mirror of
https://github.com/gravitational/teleport.git
synced 2026-10-12 02:15:01 +00:00
Paul Gottschling
007a9be195
Continues the work from the previous batch (#67674). We are standardizing docs guides to add a `page_type` frontmatter field, with values for how-to guides, references, etc. We can then use this field to apply linting rules that ensure each guide type follows type-specific docs site conventions. The first convention is that each docs page must have an outcome statement, the structure of which depends on the guide's type. Human and AI agent readers can determine from the outcome statement whether to continue reading the guide or not. This change assigns the `page_type` frontmatter field to 46 guides. Where an outcome statement is missing, it adds one. Where an outcome statement exists, it ensures that the statement matches the standard structure so we can add a linter later on. Of the 46 guides: - 12 guides already included the expected outcome statement, but needed a `page_type` frontmatter field. - 19 guides included an outcome statement but required minor tweaks so they followed the expected structure. - 15 guides had no outcome statement at all.
151 lines
5.1 KiB
Plaintext
151 lines
5.1 KiB
Plaintext
---
|
||
title: Discover NetIQ Access Patterns with Teleport Identity Security
|
||
sidebar_label: NetIQ
|
||
description: Describes how to synchronize OpenText NetIQ access patterns using Identity Security.
|
||
tags:
|
||
- how-to
|
||
- identity-security
|
||
- access-risks
|
||
enterprise: Identity Security
|
||
page_type: how-to
|
||
---
|
||
|
||
Gain insights into your NetIQ organization
|
||
structure, the resources each user can access, and the roles that grant them access using Identity Security with Access Graph.
|
||
Access Graph provides a visual representation that enhances security and improves
|
||
understanding of large NetIQ organizations.
|
||
|
||
Access Graph helps answer key questions such as:
|
||
|
||
- **Which resources does each user have access to?**
|
||
- **Which roles grant access to specific resources?**
|
||
|
||
Access Graph is a feature of the [Identity Security](https://goteleport.com/platform/identity-security/) product, available to **Teleport Enterprise edition** customers.
|
||
|
||
If enabled, Identity Security options can be found under the **Policy** section in the left navigation menu.
|
||
|
||
In this guide, you will set up the NetIQ integration with Teleport Access Graph
|
||
and analyze NetIQ access patterns.
|
||
|
||
## How it works
|
||
|
||
Access Graph synchronizes various NetIQ resources, including users, resources, roles, and groups.
|
||
These resources are then visualized in a graph representation, detailed in the
|
||
[Access Graph page](../identity-security.mdx).
|
||
|
||
The import process involves two primary steps:
|
||
|
||
### Querying NetIQ APIs
|
||
|
||
The Teleport cluster continuously scans the configured NetIQ organization and retrieves the
|
||
following resources:
|
||
|
||
- Users
|
||
- Groups
|
||
- Resources
|
||
- Roles (Business, Permissions, and IT Roles)
|
||
- Role and Group memberships
|
||
|
||
Once all necessary resources are fetched, Teleport pushes them to the Access Graph,
|
||
ensuring it remains updated with the latest information from your NetIQ organization.
|
||
|
||
### Importing resources
|
||
|
||
Identity Security’s Access Graph processes the imported resources
|
||
and their relationships, generating a graphical representation
|
||
to visualize access structures effectively.
|
||
|
||
|
||
## Prerequisites
|
||
|
||
- A running Teleport Enterprise cluster v17.2.4 or later.
|
||
- Identity Security enabled for your account.
|
||
- An OpenText NetIQ instance with a user that has read access to the organization.
|
||
- For self-hosted clusters:
|
||
- Ensure that an up-to-date `license.pem` is used in the Auth Service configuration.
|
||
- A running Access Graph node v1.27.0 or later.
|
||
Check the [Identity Security page](../identity-security.mdx) for details on
|
||
how to set up Access Graph.
|
||
- The node running the Access Graph service must be reachable from the Teleport Auth Service.
|
||
|
||
## Step 1/2. Create NetIQ IDM OAuth Client
|
||
|
||
To register a new OAuth client with OSP (IDM Authorization Server), modify the OSP's
|
||
`ism-configuration.properties` file.
|
||
|
||
The file is located in the `{osp-path}/tomcat/conf/` directory.
|
||
|
||
Define the following values:
|
||
|
||
- **ClientID**: <Var name="client-id" />
|
||
- **Client Secret**: <Var name="client-secret" />.
|
||
|
||
Users can store the OAuth Client Secret in the OSP `ism-configuration.properties`
|
||
file either in an encrypted or plaintext format.
|
||
For enhanced security, we strongly recommend encrypting the secret.
|
||
|
||
<Tabs>
|
||
<TabItem label="Encrypted secret" >
|
||
|
||
To store the client secret in an encrypted format, run:
|
||
|
||
```code
|
||
$ java -jar /opt/netiq/idm/apps/tomcat/lib/obscurity-*jar <Var name="client-secret" />
|
||
```
|
||
|
||
This command will generate an encrypted value:
|
||
|
||
```code
|
||
InSKM1mSmpWfjPk6etI/...
|
||
```
|
||
|
||
Then, update `ism-configuration.properties` by adding the following, assigning
|
||
<Var name="InSKM1mSmpWfjPk6etI/...." /> to your client password:
|
||
|
||
```code
|
||
com.example.<Var name="client-id" />.clientID = <Var name="client-id" />
|
||
com.example.<Var name="client-id" />.clientPass._attr_obscurity = ENCRYPT
|
||
com.example.<Var name="client-id" />.clientPass = <Var name="InSKM1mSmpWfjPk6etI/...." />
|
||
```
|
||
|
||
</TabItem>
|
||
<TabItem label="Plaintext secret" >
|
||
|
||
For plaintext storage, update `ism-configuration.properties` with:
|
||
|
||
```code
|
||
com.example.<Var name="client-id" />.clientID = <Var name="client-id" />
|
||
com.example.<Var name="client-id" />.clientPass = <Var name="client-secret" />
|
||
```
|
||
|
||
</TabItem>
|
||
</Tabs>
|
||
|
||
Once the file is updated, restart OSP to apply the new settings.
|
||
|
||
## Step 2/2. Set up Access Graph NetIQ Sync
|
||
|
||
To configure NetIQ Sync, run the following command:
|
||
|
||
```code
|
||
$ tctl plugins install netiq
|
||
```
|
||
|
||
The wizard will prompt for:
|
||
|
||
- **IDM OSP address** – Typically `https://idm.example.com/osp` or `https://osp.idm.example.com`
|
||
- **IDM API address** – Typically `https://idm.example.com/IDMProv` or `https://idmapps.idm.example.com`
|
||
- **OSP OAuth Client & Secret** – Values configured in **Step 1**
|
||
- **IDM User & Password** – A user with organization read access
|
||
|
||
After completing the setup, the wizard will create the necessary
|
||
Teleport resources and start synchronization.
|
||
|
||
## Next step: visualize NetIQ resources
|
||
|
||
Once NetIQ resources are imported, you can navigate to the Access Graph page to visualize them.
|
||
|
||
From the Teleport Web UI, visit **Identity Security** > **Graph Explorer**.
|
||
|
||
The graph representation will display the relationships between users, groups, roles and resources within your organization.
|