Identity Governance Reporting Guide

1. Select the name of the report definition in the list on the Repository page.

   Mouse over the report definition name and click Edit. When you edit a report definition, a page opens to allow you to make changes to the definition.

   The fields at the top of the page allow you to modify the name, description, tags, comments, and output format (PDF, Complex CSV, or CSV Data Table) for the report. Use tags to organize reports according to common words or phrases that suggest how the reports are related. Tag names share a common namespace for all users, so specify tag names that make sense for all users. Tag names cannot be localized.

   You can specify one or more tags for a report definition. If you specify multiple tags, separate them with commas. Defined tags are shown in the list displayed on the Repository page, and in the Detail dialog box for a report listed on the Completed and Running Reports page. In the list displayed on the Repository page, the tags are alphabetized to allow for sorting.

   NOTE:The next time you edit the report definition, the tags appear in alphabetical order, regardless of how they were originally entered. The tags are also alphabetized in the Repository list, even if you did not alphabetize them when you first entered them.

   The other fields on the page are organized into the following sections:

   • Criteria

   • Default Notifications

   • Schedule

2. To edit the criteria for the report, open the Criteria section and make changes as necessary. The Criteria section does not appear unless the imported definition included one or more report parameters.

   The number of fields displayed in the Criteria section and the way these fields behave depend on how they were specified in the original report definition object imported into Identity Reporting.

   Identity Reporting supports the following data types for criteria fields:

   • String

   • String with Options

   • Date

   • Integer

   • Boolean

   • Lookup

   The control displayed for each data type varies depending on how the parameter is defined in the report definition. For multivalued options, a multiselect control is displayed, but a single value control is displayed for a parameter that accepts only a single value.

   Some criteria fields are required by the report definition, but others are optional. If you do not provide a value for a required field, the user interface displays an error message.

   The criteria parameters in the following table are available with most of the reports installed with Identity Reporting.

   Table 2 Report Definition Parameters

   Parameter	Description
   Data Source	Defines the data source on which you want to report. This parameter is required for all reports. To run a report on multiple data sources, edit the report, select the desired data source when you define the report criteria, and then save as a new report. For a data source to be available for reports, you must first add it on the Data Sources page. For more information, see Using the Data Sources Page.
   Language	Defines the target language for the report.
   Date Range	Allows you to define a range of dates for the data included in the report. The following choices are available: Current Day Previous Day Week to Date Previous Week Month to Date Previous Month Custom Date Range
   From Date	Allows you to specify a fixed start date for the report data. This parameter is enabled only if you selected Custom Data Range for the Data Range parameter.
   To Date	Allows you to specify a fixed end date for the report data. This parameter is enabled only if you selected Custom Data Range for the Data Range parameter.
   Limit Results To	Limits the record types relevant to the report or sections within the report.
   Time Zone	Allows you to specify the time zone to which date/time information returned in the report will be oriented.

   If a report definition includes one or more fields for defining dates, such as Date Range, From Date, and To Date, be aware that the date range you specify affects the data returned with the report, not the dates on which the report is run. Therefore, if a report is run monthly, do not define a custom date range that fixes the dates in the From Date and To Date fields. It does not make sense for a monthly scheduled report to report on a fixed date range (such as 3/10/2010 - 3/17/2010). To report on a fixed date range, schedule the report to run only once. For a monthly report, use one of the relative date range settings included in the Date Range field, such as Month to Date. This ensures that the data in the report is updated each month.

   Some criteria fields support automatic completion, which allows you to type several characters and then select an item from a list of possible choices. For example, the user(s) field might allow you to type the first few characters of a user’s name and then select the user from a list of users whose names contain the characters you have typed.

3. To edit the email settings associated with the report definition, open the Default Notifications section and make changes as necessary.

4. To add a new schedule for the report definition, click the + button on the left side of the Schedule section.

   1. Provide a name for the schedule in the Schedule Name field. The name for a schedule must be unique within the report definition, but does not need to be unique within Identity Reporting as a whole.

   2. (Conditional) If you want the name of the report definition to be added to the beginning of the schedule name, click Prepend Report Definition Name. This option allows you to see which report has been scheduled with each schedule instance in the Calendar page. This option is enabled by default.

   3. Click in the Date range field or select the calendar control to display calendar for selecting dates.

   4. Select the date in the left calendar on which you want to initiate the first run of the report.

   5. Select the approximate start time of day for each run. The time of day is based on the clock on the server where the report is executed. The actual execution time depends on server activity.

   6. Select the date in the right calendar after which no more runs should occur. Note that the last report run may not actually occur on this date. For example, if you select October 15 as the start date, and specify a repeat interval of two weeks and an end date of November 1, the report will be run on October 15 and October 29. In this case, October 29 is the last run. The report runs at its scheduled time, regardless of whether the data collection completed successfully.

   7. Select the approximate end time of day for each run.

   8. Select Apply.

   9. In the Frequency field, type the repeat interval (a number that specifies how often the report will run) and select the time period for report runs, such as Month(s), Week(s), or Day(s).

   10. Use the default notifications or deselect Use default notifications and enter emails, subject, and a custom message.

5. (Conditional) To save the report definition and schedule, click Save or click Save As to distinguish it from the default report.

6. (Conditional) To queue a report to run immediately, click Run Now.

7. (Optional) To edit an existing schedule, see Editing a Schedule Instance.

1. Click the check box to the left of each report definition you want to run or delete.

2. In the Bulk Actions drop-down list, click Run Now or Delete.

3. Click Apply.

1. On the Calendar page, click Edit under the schedule name.

   Identity Reporting displays a page that lets you edit the report definition and schedule. In addition, you can create a new schedule from the editing page.

   The report definition has a one-to-many relationship with schedules. This means that a report definition can have one or more schedules, but a schedule can only be associated with a single report definition.

2. To edit the settings for the schedule, scroll down to the Schedule section of the page and open the section for the scheduled run you want to edit.

3. Make changes as necessary to the scheduled run. The following table describes the schedule properties you can change.

   Table 4 Schedule Properties

   Schedule Property	Description
   From date	Specifies the date in the calendar on which you want to initiate the first run of the report. This property also determines the date for all subsequent runs. You can change the start date for a schedule after it has been created, even if the calendar already includes one or more scheduled runs. If you change the start date for a schedule, all of the runs for that schedule shift to the new date.
   Time of day	Specifies the approximate time of day for each report run. The time of day is based on the clock on the server where the report is executed. The actual execution time depends on server activity. The run time specified for each schedule instance is set to the hour or the half hour - for example, 1:00 AM or 1:30 PM. You can change the time of day for a schedule after it has been created. If you change the time of day, all of the runs for that schedule execute at the new time.
   Frequency	Specifies the repeat interval (a number that specifies how often the report will run) and the time period for report runs: Month(s), Week(s), or Day(s). You cannot modify the frequency for a schedule after the schedule has been created.
   To date	Specifies the date in the calendar after which no more runs should occur. Note that the last report run may not actually occur on this date. For example, if you choose October 15 as the start date, and specify a repeat interval of two weeks and an end date of November 1, the report will run on October 15 and October 29. In this case, October 29 is the last run. You can change the end date for a schedule after it has been created.
   Use default notifications	Specifies the email settings associated with the schedule instance.

4. Click Save.

To move a single schedule instance to a new date:

1. Select the schedule instance you want to move and drag it to the desired date.

2. Click Move This.

To move all of the scheduled runs for a schedule:

1. Select the schedule instance you want to move and drag it to the desired date.

2. Click Move All.

   The Calendar page shifts all of the scheduled runs to align with the new run date.

1. Click the Details link below the report for which you want to see the details. If the report definition includes one or more parameters, a Criteria section is added to the page that shows the parameters. The fields shown in the pop-up window are not editable, because the report has already been submitted to be run.

   The Run By user is the logged-in user who creates a schedule or clicks Run Now. For example, if the user cblack creates a schedule, and then mmackenzie logs in and modifies the schedule, the Run By user is still the original creator, cblack. If mmackenzie moves the item by clicking Move This, thereby creating a new schedule, mmackenzie is the creator for the report generated by that one-off schedule.

2. If the report has completed processing, you can download the generated report from this window by clicking the Download link next to the status icon at the top of the window. This link is not available if the report is still in progress or has failed.

3. To return to the report list, click the Close icon. You can continue to work outside the window while it is still open.

1. Select the check box to the left of each report definition you want to delete.

2. In the Bulk Actions list, click the Delete operation.

3. Click Apply.

1. Type a search string in the Search text field, which is designated by the magnifying glass at the top right of the page.

   The search facility allows you to pass in search strings for any of the items in the following table.

   Table 5 Report Search Filters

   Filter Value	Description
   Name	Performs a CONTAINS search. The search is case-insensitive, and it uses the locale of the user.
   Description	Performs a CONTAINS search. The search is case-insensitive, and it uses the locale of the user.
   Tags	Performs an exact string search. The search is case-insensitive. You need to pass in only a single tag.
   Run By	Performs a search on the first name and last name of the creator of the schedule. The creator is the logged-in user who creates a schedule or clicks Run Now. For example, if the user cblack creates a schedule, then mmackenzie logs in and modifies the schedule, the Run By user is still the original creator, cblack. If mmackenzie moves the item by clicking Move This, thereby creating a new schedule, mmackenzie is the creator for the report generated by that one-off schedule.

   You can enter one or more words in the Search field, with or without quotes:

   • If you enter multiple words without quotes, the search results include reports that contain all of the words anywhere in the Name or Description, or that have all of the words as tags (that match exactly).

     For example, suppose you enter the following:

     chris black

     In this case, the following report definitions are in the results:

     • Reports with a Name containing the words chris and black anywhere in the string

     • Reports with a Description containing the words chris and black anywhere in the string

     • Reports with Tags having chris and black as exact tags

     • Reports with Run By having a first name or last name of chris and last name or first name of black

   • If you enter multiple words surrounded by double quotes, the search results include reports that include the entire phrase anywhere in the Name or Description, or that have a tag that matches the entire phrase.

     For example, suppose you enter the following:

     "margo mackenzie"

     In this case, the following report definitions are in the results:

     • Reports with Name containing the phrase margo mackenzie

     • Reports with Description containing the phrase margo mackenzie

     • Reports with a Tag that exactly matches margo mackenzie

     • Reports with Run By having margo mackenzie as the first name and last name or last name and first name

2. Press Enter key on your keyboard.

To create and configure the proper global configuration properties for your data store type and for the SSL type:

1. Log in as a Global Administrator.

2. In Identity Governance, select Configuration > Advanced.

3. Next to Global Configuration Settings, click the plus sign (+).

4. Type the name of the configuration property you want to create, then click Add.

5. Type the value for the configuration property you want to create, then click Create.

6. Perform Step 3 through Step 5 for each property you need to create.

To create a data source:

1. In Identity Reporting, click Data Sources in the top navigation menu.

2. Click the plus sign (+) to add a new data source.

3. Select the appropriate method for connecting to the data source.

4. (Conditional) If you are adding a predefined data source, select the source from the list.

5. (Conditional) If you are defining a new data source, provide the following information for connecting to the data source:

   • The name of the data source

   • The database platform

   • The host - DNS name or IP address of the computer that hosts the data source

   • Whether to use SSL to connect to the data source

   • The port the database is listening on

   • The name of the database. For Oracle this will be the SID/ServiceName.

   • The user name and password for the data source user account. As a best practice for Identity Governance reports, use the igrptuser account.

6. (Optional) To test whether Identity Reporting can connect to the data source, click Test Connection.

   NOTE:A successful connection is not required to add the data source. It is possible to come back and test the connection at a later time.

7. Click the Save icon.

To modify a data source:

1. Click Data Sources in the top navigation menu.

2. Click the data source name, then modify the information.

To remove a data source:

1. Click Data Sources in the top navigation menu.

2. Click the delete icon next to the data source you want to remove.

To enable and configure auditing:

1. (Conditional) If you enabled auditing during the installation, proceed to Step 3.

2. (Conditional) If you want to enable auditing after the installation, complete the following steps:

   1. Create an audit directory to store the audit information.

      • Linux: /opt/netiq/idm/apps/audit

      • Windows: C:\netiq\idm\apps\audit

   2. Create the Identity Reporting log file.

      • Linux: ../tomcat/conf/idmrptcore_logging.xml

      • Windows: C:\netiq\idm\apps\tomcat\conf\idmrptcore_logging.xml

   3. (Linux only) Assign ownership to the audit directory.

      chown -R novlua.users /opt/netiq/idm/apps/audit

      NOTE:The novlua.users is the same ownership as the tomcat directory. It allows the Tomcat service to modify files within the audit logs directory.

3. Modify the Identity Governance logging file to enter the syslog server information.

   1. Open the logging file in a text editor.

      • Linux: /opt/netiq/idm/apps/tomcat/conf/idmrptcore_logging.xml

      • Windows: C:\netiq\idm\apps\tomcat\conf\idmrptcore_logging.xml

   2. Make the following changes specific for your syslog server:

      <enabled>${com.netiq.ism.audit.cef.enabled:true/false}</enabled>
      <protocol>${com.netiq.ism.audit.cef.protocol:TCP/TLS}</protocol>
      <host>${com.netiq.ism.audit.cef.host:123.456.78.90}</host>
      <port>${com.netiq.ism.audit.cef.port:6514}</port>
      <cache-dir>${com.netiq.ism.audit.cef.cache-file-dir:/opt/netiq/idm/apps/audit}</cache-dir>
      <cache-file>idm-rpt.txt</cache-file>
      <application>Reporting Core</application>
      <vendor>Micro Focus</vendor>
      <version>6.6.0</version>

      NOTE:To disable auditing, ensure that the <enabled> line is set to false. For example:

      <enabled>false</enabled>

4. (Conditional) If you are using TLS, add the certificate (public key) for the syslog server (at the provided port) to the Identity Governance and Identity Reporting trusted certificates files.

5. Restart Tomcat. For more information, see the User Guide on the Identity Governance documentation website.