Sun Identity Manager 8.1 Resources Reference

Adapter Details

The Windows NT resource adapter is defined in com.waveset.adapter.NTResourceAdapter class.

Resource Configuration Notes

This section describes Windows NT provisioning across multiple domains with two-way trusts. The following constraints apply when managing multiple domains from a single domain.


Note –

Terms referenced in this section are:


These trusts must be established:

When the gateway service is started, a local login of the service account is done. If any of the resource admin accounts are different than the service account or you will be doing pass-through authentication for any of the domains, then the service account needs the Act As Operating System and Bypass Traverse Checking user rights in the gateway domain. These rights are required for the service account to login as and impersonate another.

If you will be creating home directories, then the resource admin account needs to be able to create directories on the file system on which the directories will be created. If the home directory will be created on a network drive, the resource admin account must have write access to the file system in the Temp or TMP environmental variables of the gateway process; or, if not defined, the gateway process's working directory (this is either WINNT or WINNT\system32).

If you will be running before, after, or resource actions, the resource admin account needs read and write access to the file system in the TEMP or TMP environment variables of the gateway process; or, if not defined, the gateway processes' working directory (this is either WINNT or WINNT\system32).

The gateway writes the scripts and the script output to one of these directories (the directory is selected in the order in which they are mentioned).

Configure a separate resource adapter for each domain. The same gateway host can be used.

It should be possible to manage multiple domains using a single resource by overriding any domain-specific resource attributes (the domain and possibly the administrator and password) for each user.


Note –

Identity Manager Installation Notes

The Windows NT adapter does not require any additional installation procedures.

Usage Notes

The Scripted Gateway adapter allows you to use the RA_HANGTIMEOUT resource attribute to specify a timeout value in seconds. This attribute controls how long before a request to the gateway times out and is considered hung. You must manually add this attribute to the resource object as follows:

The default value for this attribute is 0, indicating that Identity Manager will not check for a hung connection.

Security Notes

This section provides information about supported connections and privilege requirements.

Supported Connections

Identity Manager uses the Sun Identity Manager Gatewayto communicate with this adapter.

Required Administrative Privileges

Administrators must have permission to create and maintain users and groups on the resource.

Provisioning Notes

The following table summarizes the provisioning capabilities of this adapter.

Feature  

Supported?  

Enable/disable account 

Yes 

Rename account 

Yes 

Pass-through authentication 

Yes 

Before/after actions 

Yes 

Data loading methods 

  • Import from resource

  • Reconciliation

The following administrative privileges are required to support Active Directory pass-through authentication for Windows 2003 running in Windows 2000 mode.

Account Attributes

The following table provided information about Windows NT account attributes.

Resource User Attribute  

Tab/NT Field  

Attribute Type 

AccountLocked

General/Account is locked out 

Boolean 

description

General/Description 

String 

fullname

General/Full Name 

String 

groups

Member Of/Member of 

String 

HomeDirDrive

Profile Connect 

String 

HomeDirectory

Profile/Local Path 

String 

LoginScript

Profile/Login script 

String 

PasswordNeverExpires

General/Password never expires 

Boolean 

Profile

Profile/Profile path 

String 

userPassword

Password 

Encrypted 

WS_PasswordExpired

General/User must change password at next login 

Boolean 

PasswordAge

Not displayed by default. Indicates the amount of time since the last password change. To implement, use the java.util.Date class to convert the value into a human-readable format. 

Int 

Resource Object Management

Identity Manager supports the following objects:

Resource Object  

Features Supported  

Attributes Managed  

Group 

create, update, delete 

description, member

Identity Template

$accountId$

Sample Forms

Built-In

Windows NT Create Group Form

Windows NT Update Group Form

Also Available

NTForm.xml

Troubleshooting

Use the Identity Manager debug pages to set trace options on the following class:

com.waveset.adapter.NTResourceAdapter