OpenText Identity Manager Reviews

We use this solution for Directory and Password Synchronization, as well as SQL updating for ERP.

Has facilitated the synchronization from eDirectory to AD and helped with Automating some SQL tasks.

The most valuable features are Password Reset Alerts, Password Sync, and SQL connectors.

The interface is old and outdated, and the design software seems archaic.

We provision accounts and access through NetIQ. Lifecycle events are triggered by our HCM system which feeds Identity Manager. Identity Manager then feeds other downstream systems such as Active Directory and ServiceNow. We also have NAM (Novell Access Manager) for single sign-on but I did not include that in this review as it is a separate product.

We learned a lot about what not to do when we implement our next solution. We were implementing an HCM solution at nearly the same time as NetIQ so that was definitely something I would not recommend doing if at all possible.

The identity vault, password syncing and self service Password Reset. As seen in another review, I will concur that NetIQ does a good job with password syncing among directories.

Be more honest about how poorly it runs on Windows servers. It is optimized for Linux. Just because you can install and run it on Windows doesn’t mean you should, at all. It is a recipe for disaster.

Yes, it does not run well on Windows servers. It is meant to run on a Linux platform.

Yes, it does not scale well and licensing is very expensive. Again, does not run well on Windows so upgrades were a nightmare.

Very poor. We ended up having to contract for support from two other service providers since NetIQ’s support was so poor.

This was our first IAM solution.

Very complex. Again, it does not run very well on Windows and we required a lot of customization to meet our business objectives.

A vendor team helped us through our implementation from Deloitte & Touche Consulting. I wasn't quite as involved with the implementation but have been supporting the solution for about 4 years now so I can't speak to their level of expertise.

Very expensive licensing. Definitely review support and licensing contracts with an attorney to get language less ambiguous and redline accordingly.

We did. We evaluated CA, IBM, Novell (now NetIQ) & Oracle.

Get executive buy-in and know that a tool isn’t going to fix bad processes.

Its reliability when it comes to synchronizing directories is the most valuable feature. It is very safe to be based on events.

For many years we had Novell eDirectory as the main directory, to which was added LDAP, AS400, Active Directory, Google, and SAP.

The greater strength was to keep the identities synchronized without failures in both attributes and passwords. The provisioning of identities at reasonable times greatly reduces the time of a new user's registration.

The Operations and Information Security.

We have been using this solution for 15 years, i.e., since its inception and the time it was called Novell NDS for NT.

There were no stability issues, IDM is one of Novell's most stable products. Errors are human, just be careful in its use.

There were no scalability issues. In fact, we have incorporated many users by acquisitions and it is safe to climb; your performance does not degrade.

Technical support is very good, but in my country the ecosystem of consultants is scarce. In Argentina, in addition to Micro Focus (previously Novell), there are only two or three partners whose focus is IDM. But the few that are there, they possess very good technical level, generally ex-Novell.

A few years ago, I had the opportunity to analyze its competitors. IBM and Oracle and both were horrible; especially Oracle as it is difficult to implement, has unfriendly interfaces, there is an absence of connectors, and there are almost no specialists in the region. Oracle did not even work.

Given that identity management is itself an IT specialization that requires a lot of knowledge, the implementation is simple. That is to say, if it is clear that the tool is intended, sinceneeds can vary from a simple synchronization of keys to a complete and automated process.

IDM licensing has accessible values even for installations of thousands of users. Once the input values were not so cheap, but the annual maintenance is very accessible. The ROI is seen in the hours saved in provisioning.

We first had IDM for several years and then, compared it to IBM and Oracle against aggressive bidding; these were not worthwhile though.

Analyze if you want to unify the keys of different identities of the same user or if you want to propagate an identity in several platforms. The latter option is recommended, although it demands more effort.

Go little by little. Install the core in a new metadirectory, separate from the production one, and implement the one-to-one connectors. This is advisable because the impact on the end user is high (in the positive sense) since it is still a change. Then, take advantage of all of its functionalities, as it is common to see that after installation, several connectors do not use other parts of the tool. For example, the role-based authorization flows, circuits to request a device, or automation of response by the loss of passwords.

Do not confuse identity management with single sign-on. This is another discipline and there are other products for it.

Designer and Analyzer are very nifty tools to deploy new drivers. Also, the iManager fallback for small configuration changes is very handy, but the feature I like the most is the extremely detailed tracing possibilities.

It saves us a full time employee in account management and once it's in place it is not expensive at all because of the extremely low license fee that is charged by NetIQ in the Netherlands.

If it works, Designer is a charm, but it can be a pain to keep updated because of all the Java stuff that regularly goes wrong. A re-installation of the software is necessary in that case.

We've been using this and previous versions for the past 10 years.

Yes, there are some bugs in the bi-directional eDirectory driver, most are fixed now and not all of them apply in every situation.

Only on the eDirectory of the connected system, which would sometimes crash during driver start-up. We still haven't found a solution for this but it happens only twice a year.

No, and we're currently scaling towards 40+ drivers and 120,000+ identities and it just keeps working. I know of big environments where they fan out changes to a second vault and from there fan out to the connected systems. This, however, is because of the level of complexity of what the university wants to achieve, not because the product itself can't handle it. Also, this is a million+ identity vault.

We've never had official contact with customer service. I do have unofficial contact with them but that's because they're friends.

I've never needed professional technical support and the community support is excellent.

Yes I looked at using different sets of scripts, but they were hard to manage and extremely hard to test.

The initial setup was straightforward and so was the implementation of the initial AD driver. It became a bit harder when we wanted to change user and group placements. Nothing you can't learn from docs and testing it yourself thoroughly though.

First implementation was in-house, second and third (moving to bigger production systems) were outsourced. The vendor team I would rate 9/10.

The ROI for the new, very big implementation is about a year. Keep in mind that licenses for this product cost next to nothing and that in this new project we're phasing out other third party tools which cost a lot of money per year.

The costs are unclear but it's an estimated €150,000 to €300,000 for the implementation. We save about half that amount on 14 implementations of other third party software (EduConnector and UMRA's Tools4Ever and ForeFront Identity Manager). License fees amount to about €10,000.- a year for 120,000 identities and about 40 to 50 connected systems.

Yes, we also looked at Microsoft ForeFront Identity Manager, UMRA's Tools4Ever and EduConnector (local Dutch software vendor).

NetIQ Identity Manager is by far the most flexible product available, and the pricing is incredibly good, even if you're not situated in the BeNeLux.

To my knowledge it is the only event based IDM system. Its supporting directory (eDirectory) also has event based replication. This makes it a very 'real time' system. In short, it is event based and not batch based.

Being event based, it allows data changes and passwords to propagate to applications in real time. This makes business workflows efficient and instant from both a process and technology perspective.

The user facing interfaces are not too friendly and they are also fairly hard to configure. Better alerting/monitoring of connectors/data would also be nice.

Three years

Not particularly. My advice would be to ensure ample time is spent on data quality and also on code testing.

Not really. A few issues now and then but patches generally come quick enough.

No, it seems to scale quite well.

Not too bad.

OK. Not up to par with bigger vendors like MS and Cisco.

No.

Any IDM will not be simple unless the environment is simple. We have a large complex environment, so setup was complex. Any IDM would have this.

We used and external systems integrator initially but they were not up to par so an internal team is now being built.

Be sure data quality and code quality is good from the start. Going back over a production environment just makes things hard.

• Identity Manager
• User Application

• Roles and Resource Management
• Segregation of Duties
• Approval Workflows
• Event Based Identity Synchronization.

• User Application
• UI
• Product Licensing

10 years.

No, the deployment is okay.

No, The product is quite stable.

Scales okay.

Never had a need to call customer service.

It was a pretty similar standard to what you would get somewhere else.

Yes, and we switched because NetIQ was easy to work, and low time to market.

I implemented it myself.

Yes we did.

I would recommend this product, Its quite flexible and quick to start with.

Event driven provisioning and powerful Development and documentation tool - Designer are the most valuable features on NetIQ Identity manager

Identity and access management processes have developed to become automatic and fast. While the source of identity information is the HR data, user rights can reflect the user role(s) in an organization.

The UI for requesting and approving rights have been a little outdated, however, in the most recent version that has been addressed. Also, the amount of work from box to production has been improved a lot during the years, but for sure - there is always a need for a capable project team to fit the product to the processes of an organization.

12 years.

High amount of skill with the product and overall knowledge of IAM are useful to avoid issues on IAM deployment. The issues are normally due to data quality, which can be fixed with the products Analyzer application.

Product is stable. At certain points, there have been bugs - but NetIQ Support has been able to help with those kind of situations

Product is very scalable. It is matter of optimizing the rules used during the integration process.

7/10.

9/10.

No previous solution used.

IM products are someway framework solutions. Deploying a solution to an organization requires co-operation with many stakeholders and knowledge on the systems to integrate.

With a normal integration, for example with AD, it's a matter of configuration, but integration with the HR system it's a matter of designing processes - for example if the system is not a standard out of the box system.

I have been a consultant on customer implementation projects.

• Sell the idea at the CEO level
• Get sponsors for a project
• Get a capable project team
• Choose a consultant who knows the product and not only the IDM processes.

The Role Based Provisioning Module feature is by far the best thing about the product; using roles and entitlements for access and provisioning makes old group based obsolete.

It has reduced time and resource costs due to automation of previously hand-managed tasks like provisioning, granting access, distribution and access to different enterprise connected applications.

Definitely documentation is among the most lacking features of the product. Also, the ability to run all components on Windows OS is needed.

I've used it for one year in different customer environments and licenses.

Deployment is pretty easygoing, though some trouble might arise if the customer's security policy is overly strict or the infrastructure has a bad design.

Stability wise I would rate the product 8 out of 10. Some known quirks and bugs give unwanted resource hogs that can be a headache at the wrong moment.

No major problems as of yet.

Scalability becomes an issue if the vision changes from the initial implementation. Not being flexible and having to rewrite quite a bit of code for even a simple added feature makes it difficult.

9/10.

8/10.

We previously used Microsoft Forefront Identity Manager.

Initial setup is straightforward if done by vendor requirements.

We used a vendor team, and their level of expertise is 9/10.

• Four hours for installation
• Development hours vary
• Two hours weekly maintenance and check-ups

We also looked at Quest OneIdentity, Oracle Identity Manager and Tivoli Identity Manager.

• It is a money saver in the long run
• As long as you set your requirements from the get-go there won't be overhead further along