Skip Headers
Oracle® Identity Manager Connector Guide for IBM RACF Advanced
Release 9.0.4

E10451-21
Go to Documentation Home
Home
Go to Book List
Book List
Go to Table of Contents
Contents
Go to Index
Index
Go to Feedback page
Contact Us

Go to previous page
Previous
Go to next page
Next
PDF · Mobi · ePub

3 Connector Deployment on Oracle Identity Manager

The LDAP Gateway acts as the intermediary between Oracle Identity Manager and the connector components on the mainframe. The following sections of this chapter describe the procedure to deploy some components of the connector, including the LDAP Gateway, on the Oracle Identity Manager host computer:

3.1 Files and Directories That Comprise the Connector

Table 3-1 describes the files and directories on the installation media.

Table 3-1 Files and Directories That Comprise the Connector

Files and Directories Description
  • For Oracle Identity Manager release 9.1.0.x and 11.1.1:

    configuration/RacfAdv.xml

  • For Oracle Identity Manager release 11.1.2.x:

    configuration-R2/RacfAdv.xml

This XML file contains configuration information that is used during connector installation.

DataSets/ProvisionResource_OIMRACFResourceObject.xml

DataSets/ModifyResource_OIMRACFResourceObject.xml

This XML file specifies the information to be submitted by the requester during a request-based provisioning operation. Section 3.8, "Configuring Oracle Identity Manager for Request-Based Provisioning" provides more information.

Note: These files are specific to Oracle Identity Manager releases prior to release 11.1.2.x.

etc/LDAP Gateway/ldapgateway.zip

This ZIP file contains the files required to deploy the LDAP Gateway.

etc/Provisioning and Reconciliation Connector/Mainframe_RACF.zip

This ZIP file contains the files required to deploy the Reconciliation and Provisioning Agents on the mainframe. Chapter 2, "Deploying the IDF Advanced Adapter for IBM RACF" describes the files bundled in this ZIP file.

  • For Oracle Identity Manager release 9.1.0.x: lib/racf-provisioning-adapter.jar

  • For Oracle Identity Manager release 11.1.1 and 11.1.2.x:

    lib-11G/racf-provisioning-adapter.jar

This JAR file contains the code for the adapters that are used during connector operations. During connector installation, this file is copied to the following location:

  • For Oracle Identity Manager release 9.1.0.x: OIM_HOME/xellerate/JavaTasks

  • For Oracle Identity Manager releases 11.1.1 and 11.1.2.x: Oracle Identity Manager database

Files in the resources directory

Each of these resource bundles contains locale-specific information that is used by the connector. During connector installation, this file is copied to the following location:

  • For Oracle Identity Manager release 9.1.0.x: OIM_HOME/xellerate/connectorResources

  • For Oracle Identity Manager release 11.1.1 and 11.1.2.x: Oracle Identity Manager database

Note: A resource bundle is a file containing localized versions of text strings that are displayed on the Administrative and User Console. These text strings include GUI element labels and messages.

  • For Oracle Identity Manager release 9.1.0.x:

    scripts/propertyEncrypt.bat

    scripts/propertyEncrypt.sh

  • For Oracle Identity Manager release 11.1.1 and 11.1.2.x:

    scripts-11G/propertyEncrypt.bat

    scripts-11G/propertyEncrypt.sh

You use this script to encrypt passwords that you enter in the VOYAGER_ID.properties and beans.xml files. Section 3.9, "Installing and Configuring the LDAP Gateway" provides more information.

  • For Oracle Identity Manager release 9.1.0.x: lib/racf-scheduled-tasks.jar

  • For Oracle Identity Manager release 11.1.1 and 11.1.2.x: lib-11G/racf-scheduled-tasks.jar

This JAR file contains the code for the scheduled task that is used during full reconciliation. During connector installation, this file is copied to the following location:

  • For Oracle Identity Manager release 9.1.0.x: OIM_HOME/xellerate/ScheduledTask

  • For Oracle Identity Manager release 11.1.1 and 11.1.2.x: Oracle Identity Manager database

xml/oimRacfAdvConnector.xml

This XML file contains definitions of the connector components, such as the IT resource and resource object. These objects are created in Oracle Identity Manager when you import the XML file.

Note: Use this file when installing or upgrading the connector for Oracle Identity Manager releases 9.1.0.x and 11.1.1.

xml/oimRacfAdvConnectorR2.xml

This XML files contains definitions of the connector components, such as the IT resource and resource object. These objects are created in Oracle Identity Manager release 11.1.2.x when you import the XML file.

Note: Use this file when installing or upgrading the connector for Oracle Identity Manager release 11.1.2.x.

xml/racfTrustedXellerateUser.xml

This XML file contains definitions of the connector components that are used for trusted source reconciliation.

upgrade/PostUpgradeScriptRACF.sql

This file is used during the connector upgrade procedure.


3.2 Determining the Release Number of the Connector

Note:

If you are using Oracle Identity Manager release 9.1.0.x, then the procedure described in this section is optional.

If you are using Oracle Identity Manager release 11.1.1 or 11.1.2.x, then skip this section.

You might have a deployment of an earlier release of the connector. While deploying the latest release, you might want to know the release number of the earlier release. To determine the release number of the connector that has already been deployed:

  1. In a temporary directory, extract the contents of the connector JAR file that is in the OIM_HOME/xellerate/JavaTasks directory.

  2. Open the Manifest.mf file in a text editor. The Manifest.mf file is one of the files bundled inside the connector JAR file.

    In the Manifest.mf file, the release number of the connector is displayed as the value of the Version property.

3.3 Before Running the Connector Installer

Prior to running the Connector Installer, you will need to delete the configuration script and lib directories that do not pertain to your Oracle Identity Manager release version.

If running Oracle Identity Manager release 9.1.0.x:

  • Delete the "configuration-R2" directory from the connector package.

  • Delete the "scripts-11G" directory from the connector package.

  • Delete the "lib-11G" directory from the connector package.

If running Oracle Identity Manager release 11.1.1:

  • Delete the "configuration-R2" directory from the connector package.

  • Delete the "scripts" directory from the connector package.

  • Delete the "lib" directory from the connector package.

  • Rename the "scripts-11G" directory to "scripts".

  • Rename the "lib-11G" directory to "lib".

If running Oracle Identity Manager release 11.1.2.x:

  • Delete the "configuration" directory from the connector package.

  • Delete the "scripts" directory from the connector package.

  • Delete the "lib" directory from the connector package.

  • Rename the "configuration-R2" directory to "configuration".

  • Rename the "scripts-11G" directory to "scripts".

  • Rename the "lib-11G" directory to "lib".

3.4 Running the Connector Installer

To run the Connector Installer:

  1. Copy the contents of the connector installation media directory into the following directory:

    Note:

    In an Oracle Identity Manager cluster, copy this JAR file to each node of the cluster.
    • For Oracle Identity Manager release 9.1.0.x: OIM_HOME/xellerate/ConnectorDefaultDirectory

    • For Oracle Identity Manager releases 11.1.1 and 11.1.2.x: OIM_HOME/server/ConnectorDefaultDirectory

  2. Log in to the Administrative and User Console by using the user account described in the "Creating the User Account for Installing Connectors" section of the following guide:

  3. Depending on the Oracle Identity Manager release you are using, perform one of the following steps:

    • For Oracle Identity Manager release 9.1.0.x:

      Click Deployment Management, and then click Install Connector.

    • For Oracle Identity Manager release 11.1.1:

      1. On the Welcome to Identity Manager Advanced Administration page, in the System Management region, click Manage Connector.

      2. In the Manage Connector page, click Install.

    • For Oracle Identity Manager release 11.1.2.x:

      1. Log in to Oracle Identity System Administration by using the user account described in the "Creating the User Account for Installing Connectors" section of the Oracle Fusion Middleware Administrator's Guide for Oracle Identity Manager.

      2. In the left pane, under System Management, click Manage Connector.

      3. In the Manage Connector page, click Install.

  4. From the Connector List list, select RACF Advanced RELEASE_NUMBER. This list displays the names and release numbers of connectors whose installation files you copy into the default connector installation directory in Step 1.

    If you have copied the installation files into a different directory, then:

    1. In the Alternative Directory field, enter the full path and name of that directory.

    2. To repopulate the list of connectors in the Connector List list, click Refresh.

    3. From the Connector List list, select RACF Advanced RELEASE_NUMBER.

  5. Click Load.

  6. To start the installation process, click Continue.

    The following tasks are performed in sequence:

    1. Configuration of connector libraries

    2. Import of the connector Target Resource user configuration XML file (by using the Deployment Manager). If you want to import the target system as a trusted source for reconciliation, then see Section 3.7, "Configuring Trusted Source Reconciliation."

      Note:

      Target Resource user configuration XML is same as the connector XML file.
    3. Compilation of adapters

    On successful completion of a task, a check mark is displayed for the task. If a task fails, then an X mark and a message stating the reason for failure are displayed. Depending on the reason for the failure, make the required correction and then perform one of the following steps:

    • Retry the installation by clicking Retry.

    • Cancel the installation and begin again from Step 1.

  7. If all three tasks of the connector installation process are successful, then a message indicating successful installation is displayed. In addition, a list of the steps that you must perform after the installation is displayed. These steps are as follows:

    1. Ensuring that the prerequisites for using the connector are addressed

      Note:

      At this stage, run the Oracle Identity Manager PurgeCache utility to load the server cache with content from the connector resource bundle in order to view the list of prerequisites. See Section 3.6.3, "Clearing Content Related to Connector Resource Bundles from the Server Cache" for information about running the PurgeCache utility.

      There are no prerequisites for some predefined connectors.

    2. Configuring the IT resource for the connector

      Record the name of the IT resource displayed on this page. The procedure to configure the IT resource is described later in this guide.

    3. Configuring the scheduled tasks that are created when you installed the connector

      Note:

      In Oracle Identity Manager release 11.1.1 and 11.1.2.x, a scheduled job is an instance of a scheduled task. In this guide, the term scheduled task used in the context of Oracle Identity Manager release 9.1.0.x is the same as the term scheduled job in the context of Oracle Identity Manager releases 11.1.1 and 11.1.2.x.

      See Oracle Fusion Middleware Administrator's Guide for Oracle Identity Manager for more information about scheduled tasks and scheduled jobs.

      Record the names of the scheduled tasks displayed on this page. The procedure to configure these scheduled tasks is described later in this guide.

When you run the Connector Installer, it copies the connector files and external code files to destination directories on the Oracle Identity Manager host computer. These files are listed in Table 3-1.

Installing the Connector in an Oracle Identity Manager Cluster

While installing Oracle Identity Manager in a cluster, you must copy all the JAR files and the contents of the connectorResources directory into the corresponding directories on each node of the cluster. See Section 3.1, "Files and Directories That Comprise the Connector" for information about the files that you must copy and their destination locations on the Oracle Identity Manager server.

3.5 Configuring the IT Resource

You must specify values for the parameters of the RacfResource IT resource as follows:

  1. Depending on the Oracle Identity Manager release you are using, perform one of the following steps:

    • For Oracle Identity Manager release 9.1.0.x:

      1. Log in to the Administrative and User Console.

      2. Expand Resource Management, and then click Manage IT Resource.

    • For Oracle Identity Manager release 11.1.1:

      1. Log in to the Administrative and User Console.

      2. On the Welcome to Oracle Identity Manager Self Service page, click Advanced in the upper-right corner of the page.

      3. On the Welcome to Oracle Identity Manager Advanced Administration page, in the Configuration region, click Manage IT Resource.

    • For Oracle Identity Manager release 11.1.2.x:

      1. Log in to Oracle Identity System Administration.

      2. In the left pane, under Configuration, click IT Resource.

  2. In the IT Resource Name field on the Manage IT Resource page, enter RacfResource and then click Search.

  3. Click the edit icon for the IT resource.

  4. From the list at the top of the page, select Details and Parameters.

  5. Specify values for the parameters of the IT resource. Table 3-2 describes each parameter.

    Table 3-2 IT Resource Parameters

    Parameter Description

    AtMap User

    This parameter holds the name of the lookup definition containing attribute mappings that are used for provisioning.

    Value: AtMap.RACF

    Note: You must not change the value of this parameter.

    idfPrincipalDn

    Set a user ID for an account that the connector will use to connect to the LDAP Gateway.

    Format: cn=USER_ID,dc=racf,dc=com

    Sample value: cn=idfRacfAdmin,dc=racf,dc=com

    You also set this user ID in the beans.xml file inside the idfserver.jar file. See Step 5 in Section 3.9, "Installing and Configuring the LDAP Gateway."

    idfPrincipalPwd

    Set a password for the account that the connector will use to connect to the LDAP Gateway. You also set this password in the files listed in the description of the idfPrincipalDn parameter.

    Note: Do not enter an encrypted value.

    idfRootContext

    This parameter holds the root context for IBM RACF.

    Value: dc=racf,dc=com

    Note: You must not change the value of this parameter.

    idfServerHost

    This parameter holds the host name of the computer on which you install the LDAP Gateway. For this release of the connector, you install the LDAP Gateway on the Oracle Identity Manager host computer.

    Value: localhost

    Note: You must not change the value of this parameter.

    idfServerPort

    Enter the number of the port for connecting to the LDAP Gateway.

    Sample value: 5389

    You also set this port number in the beans.xml inside the idfserver.jar file. See Step 5 in Section 3.9, "Installing and Configuring the LDAP Gateway."

    idfSsl

    This parameter determines whether the LDAP Gateway will use SSL to connect to the target system. Enter true if using SSL; otherwise, enter false.

    Sample value: true

    idfTrustStore

    This parameter holds the directory location of the trust store containing the SSL certificate. This parameter is optional, and should only be entered when using SSL authentication. This must be the full path to the directory location.

    Sample value: ../conf/idf.jks

    idfTrustStorePassword

    This parameter holds the password for the SSL trust store. This parameter is optional, and should only be entered when using SSL authentication.

    idfTrustStoreType

    This parameter holds the trust store type for the SSL trust store. This parameter is optional, and should only be entered when using SSL authentication.

    Sample value: jks

    Last Modified Time Stamp

    The most recent start time of the Reconcile LDAP Users reconciliation scheduled task is stored in this parameter. See Section Section 1.3.2.2, "Initial LDAP Population and Reconciliation Process" for more information about this scheduled task.

    The format of the value stored in this parameter is as follows:

    MM/dd/yy hh:mm:ss a

    In this format:

    ...MM is the month of the year.

    ...dd is the day of the month.

    ...yy is the year.

    ...hh is the hour in am/pm (01-12).

    ...mm is the minute in the hour.

    ...ss is the second in the minute.

    ...a is the marker for AM or PM.

    ...Sample value: 05/07/10 02:46:52 PM

    The default value is 0. The reconciliation task will perform full LDAP user reconciliation when the value is 0. If the value is a non-zero, standard time-stamp value in the format given above, then incremental reconciliation is performed. Only records that have been created or modified after the specified time stamp are brought to Oracle Identity Manager for reconciliation.

    Note: When required, you can manually enter a time-stamp value in the specified format.


  6. To save the values, click Update.

3.6 Configuring Oracle Identity Manager

Configuring Oracle Identity Manager involves performing the following procedures:

Note:

In an Oracle Identity Manager cluster, perform these steps on each node of the cluster.

3.6.1 Configuring Oracle Identity Manager 11.1.2 or Later

If you are using Oracle Identity Manager release 11.1.2 or later, then you must create additional metadata such as a UI form and an application instance. In addition, you must run entitlement and catalog synchronization jobs. These procedures are described in the following sections:

3.6.1.1 Creating and Activating a Sandbox

Create and activate a sandbox as follows. For detailed instructions, see the "Managing Sandboxes" section in the Oracle Fusion Middleware Administrator's Guide for Oracle Identity Manager.

  1. On the upper navigation bar, click Sandboxes. The Manage Sandboxes page is displayed.

  2. On the toolbar, click Create Sandbox. The Create Sandbox dialog box is displayed.

  3. In the Sandbox Name field, enter a name for the sandbox. This is a mandatory field.

  4. In the Sandbox Description field, enter a description of the sandbox. This is an optional field.

  5. Click Save and Close. A message is displayed with the sandbox name and creation label.

  6. Click OK. The sandbox is displayed in the Available Sandboxes section of the Manage Sandboxes page.

  7. From the table showing the available sandboxes in the Manage Sandboxes page, select the newly created sandbox that you want to activate.

  8. On the toolbar, click Activate Sandbox.

    The sandbox is activated.

3.6.1.2 Creating a New UI Form

Create a new UI form as follows. For detailed instructions, see the "Managing Forms" chapter in the Oracle Fusion Middleware Administrator's Guide for Oracle Identity Manager.

  1. In the left pane, under Configuration, click Form Designer.

  2. Under Search Results, click Create.

  3. Select the resource type for which you want to create the form, for example, RACF User.

  4. Enter a form name and click Create.

3.6.1.3 Creating an Application Instance

Create an application instance as follows. For detailed instructions, see the "Managing Application Instances" chapter in the Oracle Fusion Middleware Administrator's Guide for Oracle Identity Manager.

  1. In the System Administration page, under Configuration in the left pane, click Application Instances.

  2. Under Search Results, click Create.

  3. Enter appropriate values for the fields displayed on the Attributes form and click Save.

  4. In the Form drop-down list, select the newly created form and click Apply.

  5. Publish the application instance to an organization to make the application instance available for requesting and subsequent provisioning to users. See the "Managing Organizations Associated With Application Instances" section in Oracle Fusion Middleware Administrator's Guide for Oracle Identity Manager for detailed instructions.

3.6.1.4 Publishing a Sandbox

To publish the sandbox that you created in Section 3.6.1.1, "Creating and Activating a Sandbox.":

  1. Close all the open tabs and pages.

  2. In the upper right corner of the page, click the Sandboxes link.

    The Manage Sandboxes page is displayed.

  3. From the table showing the available sandboxes in the Manage Sandboxes page, select the sandbox that you created in Section 3.6.1.1, "Creating and Activating a Sandbox."

  4. On the toolbar, click Publish Sandbox. A message is displayed asking for confirmation.

  5. Click Yes to confirm. The sandbox is published and the customizations it contained are merged with the main line.

3.6.1.5 Harvesting Entitlements and Sync Catalog

To harvest entitlements and sync catalog:

  1. Run the scheduled jobs for lookup field synchronization. See Section 4.2, "Scheduled Tasks for Lookup Field Synchronization" for more information about these scheduled jobs.

  2. Run the Entitlement List scheduled job to populate Entitlement Assignment schema from child process form table. See the "Predefined Scheduled Tasks" section in the Oracle Fusion Middleware Administrator's Guide for Oracle Identity Manager for more information about this scheduled job.

  3. Run the Catalog Synchronization Job scheduled job. See the "Predefined Scheduled Tasks" section in the Oracle Fusion Middleware Administrator's Guide for Oracle Identity Manager for more information about this scheduled job.

3.6.1.6 Updating an Existing Application Instance with a New Form

For any changes you do in the Form Designer, you must create a new UI form and update the changes in an application instance. To update an existing application instance with a new form:

  1. Create a sandbox and activate it as described in Section 3.6.1.1, "Creating and Activating a Sandbox."

  2. Create a new UI form for the resource as described in Section 3.6.1.2, "Creating a New UI Form."

  3. Open the existing application instance.

  4. In the Form field, select the new UI form that you created.

  5. Save the application instance.

  6. Publish the sandbox as described in Section 3.6.1.4, "Publishing a Sandbox."

3.6.2 Localizing Field Labels in UI Forms

Note:

Perform the procedure described in this section only if you are using Oracle Identity Manager release 11.1.2.x, and you want to localize UI form field labels.

To localize field labels that you add to in UI forms:

  1. Log in to Oracle Enterprise Manager.

  2. In the left pane, expand Application Deployments and then select oracle.iam.console.identity.sysadmin.ear.

  3. In the right pane, from the Application Deployment list, select MDS Configuration.

  4. On the MDS Configuration page, click Export and save the archive to the local computer.

  5. Extract the contents of the archive, and open the following file in a text editor:

    SAVED_LOCATION\xliffBundles\oracle\iam\ui\runtime\BizEditorBundle.xlf

  6. Edit the BizEditorBundle.xlf file as follows:

    1. Search for the following text:

      <file source-language="en"  
      original="/xliffBundles/oracle/iam/ui/runtime/BizEditorBundle.xlf"
      datatype="x-oracle-adf">
      
    2. Replace with the following text:

      <file source-language="en" target-language="LANG_CODE"
      original="/xliffBundles/oracle/iam/ui/runtime/BizEditorBundle.xlf"
      datatype="x-oracle-adf">
      

      In this text, replace LANG_CODE with the code of the language that you want to localize the form field labels. The following is a sample value for localizing the form field labels in Japanese:

      <file source-language="en" target-language="ja"
      original="/xliffBundles/oracle/iam/ui/runtime/BizEditorBundle.xlf"
      datatype="x-oracle-adf">
      
    3. Search for the application instance code. This procedure shows a sample edit for RacfUser application instance. The original code will be in the following format:

      <trans-unit id="${adfBundle['oracle.adf.businesseditor.model.util.BaseRuntimeResourceBundle']['persdef.sessiondef.oracle.iam.ui.runtime.form.model.user.entity.userEO.UD_<Field_Name>__c_description']}">
      <source><Field_Label></source>
      <target/>
      </trans-unit>
      <trans-unit id="sessiondef.oracle.iam.ui.runtime.form.model.<UI_Form_Name>.entity. <UI_Form_Name>EO.UD_<Field_Name>__c_LABEL">
      <source><Field_Label></source>
      <target/>
      </trans-unit>
      

      As an example, the code for FULL NAME field would be:

      <trans-unit id="${adfBundle['oracle.adf.businesseditor.model.util.BaseRuntimeResourceBundle']['persdef.sessiondef.oracle.iam.ui.runtime.form.model.user.entity.userEO.UD_RACF_ADV_CN__c_description']}">
      <source>FULL NAME</source>
      <target/>
      </trans-unit>
      <trans-unit id="sessiondef.oracle.iam.ui.runtime.form.model.RacfUser.entity.RacfUserEO.UD_RACF_ADV_CN__c_LABEL">
      <source>FULL NAME</source>
      <target/>
      </trans-unit>
      
    4. Open the resource file from the /resources directory in the connector installation media, for example RACF-Adv_ja.properties, and get the value of the attribute from the file, for example global.udf.UD_RACF_ADV_CN=\u6C0F\u540D.

    5. Replace the original code shown in Step 6.c with the following:

      <trans-unit id="${adfBundle['oracle.adf.businesseditor.model.util.BaseRuntimeResourceBundle']['persdef.sessiondef.oracle.iam.ui.runtime.form.model.user.entity.userEO.UD_<Field_Name>__c_description']}">
      <source>< global.udf.UD_Field_Name></source>
      <target/>enter Unicode values here</target>
      </trans-unit>
      <trans-unit id="sessiondef.oracle.iam.ui.runtime.form.model.<UI_Form_Name>.entity. <UI_Form_Name>EO.UD_<Field_Name>__c_LABEL">
      <source><Field_Label></source>
      <target/>enter Unicode values here</target>
      </trans-unit>
      

      As an example, the code for FULL_NAME field translation would be:

      <trans-unit id="${adfBundle['oracle.adf.businesseditor.model.util.BaseRuntimeResourceBundle']['persdef.sessiondef.oracle.iam.ui.runtime.form.model.user.entity.userEO.UD_RACF_ADV_CN__c_description']}">
      
      <source>FULL_NAME</source>
      <target>\u6C0F\u540D</target>
      </trans-unit>
      <trans-unit id="sessiondef.oracle.iam.ui.runtime.form.model.RacfUser.entity.RacfUserEO.UD_RACF_ADV_CN__c_LABEL">
      <source>FULL_NAME</source>
      <target>\u6C0F\u540D</target>
      </trans-unit>
      
    6. Repeat Steps 6.c through 6.e for all attributes of the process form.

    7. Save the file as BizEditorBundle_LANG_CODE.xlf. In this file name, replace LANG_CODE with the code of the language to which you are localizing. Sample file name: BizEditorBundle_ja.xlf.

  7. Repackage the ZIP file and import it into MDS.

  8. Log out of and log in to Oracle Identity Manager.

3.6.3 Clearing Content Related to Connector Resource Bundles from the Server Cache

Note:

In an Oracle Identity Manager cluster, you must perform this step on each node of the cluster. Then, restart each node.

When you deploy the connector, the resource bundles are copied from the resources directory on the installation media into the OIM_HOME/xellerate/connectorResources directory for Oracle Identity Manager release 9.1.0.x and Oracle Identity Manager database for Oracle Identity Manager releases 11.1.1. and 11.1.2.x. Whenever you add a new resource bundle to the connectorResources directory or make a change in an existing resource bundle, you must clear content related to connector resource bundles from the server cache.

To clear content related to connector resource bundles from the server cache:

  1. In a command window, perform one of the following steps:

    • If you are using Oracle Identity Manager release 9.1.0.x, then switch to the OIM_HOME/xellerate/bin directory.

    • If you are using Oracle Identity Manager release 11.1.1 or 11.1.2.x, then switch to the OIM_HOME/server/bin directory.

    Note:

    You must perform Step 1 before you perform Step 2. An exception is thrown if you run the command described in Step 2 as follows:

    For Oracle Identity Manager release 9.1.0.x:

    OIM_HOME/xellerate/bin/SCRIPT_FILE_NAME
    

    For Oracle Identity Manager releases 11.1.1 and 11.1.2.x:

    OIM_HOME/server/bin/SCRIPT_FILE_NAME
    
  2. Enter one of the following commands:

    Note:

    You can use the PurgeCache utility to purge the cache for any content category. Run PurgeCache.bat CATEGORY_NAME on Microsoft Windows or PurgeCache.sh CATEGORY_NAME on UNIX. The CATEGORY_NAME argument represents the name of the content category that must be purged.

    For example, the following commands purge Metadata entries from the server cache:

    PurgeCache.bat MetaData

    PurgeCache.sh MetaData

    • For Oracle Identity Manager release 9.1.0.x:

      On Microsoft Windows: PurgeCache.bat ConnectorResourceBundle

      On UNIX: PurgeCache.sh ConnectorResourceBundle

      Note:

      You can ignore the exception that is thrown when you perform Step 2. This exception is different from the one mentioned in Step 1.

      In this command, ConnectorResourceBundle is one of the content categories that you can delete from the server cache. See the following file for information about the other content categories:

      OIM_HOME/xellerate/config/xlconfig.xml

    • For Oracle Identity Manager releases 11.1.1 and 11.1.2.x:

      On Microsoft Windows: PurgeCache.bat All

      On UNIX: PurgeCache.sh All

      When prompted, enter the user name and password of an account belonging to the SYSTEM ADMINISTRATORS group. In addition, you are prompted to enter the service URL in the following format:

      t3://OIM_HOST_NAME:OIM_PORT_NUMBER
      

      In this format:

      • Replace OIM_HOST_NAME with the host name or IP address of the Oracle Identity Manager host computer.

      • Replace OIM_PORT_NUMBER with the port on which Oracle Identity Manager is listening.

    See Oracle Fusion Middleware Administrator's Guide for Oracle Identity Manager for more information about the PurgeCache utility.

3.6.4 Enabling Logging

The IBM RACF connector supports two forms of logging, namely LDAP gateway-level logging and OIM-level logging. This section discusses the following topics:

3.6.4.1 Enabling Logging for the LDAP Gateway

LDAP Gateway logging operations are managed by the log4j.properties file. This file is present in the ldapgateway/dist/idfserver.jar compilation file (see step 10 of Section 3.9, "Installing and Configuring the LDAP Gateway"). To configure logging operations, you must edit the log4j.properties file and specify the type of event for which you want logging to take place. This is done by editing the log4j.rootLogger log level:variable in the log4j.properties file. For example,

log4j.rootLogger=ERROR

The following is a list of log levels that can be used:

  • ALL

    This level enables logging for all events.

  • DEBUG

    This level enables logging of information about fine-grained events that are useful for debugging.

  • INFO

    This level enables logging of messages that highlight the progress of the application at a coarse-grained level.

  • WARN

    This level enables logging of information about potentially harmful situations.

  • ERROR

    This level enables logging of information about error events that may allow the application to continue running.

  • FATAL

    This level enables logging of information about very severe error events that could cause the application to stop functioning.

  • OFF

    This level disables logging for all events.

Log statements generated during provisioning and scheduled task reconciliation events are written to the idfserver.log.0 file. Log statements generated from real-time reconciliation events are written to the racf-agent-recon.log.0 file. Both files are located in the /ldapgateway/logs directory.

3.6.4.2 Enabling Logging in Oracle Identity Manager

This section discusses the following topics:

3.6.4.2.1 Enabling Logging in Oracle Identity Manager Release 9.1.0.x

Note:

In an Oracle Identity Manager cluster, perform this procedure on each node of the cluster. Then, restart each node.

When you enable logging, Oracle Identity Manager automatically stores in a log file information about events that occur during the course of provisioning and reconciliation operations. To specify the type of event for which you want logging to take place, you can set the log level to one of the following:

  • DEBUG

  • INFO

  • WARN

  • ERROR

  • FATAL

  • OFF

See Section 3.6.4.1, "Enabling Logging for the LDAP Gateway" for information about each of the log level in the preceding list.

The file in which you set the log level and the log file path depend on the application server that you use:

Note:

Ensure that the version of the log4j-1.2.8.jar file that you are using on the IBM RACF host computer is the same as the version of the log4j-1.2.8.jar file that is in use on the Oracle Identity Manager host computer.
  • IBM WebSphere Application Server

    To enable logging:

    1. In the OIM_HOME/xellerate/config/log.properties file, add the following line:

      log4j.logger.COM.IDENTITYFORGE.IDFUSEROPERATIONS=LOG_LEVEL
      
    2. In this line, replace LOG_LEVEL with the log level that you want to set.

      For example:

      log4j.logger.COM.IDENTITYFORGE.IDFUSEROPERATIONS=INFO
      

    After you enable logging, log information is written to the following file:

    WEBSPHERE_HOME/AppServer/logs/SERVER_NAME/SystemOut.log

  • JBoss Application Server

    To enable logging:

    1. In the JBOSS_HOME/server/default/conf/log4j.xml file, locate or add the following lines:

      <category name="COM.IDENTITYFORGE.IDFUSEROPERATIONS">
         <priority value="LOG_LEVEL"/>
      </category>
      
    2. In the second XML line, replace LOG_LEVEL with the log level that you want to set. For example:

      <category name="COM.IDENTITYFORGE.IDFUSEROPERATIONS">
         <priority value="INFO"/>
      </category>
      

    After you enable logging, log information is written to the following file:

    JBOSS_HOME/server/default/log/server.log

  • Oracle Application Server

    To enable logging:

    1. In the OIM_HOME/xellerate/config/log.properties file, add the following line:

      log4j.logger.IDENTITYFORGE.IDFUSEROPERATIONS=LOG_LEVEL
      
    2. In this line, replace LOG_LEVEL with the log level that you want to set.

      For example:

      log4j.logger.IDENTITYFORGE.IDFUSEROPERATIONS=INFO
      

    After you enable logging, log information is written to the following file:

    ORACLE_HOME/opmn/logs/default_group~home~default_group~1.log

  • Oracle WebLogic Server

    To enable logging:

    1. In the OIM_HOME/xellerate/config/log.properties file, add the following line:

      log4j.logger.COM.IDENTITYFORGE.IDFUSEROPERATIONS=LOG_LEVEL
      
    2. In this line, replace LOG_LEVEL with the log level that you want to set.

      For example:

      log4j.logger.COM.IDENTITYFORGE.IDFUSEROPERATIONS=INFO
      

    After you enable logging, log information is displayed on the server console.

Multiple log files are available for use with the connector. Table 3-3 lists the name, location, and contents of each LDAP gateway log file.

Table 3-3 Log Files and their Contents

Log File Description

nohup.out

This log file contains the console window output from the LDAP Gateway. This file is primarily used in conjunction with the run.sh script (instead of the run.bat file)

Location:/ldapgateway/bin/

idfserver.log.0

This log file contains provisioning and reconciliation logging messages from the LDAP Gateway and is the primary log file used by the gateway component.

Location:/ldapgateway/logs/

racf-agent-recon.log

This log file contains the reconciliation log messages from the racf-adv-agent-recon.jar component of the connector.

Location:/ldapgateway/logs/


3.6.4.2.2 Enabling Logging on Oracle Identity Manager Release 11.1.1 or 11.1.2.x

Oracle Identity Manager release 11.1.1 uses Oracle Java Diagnostic Logging (OJDL) for logging. OJDL is based on java.util.logger. To specify the type of event for which you want logging to take place, you can set the log level to one of the following:

  • SEVERE.intValue()+100

    This level enables logging of information about fatal errors.

  • SEVERE

    This level enables logging of information about errors that might allow Oracle Identity Manager to continue running.

  • WARNING

    This level enables logging of information about potentially harmful situations.

  • INFO

    This level enables logging of messages that highlight the progress of the application.

  • CONFIG

    This level enables logging of information about fine-grained events that are useful for debugging.

  • FINE, FINER, FINEST

    These levels enable logging of information about fine-grained events, where FINEST logs information about all events.

These log levels are mapped to ODL message type and level combinations as shown in Table 3-4.

Table 3-4 Log Levels and ODL Message Type:Level Combinations

Log Level ODL Message Type:Level

SEVERE.intValue()+100

INCIDENT_ERROR:1

SEVERE

ERROR:1

WARNING

WARNING:1

INFO

NOTIFICATION:1

CONFIG

NOTIFICATION:16

FINE

TRACE:1

FINER

TRACE:16

FINEST

TRACE:32


OIM level logging operations are managed by the logging.xml file which is located in the following directory:

DOMAIN_NAME/config/fmwconfig/servers/SERVER_NAME/

Loggers are used to configure logging operations for the connector's OIM functions. To configure loggers:

  1. In a text editor, open the DOMAIN_NAME/config/fmwconfig/servers/SERVER_NAME/logging.xml file.

  2. Locate the logger you want to configure. If adding a logger for the first time, you must create the logger definition. Table 3-5, "Logger Parameters" lists the Oracle Identity Manager loggers for this connector.

    Table 3-5 Logger Parameters

    Logger Description

    COM.IDENTITYFORGE.IDFUSEROPERATIONS

    Logs events related to provisioning operations from Oracle Identity Manager to the LDAP gateway, such as user creation and modification events.

    COM.IDENTITYFORGE.UTIL.RACF.IDFLDAPOPERATIONS

    Logs events related to basic LDAP functions, including connecting to and disconnecting from the LDAP gateway.

    COM.IDENTITYFORGE.RACF.TASKS.FINDALLDATASETSTASK

    Logs events related to the Find All Datasets scheduled task.

    COM.IDENTITYFORGE.RACF.TASKS.FINDALLGROUPSTASK

    Logs events related to the Find All Facilities scheduled task.

    COM.IDENTITYFORGE.RACF.TASKS.FINDALLRESOURCESTASK

    Logs events related to the Find All Resources scheduled task.

    COM.IDENTITYFORGE.RACF.TASKS.FINDALLSECURITYATTRIBUTESSTASK

    Logs events related to the Find All Security Attributes scheduled task.

    COM.IDENTITYFORGE.RACF.TASKS.RECONCILEALLLDAPUSERSTASK

    Logs events related to the Reconcile All LDAP Users scheduled task.

    COM.IDENTITYFORGE.RACF.TASKS.RECONCILEUSERSTOINTERNALLDAPTASK

    Logs events related to the Reconcile Users to Internal LDAP scheduled task.

    COM.IDENTITYFORGE.RACF.TASKS.RECONCILEALLUSERSTASK

    Logs events related to the Reconcile All Users scheduled task.

    COM.IDENTITYFORGE.RACF.TASKS.RECONCILEDELETEDUSERSTOOIMTASK

    Logs events related to the Reconcile Deleted Users to OIM scheduled task.


  3. Define the <logger> element and its handlers. You can use the standard odl-handler as the log handler, or write your own. For more information on configuring logging in Oracle Identity Manager, see Chapter 8, "Enabling System Logging" in the Oracle Fusion Middleware Administrator's Guide for Oracle Identity Manager.

    The following is an example of a logger definition for the Reconcile All Users scheduled task:

    <logger name="com.identityforge.racf.tasks.ReconcileAllUsersTask" level="TRACE:32">
    <handler name="odl-handler"/>
    </logger>
    
  4. Save the changes and close the file.

  5. Restart the Oracle Identity Manager for the changes to take effect.

    Log statements will be written to the path that is defined in the log handler that you assigned in the logger definition. For example, in the above logger definition for the Reconcile All Users scheduled task (in step 3), the handler is odl-handler, which has the following default output file path:

    ${domain.home}/servers/${weblogic.Name}/logs/${weblogic.Name}-diagnostic.log'
    

3.7 Configuring Trusted Source Reconciliation

Note:

This section describes an optional procedure. Perform this procedure only if you want to configure IBM RACF as a trusted source for identity data. By performing this procedure, you enable trusted source reconciliation for both full reconciliation runs and incremental reconciliation.

The XML file for trusted source reconciliation, racfTrustedXellerateUser.xml, contains definitions of the connector components that are used for trusted source reconciliation. To import this XML file:

  1. Depending on the Oracle Identity Manager release you are using, perform one of the following steps:

  2. If you are using Oracle Identity Manager release 9.1.0.x, then:

    1. Click the Deployment Management link on the left navigation pane.

    2. Click the Import link under Deployment Management. A dialog box for opening files is displayed.

  3. If you are using Oracle Identity Manager release 11.1.1, then:

    1. Log in to the Administrative and User Console.

    2. On the Welcome page, click Advanced in the upper-right corner of the page.

    3. On the Welcome to Oracle Identity Manager Advanced Administration page, in the System Management region, click Import Deployment Manager File. A dialog box for opening files is displayed.

  4. If you are using Oracle Identity Manager release 11.1.2.x, then:

    1. Log in to Oracle Identity System Administration.

    2. In the left pane, under System Management, click the Import. A dialog box for opening files is displayed.

  5. Locate and open the racfTrustedXellerateUser.xml file from xml directory on the installation media. Details of this XML file are shown on the File Preview page.

  6. Click Add File. The Substitutions page is displayed.

  7. Click Next. The Confirmation page is displayed.

  8. Click Import.

  9. In the message that is displayed, click Import to confirm that you want to import the XML file and then click OK.

3.8 Configuring Oracle Identity Manager for Request-Based Provisioning

Note:

Perform the procedure described in this section only if you are using Oracle Identity Manager release 9.1.0.x or 11.1.1, and you want to configure request-based provisioning.

In request-based provisioning, an end user creates a request for a resource by using the Administrative and User Console. Administrators or other users can also create requests for a particular user. Requests for a particular resource on the resource can be viewed and approved by approvers designated in Oracle Identity Manager.

The following are features of request-based provisioning:

  • A user can be provisioned only one resource (account) on the target system.

    Note:

    Direct provisioning allows the provisioning of multiple target system accounts on the target system.
  • Direct provisioning cannot be used if you enable request-based provisioning.

To configure request-based provisioning, perform the following procedures:

3.8.1 Copying Predefined Request Datasets

A request dataset is an XML file that specifies the information to be submitted by the requester during a provisioning operation. Predefined request datasets are shipped with this connector. These request datasets specify information about the default set of attributes for which the requester must submit information during a request-based provisioning operation. The following predefined request datasets are available in the DataSets directory on the installation media:

ProvisionResource_OIMRACFResourceObject.xml

ModifyResource_OIMRACFResourceObject.xml

Copy these files from the installation media to any directory on the Oracle Identity Manager host computer. It is recommended that you create a directory structure as follows:

/custom/connector/RESOURCE_NAME

For example:

E:\MyDatasets\custom\connector\racfAdv

Note:

Until you complete the procedure to configure request-based provisioning, ensure that there are no other files or directories inside the parent directory in which you create the directory structure. In the preceding example, ensure that there are no other files or directories inside the E:\MyDatasets directory.

The directory structure to which you copy the dataset files is the MDS location into which these files are imported after you run the Oracle Identity Manager MDS Import utility. The procedure to import dataset files is described in the next section.

Depending on your requirement, you can modify the file names of the request datasets. In addition, you can modify the information in the request datasets. See Oracle Fusion Middleware Developer's Guide for Oracle Identity Manager for information on modifying request datasets.

3.8.2 Importing Request Datasets into the MDS

All request datasets must be imported into the metadata store (MDS), which can be done by using the Oracle Identity Manager MDS Import utility.

To import a request dataset definition into MDS:

  1. Ensure that you have set the environment for running the MDS Import utility. See Oracle Fusion Middleware Developer's Guide for Oracle Identity Manager for detailed information about setting up the environment for MDS utilities.

    Note:

    While setting up the properties in the weblogic.properties file, ensure that the value of the metadata_from_loc property is the parent directory of the /custom/connector/RESOURCE_NAME directory. For example, while performing the procedure in Section 3.8.1, "Copying Predefined Request Datasets," if you copy the files to the E:\MyDatasets\custom\connector\racfAdv directory, then set the value of the metada_from_loc property to E:\MyDatasets.
  2. In a command window, change to the OIM_HOME\server\bin directory.

  3. Run one of the following commands:

    • On Microsoft Windows

      weblogicImportMetadata.bat
      
    • On UNIX

      weblogicImportMetadata.sh
      
  4. When prompted, enter the following values:

    • Please enter your username [weblogic]

      Enter the username used to log in to the WebLogic server

      Sample value: WL_User

    • Please enter your password [weblogic]

      Enter the password used to log in to the WebLogic server.

    • Please enter your server URL [t3://localhost:7001]

      Enter the URL of the application server in the following format:

      t3://HOST_NAME_IP_ADDRESS:PORT

      In this format, replace:

      • HOST_NAME_IP_ADDRESS with the host name or IP address of the computer on which Oracle Identity Manager is installed.

      • PORT with the port on which Oracle Identity Manager is listening.

    The request dataset is imported into MDS at the following location:

    /custom/connector/RESOURCE_NAME

3.8.3 Enabling the Auto Save Form Feature

To enable the Auto Save Form feature:

  1. Log in to the Design Console.

  2. Expand Process Management, and then double-click Process Definition.

  3. Search for and open the OIMRACFProvisioningProcess process definition.

  4. Select the Auto Save Form check box.

  5. Click the Save icon.

3.8.4 Running the PurgeCache Utility

Run the PurgeCache utility to clear content belonging to the Metadata category from the server cache. See Section 3.6.3, "Clearing Content Related to Connector Resource Bundles from the Server Cache" for instructions.

The procedure to configure request-based provisioning ends with this step.

3.9 Installing and Configuring the LDAP Gateway

The IT resource contains connection information for Oracle Identity Manager to connect to the LDAP Gateway. The racf.properties file is one of the components of the gateway. This file contains information used by the gateway to connect to the mainframe. Configuring the gateway involves setting values in the racf.properties file and the other files that are used by the gateway.

To install and configure the LDAP Gateway:

  1. Extract the contents of the ldapgateway.zip file to a directory on the computer. This ZIP file is in the etc/LDAP Gateway directory on the installation media.

    Note:

    • The LDAP gateway can exist on a server other than the Oracle Identity Manager.

    • In this document, the full path (and name) of the ldapgateway directory on the Oracle Identity Manager host computer is referred to as LDAP_INSTALL_DIR.

  2. Copy the racf-adv-agent-recon.jar and VOYAGER_ID.properties files from the lib directory on the installation media to the LDAP_INSTALL_DIR/etc directory.

  3. In a text editor, open the LDAP_INSTALL_DIR/conf/racf.properties file. Enter values for the properties listed in this file. Table 3-6 describes these properties.

    Table 3-6 Properties in the racf.properties File

    Property Description

    agentPort

    Enter the number of the port on the LDAP Gateway host computer from which the Reconciliation Agent sends messages.

    configAttrs

    This property holds the field names of RACF fields that are defined in the CSDATA user segment and used during user provisioning operations. If entering more than one value, separate each value with a vertical bar (|) character. Each field name should have a corresponding configDNames entry.This step is mentioned in the following sections:

    For example, if you define a field with a display name of "EMP_NUM" and a field name of "SSN", you would enter:

    # CUSTOM CSDATA RACF ATTRIBUTE FIELD NAME

    _configAttrs_=SSN

    configDNames

    This property holds the display name(s) of RACF field(s) that are defined in the CSDATA segment and used during user reconciliation operations. If entering more than one value, separate each value with a vertical bar (|) character. Each display name should have a corresponding configAttrs entry.

    For example, if you define a field with a display name of "EMP_NUM" and a field name of "SSN", you would enter:

    # CUSTOM CSDATA RACF ATTRIBUTE DISPLAY NAME

    _configDNames_=EMP_NUM=|TESTID=|

    defaultDelete

    Enter one of the following as the value of this property:

    • Set revoke as the value if you want the user to be disabled on the target system as the outcome of a Delete User provisioning operation.

    • Set delete as the value if you want the user to be deleted from the target system as the outcome of a Delete User provisioning operation.

    For example:

    # DEFAULT ACTION WHEN DELETE FUNCTION USED

    _defaultDelete_=delete

    host

    Set the host name or IP address of the mainframe as the value of this property.

    port

    Enter the number of the port on the mainframe that you are going to reserve for the Provisioning Agent. The LDAP Gateway will send provisioning messages to this port.

    ver45

    This property is used to determine whether the LDAP gateway must use the large (240K) socket buffer when passing messages to the target system. Values: [true|false]

    If you set the value of this property to true, the LDAP gateway will use a 240K socket buffer.If you set the value of this property to false, the LDAP gateway will use a 32K socket buffer.

    Default setting is true.

    auditOn

    This property is used to store audit data from IBM RACF. Default setting is false.

    domainOu

    This property is used to store user in a certain location under the ou=People tree of the internal LDAP. This needs to be unique and specific for each system if multiple systems are used within one LDAP Gateway. Default = domainOu=racf

    _stcID_

    This property is used to allow the real-time agent to ignore events that have been submitted by the Pioneer STC from request by Oracle Identity Manager.

    _internalEnt_

    This property is used to allow the real-time agent to store users in the LDAP internal store. Values: [true|false]

    _internalGrpEnt_

    This property is used to allow the real-time agent to store groups in the LDAP internal store.

    Values: [true|false]

    _internalCREnt_

    This property is used to allow the real-time agent to store connect and remove commands in the LDAP internal store. Values: [true|false]

    useExtractGrp

    Use this new property for faster reconciliation. Default setting is false which will run a LISTUSER.

    If the default setting is set to true, an EXTRACT command will be issued instead.

    useExtractUser

    Use this new property for faster reconciliation. Default setting is false which will run a LISTUSER.

    If the default setting is set to true, an EXTRACT command will be issued instead and use configExtractAttrs for CSDATA fields.

    _configExtractAttrs_

    Use this property to list any custom CSDATA fields for RACF. Use this when using 'useExtractUser=true' property above.

    Sample value: EMPSER :|NETAN :|

    _allowDeleteDS_

    This property is used for default action when delete request occurs that will delete dataset profiles for user being deleted.

    revokePsuspendUsers

    Use this property to specify whether users with the PSUSPEND attribute should be flagged as revoked when parsing a LIST USER result message.

    • Set true as the value if you want the user to be disabled in Oracle Identity Manager as the outcome of a LIST USER reconciliation operation.

    • Set false as the value if you want the PSUSPEND attribute to not factor the user's OIM Status setting as the outcome of a LIST USER reconciliation operation.

      For example:

      # REVOKE OIM USERS WITH PSUSPEND

      _revokePsuspendUsers_=true

    _useUnivGrp_

    Use this property to specify whether to use universal groups instead of normal groups on the target system. Universal groups can have an unlimited number of AUTH(USE) userIDs connected to it.

    Values: [true|false]


  4. Save and close the racf.properties file.

  5. From the LDAP_INSTALL_DIR/dist/idfserver.jar file, extract the beans.xml file, and then open the file in a text editor.

    • You use the beans.xml file to store the credentials of the account used by Oracle Identity Manager to connect to the LDAP Gateway. You also enter these credentials as parameters of the IT resource. During provisioning and reconciliation, the credentials passed through the IT resource are authenticated against the credentials stored in the beans.xml file. The LDAP Gateway exchanges data with the connector only after this authentication succeeds.

      You enter the credentials of the LDAP Gateway user in the following lines of the beans.xml file:

      <property name="adminUserDN" value="cn=idfRacfAdmin,dc=RACF,dc=com"/>
      <property name="adminUserPassword" value="idfRacfPwd"/>
      

      In the first line, replace cn=idfRacfAdmin,dc=RACF,dc=com with the value that you entered for the idfPrincipalDn parameter of the IT resource. In the second line, replace idfRacfPwd with the value that you entered for the idfPrincipalPwd parameter of the IT resource. Table 3-2, "IT Resource Parameters" describes both parameters. If you want to encrypt the password before you enter it in the beans.xml file, then:

      Note:

      It is optional to encrypt the password that you set in the beans.xml file. However, it is recommended that you encrypt the password for security reasons.

      You must enter the unencrypted password as the value of the idfPrincipalPwd IT resource parameter. This is regardless of whether you enter the encrypted password in the beans.xml file.

      1. In a text editor, copy one of the following script files from the installation media into a temporary directory and then open the script file in a text editor:

        For Microsoft Windows:

        /scripts/propertyEncrypt.bat
        

        For UNIX:

        /scripts/propertyEncrypt.sh
        
      2. Specify values for the following properties in the file:

        SET CLASSPATH=DIRECTORY_LOCATION\idfserver.jar
        

        Replace DIRECTORY_LOCATION with the full path of the directory into which you copied the idfserver.jar file while deploying the connector.

        For example:

        SET CLASSPATH=C:\software\ldapgateway\dist\idfserver.jar
        
        %JAVACMD%  %JVM_OPTS%  -cp %CLASSPATH%  com.identityforge.idfserver.util.AESCipherUtil PLAINTEXT_PASSWORD
        

        Replace PLAINTEXT_PASSWORD with the password that you want to encrypt.

        For example:

        %JAVACMD%  %JVM_OPTS%  -cp %CLASSPATH%  com.identityforge.idfserver.util.AESCipherUtil idfRacfPwd
        
      3. Save the changes made to the propertyEncrypt.bat or propertyEncrypt.sh script.

      4. Run the script.

        The script encrypts the password that you provide and displays it in the command window.

      5. In the beans.xml file, search for the following string:

        <property name="adminUserPassword"
        
      6. Replace the value of this property with the encrypted password.

        For example:

        <property name="adminUserPassword" value="468018DD1CDBE82E515EBF78A41C428E"/>
        

      In the beans.xml file, specify the port used for communication between the LDAP Gateway and the mainframe LPAR on which you installed the Reconciliation and Provisioning Agents

    • Note:

      The procedure to install these agents is described in the next chapter.

      As shown in the following line, the default value of the port property is 5389 in the beans.xml file. You can change this default value to any port of your choice.

      <property name="port" value="6389"/>
      

      Note:

      The port number must be the same as the port number that you specify as the value of the idfServerPort IT resource parameter. See Table 3-2, "IT Resource Parameters" for more information.
  6. To enable logging for the LDAP Gateway:

    1. Copy the log4j JAR file from the application server directory in which it is placed to the LDAP_INSTALL_DIR/lib directory.

    2. Extract the log4j.properties file from the LDAP_INSTALL_DIR/dist/idfserver.jar file.

    3. Enter a log level as the value of the log4j.rootLogger variable. For example:

      log4j.rootLogger=DEBUG, A1
      

      See Also:

      Section 3.6.4, "Enabling Logging" for more information
    4. Save and close the file.

    When you use the connector, the following log files are generated in the LDAP_INSTALL_DIR/logs directory:

    • idfserver.log.0: This is the main LDAP Gateway operations log file.

    • racf-agent-recon.log: This is the real-time, incremental reconciliation log file that stores Oracle Identity Manager reconciliation messages. See Section 4.4, "Configuring Reconciliation" for more details on incremental reconciliation.

  7. To configure the SSL in the LDAP Gateway:

    1. Edit the /ldapgateway/idfserver.jar beans.xml directory for the following:

      <bean id="sslChannelFactory" class="com.identityforge.idfserver.nio.ssl.SSLChannelFactory">
      <constructor-arg><value>false</value></constructor-arg>
      <constructor-arg><value>./conf/idf.jks</value></constructor-arg>
      <constructor-arg><value>abc123</value></constructor-arg>
      <constructor-arg><value>false</value></constructor-arg>
      </bean>
      

      The first argument indicates we are not in client mode.

      Note:

      Do not change this argument.

      The second argument is the path to the keystore. Either change this path to your keystore or add your certificate to this keystore.

      The third argument is the keystore password that you used to generate your keystore.

      The fourth argument indicates whether the keystore password is encrypted. Use false for plain-text passwords, and true for encrypted passwords.

    2. Edit a listener using the SSLChannelFactory for only "port", which is the only item you can change in the listener:

      <bean id="sslListener" class="com.identityforge.idfserver.nio.Listener">
      constructor-arg><ref bean="bus"/></constructor-arg>
      <constructor-arg><ref bean="sslChannelFactory"/></constructor-arg>
      <property name="admin"><value>false</value></property>
      <property name="config"><value>./conf/listener.xml</value></property>
      <property name="port" value="7389"/>
      <property name="threadName" value="SSLLDAPListener"/>
      </bean>
      
    3. Add the listener to the server by uncommenting the following line:

      <bean id="server" class="com.identityforge.idfserver.Server">
      <property name="tasks">
      <list>
      <ref bean="bus"/>
      <ref bean="decoder"/>
      <ref bean="listener"/>
      <!-- <ref bean="sslListener"/> <!-- added here -->
      <ref bean="client"/>
      <ref bean="protocol"/>
      <ref bean="encoder"/>
      <ref bean="output"/>
      </list>
      </property>          
      <property name="nexus" ref="nexus"/>
      <property name="logPath" value="../logs/idfserver.log"/>
      </bean>
      
  8. Save the changes made to the beans.xml file, and then re-create the idfserver.jar file.

  9. To configure the LDAP Gateway for the application server that Oracle Identity Manager is running on:

    1. In a text editor, open the run script from the LDAP_INSTALL_DIR/bin directory. This run script is used to start and stop the LDAP gateway.

      If using a Windows system, open the run.bat file. If using a UNIX system, open the run.sh file.

    2. In the run script, you will need to update certain sections (see the run script comments for more details):

      (i) Update the environment variables to reflect the actual location of the application server directories

      rem *****************************************************
      rem ******* UPDATE THE FOLLOWING CLASSPATHS *************
      rem *****************************************************
       
      set JAVA_HOME=C:\software\Java\jdk1.6.0_20
      set APPSERVER_HOME=C:\jboss
      set OIM_HOME=C:\oracle\9.0.3\xellerate
      set OIM_CLIENT_HOME=C:\oracle\9.0.3\client\xlclient
      

      (ii) Uncomment the lines related to the application server libraries that you are using.

      (iii) Update the application server library classpaths to reflect the actual location of the directories.

      (iv) Uncomment the startup command related to the application server that you are using.

  10. Save and close the run script.

Starting and Stopping the LDAP Gateway on UNIX

To start the LDAP Gateway on UNIX, run the following command:

bin> ./run.sh

When the LDAP Gateway has started, the LDAP Gateway VERSION_NUMBER Started message is recorded in the in the LDAP_INSTALL_DIR/bin/nohup.out log file. For more information on logging, see Section 3.6.4, "Enabling Logging".

To stop the LDAP Gateway on UNIX, run the following command:

bin> ./stop_idf.sh

Starting and Stopping the LDAP Gateway on Microsoft Windows

To start the LDAP Gateway on Microsoft Windows, run the run.bat file.

When the LDAP Gateway has started, the LDAP Gateway VERSION_NUMBER Started message is recorded in the idfserver.log.

To stop the LDAP Gateway on Microsoft Windows, close the command window in which the gateway is running.