Pre-Con Ed: Implementing EEM with CA Workload Automation AE
1 like276 views
This document discusses ways to improve performance and structure policies for Embedded Entitlements Manager (EEM) using CA Workload Automation. It recommends defining a security matrix, leveraging naming conventions, implementing group membership, using different policy methodologies, and testing the implementation. The presentation agenda includes defining infrastructure, group membership, policy methodology, and testing. It also recommends related sessions and demos.
Pre-Con Ed: Implementing EEM with CA Workload Automation AE
- 2. 2 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD © 2016 CA. All rights reserved. All trademarks referenced herein belong to their respective companies. The content provided in this CA World 2016 presentation is intended for informational purposes only and does not form any type of warranty. The information provided by a CA partner and/or CA customer has not been reviewed for accuracy by CA. For Informational Purposes Only Terms of this Presentation
- 5. 5 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD Defining a Security Matrix § Jobs § Global Variables § Calendars § Resources § Owners? § Machines? Objects to be controlled
- 6. 6 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD Defining a Security Matrix § Who? – Which groups § What? – Type of access required § Where? – Tiers are different? Sub-head
- 7. 7 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD DEV as-appl as-calendar as-control as-cylce as-group as-gvar as-job as-joblog as-jobtype as-list as-machine as-owner ACCESS x r,c,d,x,w x r,c,d,x,w x r,c,d,x,w r,c,d,x,w r r,c,d,x,w r r,c,d,x,w x BINARY jil autocal_asc,j il stop_demo n, eplog, secadm autocal_asc jil autorep, autostatu s, sendeven t, autorep, autostatd, autostatus, job_depends , monbro,jil, sendevent autorep, job_depends , jil autorep, autostat, autostatus, job_depen ds, monbro jil, sendevent jil resource instance. app instance.cale ndar instance.o bject instance.cale ndar instance.gr oup instance. var instance.job name instance.job name instance.job name instance.o bject instance.ma chin user@hostn ame Autosys Admins x-all r,c,d,x,w-all x-all all x-all r,c,d,x,w- all r,c,d,x,w-all r-all all r-all r,c,d,x-all x-all Autosys Operatio ns x-all r-all none none x-all r,c,d,x,w- all r,c,d,x,w-all r-all none r-all all x-all Applicati on Develop ers x-by app r-all none none x-by group r,c,d,x,w- all r-all, cdxw-by jobname r-all none r-all by app name: all x-all Autosys Schedule r x-all r,c,d,x,w-all none all x-all r,c,d,x,w- all r,c,d,x,w-all r-all all r-all r,c,d,x-all x-all Prod as-appl as-calendar as-control as-cylce as-group as-gvar as-job as-joblog as-jobtype as-list as-machine as-owner ACCESS x r,c,d,x,w x r,c,d,x,w x r,c,d,x,w r,c,d,x,w r r,c,d,x,w r r,c,d,x,w x
- 8. 8 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD Leverage Your Naming Convention § Most common – Application_More_Detailed_Name § If None or too many used (too many mergers) – Consider using group/application fields Sub-head
- 9. 9 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD Define Group Membership Will depend on your user store § Internal to EEM – Naming is under your control – Your responsibility to maintain and keep accurate § LDAP/CA SiteMinder – May be harder to utilize depending on company naming standards – Compliance is easier as accuracy shifted to security group Sub-head
- 10. 10 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD Implement Policy Methodology § Most Basic – Define a policy per object per application § Each policy will protect a piece of an application § as-job, as-global, as-calendar,… – Resource name will contain identifying application name § ACE.abcapp* – Identities will contain affected groups – Operations, Admins, application group Sub-head
- 11. 11 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD Implement Policy Methodology § More Advanced – Reduced number of policies § Policy per type of user – Applies to selected instances § PR1.* – One for Operations and Admins – One with filters controlling application groups Sub-head
- 12. 12 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD Implement Policy Methodology § Implement sub-groups of application users § Uses string calculations – Application + Role based group names – May be any type of group Sub-head
- 13. 13 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD Implement Policy Methodology § Combined filters § Least number of policies § May be harder to adjust – Combines application users with other groups Sub-head
- 14. 14 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD Deny Policies § Best Match enabled – Think about the list of policies gathered § Grant Must be given – Access is denied if no policy grants access Sub-head
- 15. 15 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD Recommended Sessions SESSION # TITLE DATE/TIME MFX37E Your Voice Counts! Customer Driven Requirements for CA Workload Automation 11/15/2016 at 1:00 pm Banyan A/B MFX14E Maximizing your CA investment by integration CA WLA with CA Unified Infrastructure Management (UIM) 11/15/2016 at 11:00 am Jasmine C MFX142EL CA Workload Automation Advanced Integrations and Agents (Hands-on-Lab) 11/15/2016 at 3:00 pm South Seas D MFX122S Vision and Roadmap: CA Workload Automation AE 11/16/2016 at 12:45pm Banyan A/B