CA Identity Manager Implementation Guide - CA Technologies

Identity Manager ComponentsUser Store and Provisioning DirectoryTo provide options for managing users and automatic provisioning of additionalaccounts for those users, CA Identity Manager coordinates two user stores:■The Identity Manager user store, the user store maintained by CA IdentityManager. Typically, this is an existing store that contains the user identitiesthat a company needs to manage.The user store can be an LDAP directory or a relational database.In the Management Console, you create an Identity Manager Directoryobject to connect to the user store and to describe the user store objects thatCA Identity Manager will maintain.■The Provisioning Directory, the user store maintained by the ProvisioningServer.Separate User Store and Provisioning DirectoriesIt is an instance of CA Directory and includes global users, which associateusers in the Provisioning Directory with accounts on endpoints such asMicrosoft Exchange, Active Directory, and SAP.Only some CA Identity Manager users have a corresponding global user.When a CA Identity Manager user receives a provisioning role, theProvisioning Server creates a global user.The following figure shows a separate user store and Provisioning Directory. Inthis figure:■A CA Identity Manager administrator uses an admin task that edits a user inthe user store, which affects the Provisioning Directory.This change may also update an endpoint (such as an email server) whichhas a connector to the Provisioning Server.■A change made in the Provisioning Server (or an endpoint with a connectorto the Provisioning Server) updates the Identity Manager user store andProvisioning Directory.32 Implementation Guide