordChangeDate, 
  CASE WHEN user_details.DE_ACTIVATION_DT IS NULL 
    THEN 0 ELSE 1 
  END as isDisabled, 
  user_details.LAST_LOGIN_DT as lastLogin, 
  company.ORG_SEC_GRP_CD as company 
FROM 
  CPADMIN.W_USER_GRP_USERS users 
  JOIN CPADMIN.W_USER_UGRP_LIST user_details 
    ON users.USER_ID = user_details.SEC_OBJ_ID 
  JOIN CPADMIN.W_USER_COMPANY company 
    ON users.USER_ID = company.USER_ID‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

The following are the important attributes

select 
  CPADMIN.W_USER_GRP_USERS.USER_ID as accountName, 
  CPADMIN.W_USER_GRP_USERS.USER_ID as userID 
from 
  CPADMIN.W_USER_GRP_USERS‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

The following are the important attributes

SELECT 
  DISTINCT SEC_OBJ_ID as groupID, 
  NAME as groupName 
FROM 
  CPADMIN.W_USER_UGRP_LIST groups 
WHERE 
  TYPE = 'G'

The following are the important attributes

SELECT 
  groups.NAME as groupName, 
  groups.SEC_OBJ_ID as groupID, 
  users.USER_ID as accountName
FROM 
  CPADMIN.W_USER_GRP_USERS users 
  INNER JOIN CPADMIN.W_USER_UGRP_LIST groups 
    ON groups.SEC_OBJ_ID = users.SEC_OBJ_ID 
WHERE 
  groups.TYPE = 'G'

11. Click Next. In the User Resolution Rules, map the user to account
    
    
    
12. Click Next. In the Member Account Resolution Rules, map the account collector.
    
    
    
13. Click Finish. Use the Test function to make sure the configurations are accurate.

COL023

Application​

Steps

1. Login to RSA G&L console as System Administrator.
2. Navigate to Resources > Application.
3. Click on Create Application and select Other Application.
4. Enter the details as shown below.
   
   
5. Click Finish.

Account Collector​

This section explains the process for configuring an account collector for the Cherwell application. We will use the MySQL database collector for this purpose.

Steps

1. Login to RSA G&L console as System Administrator.
2. Navigate to Resources > Applications.
3. Click on Cherwell.
4. Navigate to Collectors tab and click on Create Account Collector. Enter the details as shown below.
   
   
   
5. Click Next and enter the database details. Use the Test Connection to make sure the connection details are accurate.
   
   
   
6. Click Next. Select the appropriate data that you intend to collect.
   
   
   
7. Click Next. On the Account Data page, enter the following query to collect account information.

SELECT
  -- Local accounts
  auth.StandardIdentifier as accountName, 
  auth.LastPasswordResetDT as lastPasswordSetDate, 
  auth.AccountLocked as isLocked 
FROM 
  dbo.TrebuchetAuth auth 
WHERE 
  auth.StandardIdentifier <> '' 
UNION 
SELECT
  -- Domain accounts
  CASE WHEN LEFT(auth.WindowsIdentifier, 7) = 'DOMAIN\\' 
  THEN REPLACE(auth.WindowsIdentifier,'DOMAIN\\','') 
  ELSE auth.WindowsIdentifier  
  END as accountName, 
  auth.LastPasswordResetDT as lastPasswordSetDate,
  auth.AccountLocked as isLocked
FROM 
  dbo.TrebuchetAuth auth
WHERE auth.StandardIdentifier <> ''

The following are the important attributes

8. Click Next. On the User Account Mappings Data configuration page enter the following query to map the Cherwell account to user identity.

SELECT
  -- Local accounts
  auth.StandardIdentifier as accountName, 
  auth.StandardIdentifier as userID
FROM 
  dbo.TrebuchetAuth auth 
WHERE 
  auth.StandardIdentifier <> '' 
UNION 
SELECT
  -- Domain accounts
  CASE WHEN LEFT(auth.WindowsIdentifier, 7) = 'DOMAIN\\' 
  THEN REPLACE(auth.WindowsIdentifier,'DOMAIN\\','') 
  ELSE auth.WindowsIdentifier  
  END as accountName,
  auth.StandardIdentifier as userID
FROM 
  dbo.TrebuchetAuth auth
WHERE auth.StandardIdentifier <> ''

The following are the important attributes

9. Click Next. In the Group Data configuration section enter the following query to collect groups from Cherwell.

SELECT 
  -- Local accounts
  auth.StandardIdentifier as accountName, 
  groups.DefName as groupName,
  groups.DefDescription as description,
  groups.DefOwner as owner
FROM 
  dbo.TrebuchetAuth auth,
  dbo.TrebuchetSecGroups groups
WHERE 
  auth.SecurityGroupID = groups.DefID 
  AND auth.StandardIdentifier <> '' 
UNION 
SELECT 
  -- Domain accounts
  CASE WHEN LEFT(auth.WindowsIdentifier, 7) = 'DOMAIN\\' 
  THEN REPLACE(auth.WindowsIdentifier,'DOMAIN\\','') 
  ELSE auth.WindowsIdentifier  
  END as accountName,
  groups.DefName as groupName,
  groups.DefDescription as description,
  groups.DefOwner as owner
FROM 
  dbo.TrebuchetAuth auth,
  dbo.TrebuchetSecGroups groups
WHERE auth.SecurityGroupID = groups.DefID
  AND auth.StandardIdentifier <> ''

The following are the important attributes

10. In the Account Membership Data configuration section enter the following query to collect groups membership information from Cherwell.

SELECT 
  -- Local accounts
  auth.StandardIdentifier as accountName, 
  groups.DefName as groupName
FROM 
  dbo.TrebuchetAuth auth,
  dbo.TrebuchetSecGroups groups
WHERE 
  auth.SecurityGroupID = groups.DefID 
  AND auth.StandardIdentifier <> '' 
UNION 
SELECT 
  -- Domain accounts
  CASE WHEN LEFT(auth.WindowsIdentifier, 7) = 'DOMAIN\\' 
  THEN REPLACE(auth.WindowsIdentifier,'DOMAIN\\','') 
  ELSE auth.WindowsIdentifier  
  END as accountName,
  groups.DefName as groupName
FROM 
  dbo.TrebuchetAuth auth,
  dbo.TrebuchetSecGroups groups
WHERE auth.SecurityGroupID = groups.DefID
  AND auth.StandardIdentifier <> ''

11. Click Next. In the User Resolution Rules, map the user to account
    
    
    
12. Click Next. In the Member Account Resolution Rules, map the account collector.
    
    
    
13. Click Next. In the Group Owner Resolution Rules, map the account collector.
    
    
    
14. Click Finish. Use the Test function to make sure the configurations are accurate.

Entitlement Collector​

This section explains the process for configuring an entitlement collector to collect application roles from Cherwell application.

Steps

1. Login to RSA G&L console as AveksaAdmin.
2. Navigate to Resources > Applications.
3. Click on Cherwell.
4. Navigate to Collectors tab and click on Create Entitlement Collector. Enter the details as shown below.
   
   
   
5. Click Next and enter the database connection details as shown in Step 5 of Account Collector.
6. Click Next. Select the data types that the collector will be collecting from Cherwell.
   
   
   
7. Click Next. On the Column Names, map the attribute names.
   
   
   
8. Click Next. Under Application Role Data section, use the following query to collect app roles from Cherwell.

SELECT 
  dbo.TrebuchetAuth.StandardIdentifier AS Identifier, 
  dbo.TrebuchetSecGroups.DefName 
FROM 
  [dbo].[TrebuchetAuth], 
  [dbo].[TrebuchetSecGroups] 
WHERE 
  dbo.TrebuchetAuth.SecurityGroupID = [dbo].[TrebuchetSecGroups].DefID 
  AND dbo.TrebuchetAuth.StandardIdentifier <> '' 
UNION 
SELECT 
  CASE WHEN left(dbo.TrebuchetAuth.WindowsIdentifier, 5) = 'dom1\\' 
    THEN replace(dbo.TrebuchetAuth.WindowsIdentifier,' dom1\ ','') 
    ELSE dbo.TrebuchetAuth.WindowsIdentifier 
  END AS Identifier, 
  dbo.TrebuchetSecGroups.DefName FROM [dbo].[TrebuchetAuth] ,[dbo].[TrebuchetSecGroups]
WHERE dbo.TrebuchetAuth.SecurityGroupID = [dbo].[TrebuchetSecGroups].DefID
AND dbo.TrebuchetAuth.WindowsIdentifier <> ''

The following are the important attributes

9. Click Next. Under Resource-Action Entitlements Data section, use the following query to collect resource action mapping from Cherwell.

SELECT 
  dbo.TrebuchetAuth.StandardIdentifier AS Identifier, 
  dbo.TrebuchetSecGroups.DefName 
FROM 
  [dbo].[TrebuchetAuth], 
  [dbo].[TrebuchetSecGroups] 
WHERE 
  dbo.TrebuchetAuth.SecurityGroupID = [dbo].[TrebuchetSecGroups].DefID 
  AND dbo.TrebuchetAuth.StandardIdentifier <> '' 
UNION 
SELECT 
  CASE WHEN left(dbo.TrebuchetAuth.WindowsIdentifier, 5) = 'dom1\\' 
    THEN replace(dbo.TrebuchetAuth.WindowsIdentifier,' dom1\ ','') 
    ELSE dbo.TrebuchetAuth.WindowsIdentifier 
  END AS Identifier, 
  dbo.TrebuchetSecGroups.DefName FROM [dbo].[TrebuchetAuth] ,[dbo].[TrebuchetSecGroups]
WHERE dbo.TrebuchetAuth.SecurityGroupID = [dbo].[TrebuchetSecGroups].DefID
AND dbo.TrebuchetAuth.WindowsIdentifier <> ''

10. Click Next. On the Account Data section, enter the query below to collect mappings for account to admin roles.

SELECT 
  dbo.TrebuchetAuth.StandardIdentifier AS Identifier, 
  dbo.TrebuchetSecGroups.DefName 
FROM 
  [dbo].[TrebuchetAuth], 
  [dbo].[TrebuchetSecGroups] 
WHERE 
  dbo.TrebuchetAuth.SecurityGroupID = [dbo].[TrebuchetSecGroups].DefID 
  AND dbo.TrebuchetAuth.StandardIdentifier <> '' 
UNION 
SELECT 
  CASE WHEN left(dbo.TrebuchetAuth.WindowsIdentifier,5) = 'dom1\\' 
    THEN replace(dbo.TrebuchetAuth.WindowsIdentifier,' dom1\ ','') 
    ELSE dbo.TrebuchetAuth.WindowsIdentifier 
  END AS Identifier, 
  dbo.TrebuchetSecGroups.DefName FROM [dbo].[TrebuchetAuth] ,[dbo].[TrebuchetSecGroups]
WHERE dbo.TrebuchetAuth.SecurityGroupID = [dbo].[TrebuchetSecGroups].DefID
AND dbo.TrebuchetAuth.WindowsIdentifier <> ''

11. Click Next. In the User Evaluation, map the account to the ADC.
    
    
    
12. Click Next and then click Finish. Use the Test function to make sure the configurations are accurate.

COL021

Application​

Steps

1. Login to RSA G&L console as System Administrator.
2. Navigate to Resources > Application.
3. Click on Create Application and select Other Application.
4. Enter the details as shown below.
   
   
5. Click Finish.

Identity Collector​

This section explains the process for configuring an identity collector for the Lawson application. We will use the Oracle database collector for this purpose.

Steps

1. Login to RSA G&L console as System Administrator.
2. Navigate to Resources > Applications.
3. Click on Lawson.
4. Navigate to Collectors tab and click on Create Identity Collector. Enter the details as shown below.
   
   
   
5. Click Next and enter the Oracle database details. Use the Test Connection to make sure the connection details are accurate.
   
   
   
6. Click Next.
7. Click Next. On the User Data configuration page, enter the following query to collect account information from Lawson

SELECT 
  TRIM(employee.FIRST_NAME) AS firstName, 
  TRIM(employee.LAST_NAME) AS lastName, 
  TRIM(employee.MIDDLE_INIT) AS middleInitial, 
  TRIM(employee.EMPLOYEE) AS employeeID, 
  TRIM(POS.DESCRIPTION) AS title, 
  TRIM(DPT.R_NAME) AS departmentName, 
  TRIM(employee.DEPARTMENT) AS departmentCode, 
  (
    CASE 
        WHEN employee.TERM_DATE = TO_DATE('01/01/1700', 'MM/DD/YYYY') 
        THEN ' ' ELSE TO_CHAR(employee.TERM_DATE, 'MM/DD/YYYY') END
  ) AS terminationDate, 
  TRIM(employee.NICK_NAME) AS preferredName, 
  TRIM(employee.JOB_CODE) AS jobCode, 
  TRIM(employee.POSITION) AS positionCode, 
  TRIM(employee.COMPANY) AS company, 
  TRIM(XR.BUS_UNIT_CD) AS location, 
  TRIM(BU.UNIT_CODE_DESC) AS locationDetails, 
  TRIM(employee.HM_ACCT_UNIT) AS homeAccountingUnit, 
  TRIM(employee.ADJ_HIRE_DATE) AS adjustedHireDate, 
  TRIM(employee.EMP_STATUS) AS jobStatus, 
  TRIM(employee.PROCESS_LEVEL) AS processLevel, 
  TO_CHAR(PA.BIRTHDATE, 'MM') AS dobMonth, 
  TO_CHAR(PA.BIRTHDATE, 'DD') AS dobDay, 
  employee.SUPERVISOR AS supervisorEmployeeID
FROM 
  EMPLOYEE employee 
  INNER JOIN PAEMPLOYEE PA ON employee.COMPANY = PA.COMPANY 
  AND employee.EMPLOYEE = PA.EMPLOYEE 
  LEFT OUTER JOIN HRSUPER SUP ON employee.COMPANY = SUP.COMPANY 
  AND employee.SUPERVISOR = SUP.CODE 
  LEFT OUTER JOIN PAPOSITION POS ON POS.COMPANY = employee.COMPANY 
  AND POS.POSITION = employee.POSITION 
  AND POS.END_DATE = TO_DATE('01/01/1700', 'MM/DD/YYYY') 
  LEFT JOIN ZIBUXREF XR ON XR.ACCT_UNIT = employee.HM_ACCT_UNIT 
  LEFT JOIN ZIBUSUNIT BU ON XR.BUS_UNIT_CD = BU.UNIT_CODE 
  LEFT JOIN DEPTCODE DPT ON employee.COMPANY = DPT.COMPANY 
  AND employee.PROCESS_LEVEL = DPT.PROCESS_LEVEL 
  AND employee.DEPARTMENT = DPT.DEPARTMENT