This software allows you to simplify the management of identity, as it can help you synchronize data across multiple resources. Each organization can maintain control of accounts within their respective domains.

OpenIDM works equally well with user, group, and device identities.

You can also configure workflows to help users manage how they sign up for accounts, as part of how OpenIDM manages the life cycle of users and their accounts.

You can manage employee identities as they move from job to job. You will make their lives easier as their user accounts can be registered on different systems automatically. Later, OpenIDM can increase productivity when it reconciles information from different accounts, saving users the hassle of entering the same information on different systems.

In this guide, you will see how OpenIDM reconciles user data between two data stores. We will look at a department that is adding a third engineer, Jane Sanchez.

Your Human Resources department has updated their data store with Jane Sanchez's information. You want to use OpenIDM to update the internal Engineering data store. But first, you have to start OpenIDM.

This section covers what you need to have on your system before running OpenIDM:

We provide this Getting Started document for demonstration purposes only.

With this document, we want to make it as easy as possible to set up a demonstration of OpenIDM software. To that end, we have written this document for installations on a desktop operating system, Microsoft Windows 7.

For a list of software that we support in production, see "Before You Install" in the Release Notes.

When the server is ready, you can administer it from a web browser. To do so, navigate to http://localhost:8080/admin or https://localhost:8443/admin. If you have installed the server on a remote system, substitute that hostname or IP address for localhost.

Starting OpenIDM in Microsoft Windows

The default username and password for the OpenIDM Administrator is openidm-admin and openidm-admin.

When you log into OpenIDM at a URL with the /admin endpoint, you are logging into the Administrative User Interface, also known as the Admin UI.

All users, including openidm-admin, can change their password through the Self-Service UI, at http://localhost:8080/ or https://localhost:8443/. Once logged in, click Profile > Password.

In a production deployment, you are likely to see resources like Active Directory and OpenDJ. But the setup requirements for each are extensive, and beyond the scope of this document.

For simplicity, this guide uses two static files as data stores:

You can find these files in the binary package that you downloaded earlier, in the following subdirectory: openidm/samples/getting-started/data.

A central feature of OpenIDM is reconciliation - comparing the contents of two data stores and deciding what to do, depending on the differences.

This scenario is based on two data files:

Reconciliation modifies the Engineering data store by adding the newly hired Jane Sanchez. As suggested by the following illustration, it will also address detailed differences between Jane's Human Resources account and the Engineering data store.

Data Stores Can Have Different Categories of Data

OpenIDM includes configuration files that map detailed information from the Human Resources data store to the Engineering data store. For example, the OpenIDM configuration maps the firstName entry in Human Resources to the firstname entry in Engineering.

In the Admin UI, you can see how OpenIDM reconciles the different categories for user Jane Sanchez. Log in to the Admin UI at https://localhost:8443/admin. The default username is openidm-admin and default password is openidm-admin.

Select Configure > Mappings > HumanResources_Engineering > Properties.

In the Sample Source text box, enter Sanchez. You should see a drop-down entry for Jane Sanchez that you can select. You should now see how OpenIDM would reconcile Jane Sanchez's entry in the Human Resources data store into the Engineering data store.

Reconciling Differences for an Account

Scroll back up the same page. Select Reconcile Now.

When you reconcile the two data stores, OpenIDM will make the change to the Engineering data store.

For those of you who prefer the command-line interface, you can see how the mapping works in the sync.json file, in the /path/to/openidm/samples/getting-started/conf directory.

Now that you have used OpenIDM to reconcile two data stores, try something else. Assume the Engineering organization wants to overwrite all user telephone numbers in its employee data store with one central telephone number.

For this purpose, you can set up a default telephone number for the next reconciliation.

In the HumanResources_Engineering page, scroll down and select telephoneNumber > Default Values.

Set A New Default Telephone Number

When you select Update, and Save Properties, OpenIDM changes the sync.json configuration file. The next time OpenIDM reconciles from Human Resources to Engineering, it will include that default telephone number for all employees in the Engineering group.

A business process begins with an objective and includes a well-defined sequence of tasks to meet that objective. In OpenIDM, you can configure many of these tasks as self-service workflows, such as self-registration, new user onboarding, and account certification.

With OpenIDM, you can automate many of these tasks as a workflow.

Once you configure the right workflows, a newly hired engineer can log into OpenIDM and request access to manufacturing information.

That request is sent to the appropriate manager for approval. Once approved, the OpenIDM provisions the new engineer with access to manufacturing.

OpenIDM supports workflow-driven provisioning activities, based on the embedded Activiti Process Engine, which complies with the Business Process Model and Notation 2.0 (BPMN 2.0) standard.

Additional workflows are provided, such as new user onboarding, orphan account detection, and password change reminders. For more information, see "Workflow Samples" in the Samples Guide.

You can manage passwords from the Self-Service User Interface, also known as the Self-Service UI. From the Admin UI, click on the icon in the upper-right corner. In the menu that appears, click Self-Service:

Access the Self-Service User Interface

You should now be in the Self-Service UI. Click Profile > Password. You can now change your password, subject to the policy limits shown.

Changing Your Password

As you can see, OpenIDM supports a robust password policy. You can modify the rules shown, or add more rules such as the following:

For more information, see "Managing Passwords" in the Integrator's Guide.

Some users need accounts on multiple systems. For example, insurance agents may also have insurance policies with the company that they work for. In that situation, the insurance agent is also a customer of the company.

Alternatively, a salesperson may also test customer engineering scenarios. That salesperson may also need access to engineering systems.

In OpenIDM, each of these user scenarios is known as a role. OpenIDM allows you to set up a consolidated set of attributes associated with each role. To do so, you would configure custom roles to assign to selected users. For example, you may assign both insured and agent roles to an agent, while assigning the insured role to all customers.

In a similar fashion, OpenIDM allows you to assign both sales and engineering roles to the sales engineer.

You can then synchronize users with those roles into appropriate data stores.

For more information, see "Working With Managed Roles" in the Integrator's Guide. For a sample of how you can configure external roles within OpenIDM, see "Demonstrating the Roles Implementation" in the Samples Guide.

You can use OpenIDM to connect to a substantial variety of user and device data stores, on premise and in the cloud. While OpenIDM can connect to some connectors dedicated to a few data stores, OpenIDM can also connect to many more data stores using a scripted connector framework.

If the resource that you need is not on the list, you should be able to use one of the OpenIDM scripted connector frameworks to connect to that resource:

OpenIDM supports reconciliation between two data stores, as a source and a target.

In identity management, reconciliation compares the contents of objects in different data stores, and makes decisions based on configurable policies.

For example, if you have an application that maintains its own user store, OpenIDM can ensure your canonical directory attributes are kept up to date by reconciling their values as they are changed.

For more information, see "Synchronizing Data Between Resources" in the Integrator's Guide.

OpenIDM has access to several different authentication modules that can help you protect your systems. For more information, see "Supported Authentication and Session Modules" in the Integrator's Guide.

OpenIDM is a lightweight and highly customizable identity management product.

The OpenIDM documentation includes additional use cases. Most of them are known as Samples, and are described in "Overview of the Samples" in the Samples Guide.

These samples include step-by-step instructions on how you can connect to different data stores, customize product behavior using JavaScript and Groovy, and administer OpenIDM with ForgeRock's commons RESTful API commands.

Now that you have seen how OpenIDM can help you manage users, review the features that OpenIDM can bring to your organization:

Follow these steps to stop and remove OpenIDM.

We hope that you want to continue exploring OpenIDM.

To do so, review the documentation available on ForgeRock's BackStage site.