2 Deploying the Connector

Deploying the connector involves the following steps:

• Step 1: Verifying Deployment Requirements

• Step 2: Configuring the Target System

• Step 3: Configuring the Oracle Identity Manager Server

• Step 4: Copying the Connector Files and External Code

• Step 5: Importing the Connector XML Files

• Step 6: Configuring Reconciliation

• Step 7: Compiling Adapters

• Step 8: Configuring SSL

Step 1: Verifying Deployment Requirements

The following table lists the deployment requirements for the connector.

Item	Requirement
Oracle Identity Manager	Oracle Identity Manager release 8.5.3 or later
Target systems	Oracle Internet Directory
Target system host platforms	The target system host platform can be any one of the following: Red Hat Linux AS 2.1 Microsoft Windows 2000 Solaris 9

Step 2: Configuring the Target System

You must add a custom object class and custom attribute to the Oracle Internet Directory schema for the provisioning and reconciliation of user roles.

To add a custom object class and custom attribute:

1. Ensure that Oracle Internet Directory is running.

2. Copy the contents of the Batch\custom directory from the installation media ZIP file to a directory on the target Oracle Internet Directory server. You must ensure that the contents of the Batch\custom are kept in the same directory.

3. Using any text editor, open the custom.bat file.

4. In the fields indicated in the custom.bat file, provide the host name, port, and Oracle Internet Directory superuser DN and password.

   The following is the syntax for providing these values:

   ldapmodify -h hostname -p port_number -D SuperUser_DN -w SuperUser_Password -c -f customRoleOccupant.ldif
   ldapadd -h hostname -p port_number -D SuperUser_DN -w SuperUser_Password -c -f customIndex.ldif
   ldapmodify -h hostname -p port_number -D SuperUser_DN -w SuperUser_Password -c -f customOrganizationalRole.ldif
   
   

   For example:

   ldapmodify -h bk2b3f-2809 -p 4389 -D "cn=orcladmin" -w "welcome" -c -f customRoleOccupant.ldif
   ldapadd -h bk2b3f-2809 -p 4389 -D "cn=orcladmin" -w "welcome" -c -f customIndex.ldif
   ldapmodify -h bk2b3f-2809 -p 4389 -D "cn=orcladmin" -w "welcome" -c -f customOrganizationalRole.ldif
   
   

5. Run the custom.bat file.

6. Open Oracle Directory Manager and click Schema Management in the left pane. The details of all schema elements are displayed in the right pane. You can check if the customOrganizationalRole object class and customRoleOccupant attributes have been added to their respective categories.

Step 3: Configuring the Oracle Identity Manager Server

In the xlconfig.xml file, you must provide a higher value, 50,000 or more, for the checkouttimeout attribute. This XML file is in the xellerate_home\xellerate\config directory. You must modify the checkouttimeout attribute value to ensure that the connector XML files are imported correctly.

Step 4: Copying the Connector Files and External Code

The connector files to be copied and the directories to which you must copy them are given in the following table.

Note:

The directory paths given in the first column of this table correspond to the location of the connector files in the following ZIP file on the installation media:

Directory Servers\Oracle Internet Directory\Oracle Internet Directory Rev 2.0.0.zip

Refer to "Files and Directories That Comprise the Connector" for more information about these files.

File in the Installation Media Directory	Destination Directory
The following files in the xml directory: oimOIDUser.xml oimUser.xml	xellerate_home\xellerate\OID\xml
lib\xliOID.jar	xellerate_home\Xellerate\JavaTasks
The following files in the Batch\custom directory: custom.bat customIndex.ldif customOrganizationalRole.ldif customRoleOccupant.ldif readme.txt	If you have performed the procedure in the "Step 2: Configuring the Target System" section, then you have already copied the contents of the Batch\custom directory to a directory on the Oracle Internet Directory server.
The following files in the troubleshoot directory: config.properties log4j-1.2.9.jar log.properties tcUtilTestOID.class testcreate.bat testdelete.bat testmodify.bat xliOID.jar xlLogger.jar xlUtils.jar	xellerate_home\xellerate\troubleshoot
The following contents of the docs directory: B31128_01.pdf html	xellerate_home\xellerate\OID\docs

Step 5: Importing the Connector XML Files

To import the connector XML files:

1. Open the Oracle Identity Manager Administrative and User Console.

2. Click the Deployment Management link on the left navigation bar.

3. Click the Import link under Deployment Management. A dialog box for locating files is displayed.

4. Locate and open the oimOIDUser.xml file, which is in the xellerate_home\xellerate\OID\xml directory. Details of this XML file are shown on the File Preview page.

5. Click Add File. The Substitutions page is displayed.

6. Click Next. The Confirmation page is displayed.

7. Click Next. The Provide IT Resource Instance Data page for the OID Server IT resource is displayed.

8. Specify values for the parameters of the OID Server IT resource. Use the table given in the "Defining IT Resources" section on page 2-3 for information about the values to be specified.

9. Click Next. The Provide IT Resource Instance Data page for a new instance of the LDAP Server IT resource type is displayed.

10. Click Skip to specify that you do not want to define another IT resource. The Confirmation page is displayed.

11. Click View Selections.

    The contents of the XML file are displayed on the Import page. You may see a cross-shaped icon along with some nodes. You must remove these nodes. To do this, right-click each such node and then select Remove.

12. Click Import. The connector XML file is imported into Oracle Identity Manager.

13. If you plan to use the connector in trusted source reconciliation mode, then perform the same procedure to import the oimUser.xml file. This file is in the xellerate_home\xellerate\OID\xml directory.

    Caution:

    Only one connector can be configured as a trusted source. If you import the oimUser.xml file while you have another trusted source configured, then both connector reconciliations would stop working.

After you import the connector XML files, proceed to the "Step 6: Configuring Reconciliation" section.

Defining IT Resources

You must specify values for the OID Server IT resource parameters listed in the following table.

Parameter Name	Parameter Description
Admin Id	DN value of the user who has admin rights on the Oracle Internet Directory server Sample value: cn=Admin,ou=People, o=xyz
Admin Password	Password of the user who has admin rights on the target Oracle Internet Directory server
Server Address	IP address of the Oracle Internet Directory server
Port	Port number to connect to the Oracle Internet Directory server Sample value: 389
Root DN	Base DN on which all the user operations are to be carried out Sample value: dc=host_name, dc=com Here, host_name is the host name under which the oracle context is created.
SSL	If this parameter is set to true, then SSL is used to secure communication between Oracle Identity Manager and the Oracle Internet Directory server. In this case, the authentication certificate of the Oracle Internet Directory server must be imported into the Oracle Identity Manager server. If this parameter is set to false, then there is no secure communication between Oracle Identity Manager and the Oracle Internet Directory server.
Prov Attribute Lookup Code	Name of the lookup definition that has the target attribute mappings required for provisioning The value must be AttrName.Prov.Map.OID.
Recon Attribute Lookup Code	Name of the lookup definition that has the target attribute mappings required for reconciliation The value must be AttrName.Recon.Map.OID.
Use XL Org Structure	If set to true, then the Oracle Identity Manager Organization structure is used during provisioning and reconciliation. If set to false, then the value of the Organization field in the process form is used for provisioning and the organization or container in the target Oracle Internet Directory is used for reconciliation.
Last Recon TimeStamp	This parameter does not contain a value for the initial load of reconciliation. After the first reconciliation operation is run, the time at which the reconciliation was completed is stored in this parameter. This value is updated each time reconciliation is performed. The user does not need provide any value for this parameter. After the first reconciliation, the value is automatically created in its own format. Sample value: 20060524110907Z

After you specify values for these IT resource parameters, go to Step 9 of the procedure to import connector XML files.

Step 6: Configuring Reconciliation

Configuring reconciliation involves creating scheduled tasks for lookup fields and user reconciliations. To create these scheduled tasks:

1. Open the Oracle Identity Manager Design Console.

2. Expand the Xellerate Administration folder.

3. Select Task Scheduler.

4. Click Find. The details of the predefined scheduled tasks are displayed on two different tabs.

5. Enter a number in the Max Retries field. This number represents the number of times Oracle Identity Manager should attempt to complete the task before assigning the ERROR status to the task.

6. Ensure that the Disabled and Stop Execution check boxes are cleared.

7. In the Start region, double-click the Start Time field. From the date-time editor that is displayed, select the date and time at which you want the task to run.

8. In the Interval region, set the following schedule parameters:

   • To set the task to run on a recurring basis, select the Daily, Weekly, Recurring Intervals, Monthly, or Yearly option.

     If you select the Recurring Intervals option, then you must also specify the time interval at which you want the task to run on a recurring basis.

   • To set the task to run only once, select the Once option.

9. Provide values for the attributes of the scheduled task. Refer to the appropriate table in the "Specifying Values for the Scheduled Task Attributes"section for information about the values to be specified.

   See Also:

   Oracle Identity Manager Design Console Guide for information about adding and removing task attributes

10. Click Save. The scheduled task is created. The INACTIVE status is displayed in the Status field, because the task is not currently running. The task is run at the date and time that you set in Step 7.

11. Repeat Steps 5 through 10 to create the second scheduled task.

After you create both scheduled tasks, proceed to the "Step 7: Compiling Adapters" section.

Specifying Values for the Scheduled Task Attributes

This section provides information about the values to be specified for the following scheduled tasks:

• Lookup Fields Reconciliation Scheduled Tasks

• User Reconciliation Scheduled Tasks

Lookup Fields Reconciliation Scheduled Tasks

You must specify values for the following attributes of the lookup fields reconciliation scheduled task.

Note:

Attribute values are predefined in the connector XML file that you import. Specify values only for those attributes that you want to change.

Attribute Name	Description	Default/Sample Value
LookupCodeName	Name of the lookup definition to which the master values are to be reconciled	Lookup.OID.Groups (for Groups lookup reconciliation) Lookup.OID.Roles (for Roles lookup reconciliation)
ITResourceName	Name of the IT resource for setting up the connection to Oracle Internet Directory	OID Server
SearchContext	Search context to be used for searching the master values	DC=mycompany,DC=com
ObjectClass	Object class name of the master value for which lookup fields reconciliation is being performed	groupOfUniqueNames (for Groups lookup reconciliation) customRoleOccupant (for Roles lookup reconciliation)
CodeKeyLTrimStr	String value for left-trimming the value obtained from the search, such as cn=. If there is nothing to be trimmed, then specify the value [NONE].	[NONE]
CodeKeyRTrimStr	String value for right-trimming the value obtained from the search, such as ',DC=mycompany,DC=com'. If there is nothing to be trimmed, then specify the value [NONE].	,DC=mycompany,DC=com
ReconMode	Specify REFRESH to completely refresh the existing lookup. Specify UPDATE to update the lookup with the new values.	REFRESH or UPDATE

Note:

The CodeKeyLTrimStr and CodeKeyRTrimStr attributes control the value that becomes the code key of the lookup definition. The description of the value is the cn of the master value.

After you specify values for these task attributes, go to Step 10 of the procedure to create scheduled tasks.

User Reconciliation Scheduled Tasks

You must specify values for the following attributes of the user reconciliation scheduled task.

Note:

Attribute values are predefined in the connector XML file that you import. Specify values only for those attributes that you want to change.

Attribute Name	Description	Default/Sample Value
ITResourceName	Name of the IT resource for setting up a connection to Oracle Internet Directory	OID Server
ResourceObjectName	Name of the resource object into which users are to be reconciled	OID User
XLDeleteUsersAllowed	If this attribute is set to true, then the Delete reconciliation event is started. Users who are deleted from the target system are removed from Oracle Identity Manager. This requires all the users on the target system to be compared with all the users in Oracle Identity Manager. Note: This process affects performance.	true or false
UserContainer	DN value from where the users are reconciled from the target system to Oracle Identity Manager	cn=users,dc=hostname,dc=com Here, users is the name of the user container and hostname is the host name under which the oracle context is created.
Keystore	Directory path to the Oracle Internet Directory keystore This is required to set up an SSL connection. Specify [NONE] for a non-SSL connection.	C:\j2sdk1.4.2_09\jre\lib\security\cacerts or [NONE]
IsTrusted	Configurable option. Specify True or False.	True or False
Organization	Default organization of the Xellerate User	Xellerate Users
Xellerate Type	Type of Xellerate User It is a configurable value.	End-User Administrator
Role	Default role of the Xellerate User	Consultant
Password	Default password of the Xellerate User	Admin123

After you specify values for these task attributes, go to Step 10 of the procedure to create scheduled tasks.

Step 7: Compiling Adapters

The following adapters are imported into Oracle Identity Manager when you import the connector XML file. You must compile these adapters before you can use them to provision accounts on the target system.

• OID Create User

• OID Delete User

• OID Modify User

• OID Move User

• OID Add User to Group

• OID Remove User from Group

• OID Add User to Role

• OID Remove User from Role

• OID Prepop String

To compile adapters by using the Adapter Manager form:

1. Open the Adapter Manager form.

2. To compile all the adapters that you import into the current database, select the Compile All option.

   To compile multiple (but not all) adapters, select the adapters you want to compile. Then, select the Compile Selected option.

3. Click Start. Oracle Identity Manager compiles the adapters that you specify.

To view detailed information about an adapter:

1. Highlight the adapter in the Adapter Manager form.

2. Double-click the row header of the adapter, or right-click the adapter.

3. Select Launch Adapter from the shortcut menu that is displayed. Details of the adapter are displayed.

Note:

To compile multiple adapters simultaneously, use the Adapter Manager form. To compile one adapter at a time, use the Adapter Factory form. Refer to Oracle Identity Manager Tools Reference Guide for information about how to use these forms.

Step 8: Configuring SSL

Note:

If the SSL IT resource parameter is set to False, then this is an optional step of the deployment procedure.

To set up SSL connectivity between Oracle Identity Manager and the Oracle Internet Directory server:

1. Export the Oracle Internet Directory Server certificate using Wallet Manager.

2. Check if the Oracle Internet Directory server is listening on the SSL port. If it is not, then set it to the SSL port (default SSL port is 636), and restart the server.

3. Import the certificate from the target system into the JSDK (the JSDK that is used during installation of Oracle Identity Manager) cacerts keystore as follows:

   keytool -import -file certificate_file_name -alias ndscert -keystore java_home\lib\security\cacerts
   
   

4. Restart the Oracle Identity Manager server.

5. In the OID Server IT resource:

   • Set the SSL parameter value to true.

   • Change the Port parameter value to the SSL port number. Typically, this number is 636.