Question regarding IDM 7.2 SP8 reporting

[Former Member]

Hi, all.

I am doing some proof of concept on the reporting for IDM 7.2 SP8. I would like to have your input as I ran into a lot of problems:

1) Are we supposed to still use Jasper reports in IDM 7.2 SP8? The doc seems to be only for IDM 7.0 and 7.1.

2) How about crystal reports? But I don't see there is any out of the box Crystal reports like Jasper

3) I have installed the IDM BW contents. The ODS and infoobjects are populated with IDM data. However, I noticed the quality of those vanilla BW contents are very bad and there are 2 major issues I saw:

- Firstly, there is no BW content for approval reporting, only priviledge and role assignments. This is not going to impress anyone as the privilege and role assignment can be directly retrieved from the target systems.

- Secondly, the reporting is not hierarchical. That means, only direct assignement for a role/priviledge against a person is reported. I am still trying to go through the data in ODS object 0IDM_ENAT and the transformations to see if the hierarchy data has actually been captured in the extraction process. Not only that, if you run a report for a person/privilege relation, only the direct assignement of the privilege will show. The privilege from the role is NOT shown. That makes the out of the box infosets not usable and I have to customize my own BW infosets/infoobjects.

4) For the history tab on "management tasks" and "approvals", I can only see my own tasks. Is there a way to configure it so that I can see other people tasks? If that works, maybe we don't need the IDM reporting as it is rather disappointing so far. Also, on the approval history tab, I don't see any detail about the approval task like the below. Do you know how to show more detail?

Can you please share your experience on the IDM reporting?

Thanks,

Jonathan.

[Former Member · Accepted solution]

Hi, Norman

Thank you for your reply. We don't have access to the RDS package. I heard that it is not free. Are the HTML reports connecting directly to the IDM database to extract the data? Do they provide reporting on the IDM approval data? How are the HTML reports compare to the BW ones? My management is not expecting to whip out more $$ on the IDM product.

Regards

Jonathan.

[terovirta · Accepted solution]

Jonathan,

take a look towards the end of the link below and the HTML-output section, that shows how you can write HTML-file to the disk in a job:

If you want to display reports within IdM UI, that's possible with the MX_REPORT entry type, you need to generate HTML and store the data to Id Store as MX_REPORT.

Write a script that queries the data and formats it as HTML, create the MX_REPORT entry in script and assign the report data and few other values to report's attributes and you should see the report in the Reports-tab in IdM UI.

Something along these lines..

var reportName = [NAME_OF_YOUR_REPORT]
var reportData = [YOUR_REPORT_DATA]
var reportOwner = [MSKEYS_OF_USERS_WHO_CAN_SEE_THE_REPORT]

var idStoreId = "%$glb.SAP_MASTER_IDS_ID%";

var reportMskey = uIS_Create (idStoreId, reportName);

uIS_SetValue (reportMskey, idStoreId, "MX_ENTRYTYPE", "MX_REPORT");
uIS_SetValue (reportMskey, idStoreId, "DISPLAYNAME", reportName);
uIS_SetValue (reportMskey, idStoreId, "MX_REPORT_FORMAT", "HTML");
uIS_SetValue (reportMskey, idStoreId, "MX_REPORT_RESULT", uToHex (reportData));
uIS_SetValue (reportMskey, idStoreId, "MX_REPORT_DATE", "%$ddm.date8601%");
uIS_SetValue (reportMskey, idStoreId, "MX_OWNER", reportOwner);

The IdM UI is bit awkward in reporting as you need to select always an entry type to pop-up the UI task in the first place. Also the fact that you will submit the report UI-task and see the report a little later on another tab.

regards, Tero

[Former Member]

Hi, Chris

Thanks for your feedback. I know SAP is beating the drums using BW for IDM reporting.

However, the IDM BW contents, especially the extractors, are so poorly put together that the data presented in the infosets are wrong to begin with! For example, if you remove a role and add a new role to a user, the BW delta extract will show the new role but it does not put an indicator that the old role is removed in the infoset. I opened up a ticket in service marketplace and no reply after 3 weeks! Also, there is no reporting on approval and no merging of the infosets for role and priviledge. So we would have to create our own extractors and infosets/infocubes.

So far I found what Tero's blog is way better than what SAP delivers. Please advise if you got BW working for you. Maybe I am missing something as I am new to IDM.

Thanks,

Jonathan.

[ChrisPS]

Hi,

    It is recommended to use SAP BW for reporting. The latest release notes for IdM 7.2 SP9 details
that Crystal Reports will no longer be supported (however existiing configuration prior to SP9
will still be supported)

SAP NetWeaver Identity Management 7.2 SP9 - SAP NetWeaver Identity Management Library - SAP Library

Thanks,

Chris

[normann]

Hi Jonathan,

did you consider using HTML reports? Did you have a look at the RDS package (which is providing other useful content you could use in your PoC as well)?

You can take HTML reports from RDS and adapt them to customer needs without too much effort.

Thanks

Norman

[Former Member]

Sorry, another question: is there a way to change the columns reported from the history tab? For example, instead of display name, can you show the mskeyvalue instead?

Thanks,

Jonathan.