Sun[TM] Identity Manager 8.0 Resources Reference |
RACFThe RACF resource adapter supports management of user accounts and memberships on an OS/390 mainframe. The adapter manages RACF over a TN3270 emulator session.
The RACF resource adapter is defined in the com.waveset.adapter.RACFResourceAdapter class.
Resource Configuration Notes
None
Identity Manager Installation Notes
The RACF resource adapter is a custom adapter. You must perform the following steps to complete the installation process:
- To add the RACF resource to the Identity Manager resources list, you must add the following value in the Custom Resources section of the Configure Managed Resources page.
com.waveset.adapter.RACFResourceAdapter
- Copy the appropriate JAR files to the WEB-INF/lib directory of your Identity Manager installation.
Connection Manager
JAR Files
Host On Demand
The IBM Host Access Class Library (HACL) manages connections to the mainframe. The recommended JAR file containing HACL is habeans.jar. It is installed with the HOD Toolkit (or Host Access Toolkit) that comes with HOD. The supported versions of HACL are in HOD V7.0, V8.0, V9.0, and V10.
However, if the toolkit installation is not available, the HOD installation contains the following JAR files that can be used in place of the habeans.jar:
See http://www.ibm.com/software/webservers/hostondemand/ for more information.
Attachmate WRQ
The Attachmate 3270 Mainframe Adapter for Sun product contains the files needed to manage connections to the mainframe.
Contact Sun Professional Services about getting this product.
- Add the following definitions to the Waveset.properties file to define which service manages the terminal session:
serverSettings.serverId.mainframeSessionType=Value
serverSettings.default.mainframeSessionType=ValueValue can be set as follows:
- When the Attachmate libraries are installed into a WebSphere or WebLogic application server, add the property com.wrq.profile.dir=LibraryDirectory to the WebSphere/AppServer/configuration/config.ini or startWeblogic.sh file.
This allows the Attachmate code to find the licensing file.
- Restart your application server so that the modifications to the Waveset.properties file can take effect.
- See Mainframe Connectivity for information about configuring SSL connections to the resource.
Usage Notes
This section provides information related to using the RACF resource adapter, which is organized into the following sections:
Administrators
TSO sessions do not allow multiple, concurrent connections. To achieve concurrency for Identity Manager RACF operations, you must create multiple administrators. Thus, if two administrators are created, two Identity Manager RACF operations can occur at the same time.You should create at least two (and preferably three) administrators.
If you are running in a clustered environment, you must define an admin for each server in the cluster. This applies even if it is the same admin. For TSO, there must be a different admin for each server in the cluster.
If clustering is not being used, the server name should be the same for each row (the name of the Identity Manager host machine).
Support for Additional Segments
The RACF adapter can be configured to support attributes that are not in the segments supported by default.
- Create an AttrParse object that parses the segment. See Implementing the AttrParse Object for information about defining custom AttrParse objects. Example AttrParse objects are defined in $WSHOME/web/sample/attrparse.xml.
- Add a ResourceAttribute element to the RACF resource object. For example:
<ResourceAttribute name='WORKATTR Segment AttrParse' displayName='WORKATTR Segment AttrParse' description='AttrParse for WORKATTR Segment' value='Default RACF WORKATTR Segment AttrParse'>
</ResourceAttribute>This example adds a field labeled WORKATTR Segment AttrParse to the Resource Parameters page. The value assigned to the name attribute must be of the form SegmentName Segment AttrParse.
- Add an element to the RACF resource object that defines a custom account attribute.
<AccountAttributeType id='32' name='WORKATTR Account' syntax='string' mapName='WORKATTR.WAACCNT' mapType='string'>
</AccountAttributeType>The value of the mapName attribute must be of the form SegmentName.AttributeName. When the adapter detects a mapName in this format, it asks RACF for the specified segment and uses the object specified in the SegmentName Segment AttrParse field to parse it.
Resource Actions
The RACF adapter requires login and logoff resource actions. The login action negotiates an authenticated session with the mainframe. The logoff action disconnects when that session is no longer required.
See Mainframe Examples for more information about creating login and logoff resource actions.
SSL Configuration
Identity Manager uses TN3270 connections to communicate with the resource.
See Mainframe Connectivity for information about setting up an SSL connection to a RACF resource.
Security Notes
This section provides information about supported connections and privilege requirements.
Supported Connections
Identity Manager uses TN3270 to communicate with the RACF adapter.
Required Administrative Privileges
To define or change information in a non-base segment of a user profile, including your own, you must have the SPECIAL attribute or at least UPDATE authority to the segment through field-level access checking.
To list the contents of a user profile or the contents of individual segments of the user profile, use the LISTUSER command.
To display the information in a non-base segment of a user profile, including your own, you must have the SPECIAL or AUDITOR attribute or at least READ authority to the segment through field-level access checking.
Provisioning Notes
The following table summarizes the provisioning capabilities of this adapter.
Feature
Supported?
Enable/disable account
Yes
Rename account
Yes
Pass-through authentication
No
Before/after actions
Yes
Data loading methods
Account Attributes
The following table provides information about RACF account attributes.
Identity Template
$accountId$
Sample Forms
Built-In
None
Also Available
RACFUserForm.xml
Troubleshooting
Use the Identity Manager debug pages to set trace options on the following classes: