2 Deploying the Connector

Deploying the connector involves the following steps:

• Step 1: Verifying Deployment Requirements

• Step 2: Configuring the Target System

• Step 3: Copying the Connector Files

• Step 4: Importing the Connector XML Files

• Step 5: Configuring Reconciliation

• Step 6: Compiling Adapters

Step 1: Verifying Deployment Requirements

The following table lists the deployment requirements for the connector.

Item	Requirement
Oracle Identity Manager	Oracle Identity Manager release 8.5.3 or later
Target system	The target system can be any one of the following: RSA Authentication Manager 6.0.2 RSA Authentication Manager 6.0 RSA ACE Server 5.2 RSA ACE Server 5.0
Target system host platforms	The target system host platform can be any one of the following: Microsoft Windows 2000 Server for RSA ACE Server 5.0 and RSA ACE Server 5.2 Microsoft Windows 2003 Server for RSA Authentication Manager 6.0.2, RSA Authentication Manager 6.0, and RSA ACE Server 5.2 Solaris 9 for RSA Authentication Manager 6.0.2, RSA Authentication Manager 6.0, and RSA ACE Server 5.2
Infrastructure requirements	JDK The version of JDK on which Oracle Identity Manager server is running must be installed on the ACE server.
External applications	RSA SecurID software token application See Also: The "Step 5: Configuring Reconciliation" section for more information about this requirement.

Step 2: Configuring the Target System

Configuring the target system involves the following steps:

• Setting Up the Remote Manager

• Configuring Strong Authentication Between Oracle Identity Manager and the Remote Manager

• Configuring SSL Client (Oracle Identity Manager Server) Authentication

Setting Up the Remote Manager

You must set up a remote manager on the RSA Authentication Manager server in a directory such as XL_REMOTE.

Note:

For Solaris, you must create an ACE administrator as a preinstallation requirement for RSA Authentication Manager. This administrator is the file owner of the RSA Authentication Manager installation. Use the same ACE admin credentials to install the remote manager.

1. Create the authmgr_home directory in the RSA Authentication Manager. From the installation media directory, copy the remotePackage directory into the authmgr_home directory.

   For Solaris 9

   Log in to the Solaris server by using the user credentials of the RSA Authentication Manager File Owner that was created as a preinstallation requirement for RSA Authentication Manager. Then, create the authmgr_home directory.

   Note:

   If you copy files from Microsoft Windows to Solaris, all data transfer from the FTP client must be performed in binary mode. In addition, after copying files to the Solaris server, you must check the files for the ^M character pattern.

   You must also perform required operations, such as dos2unix. As described earlier, copy all the files while using the ACE admin credentials.

2. To update the class files, copy the authmgr_home\lib\xliACE.jar file to the XL_REMOTE\xlremote\JavaTasks directory.

3. Update the library files by editing the following file:

   XL_REMOTE\xlremote\remotemanager.bat
   
   

   In this file, depending on your system environment, set one of the following parameters as the first line of the file:

   For ACE 5.2:

   set PATH=authmgr_home\lib\ACE52;%PATH%
   
   

   For ACE 5.0:

   set PATH=authmgr_home\lib\ACE50;%PATH%
   
   

   For RSA Authentication Manager 6.0:

   set PATH=authmgr_home\lib\AuthMgr60;%PATH%
   
   

   For Solaris 9:

   Update the file by adding the following lines:

   XL_REMOTE/xlremote/remotemanager.sh
   
   

   AUTHMGR_HOME=authmgr_home
   export AUTHMGR_HOME
   ACE_INSTALL=ace_installation
   export ACE_INSTALL
   USR_ACE=$ACE_INSTALL/prog
   export USR_ACE
   VAR_ACE=$ACE_INSTALL/data
   export VAR_ACE
   DLC=$ACE_INSTALL/rdbms
   export DLC
   PROPATH=$ACE_INSTALL/prog/proapi/adbapi.pl:$ACE_INSTALL/prog/proapi/sdproapi.pl:$ACE_INSTALL/prog/protrig:$ACE_INSTALL/prog
   export PROPATH
   
   

   Note:

   In the third line, ace_installation is the directory in which RSA ACE Server 5.0 is installed.

   For RSA Authentication Manager 6.0 and 6.0.2, add the following line:

   LD_LIBRARY_PATH=$ACE_INSTALL/prog:$AUTHMGR_HOME/lib/AuthMgr60Sol
   
   

   For RSA ACE 5.2, add the following line:

   LD_LIBRARY_PATH=$ACE_INSTALL/prog:$AUTHMGR_HOME/lib/ACE52Sol
   
   

   Then, add the following line:

   export LD_LIBRARY_PATH
   
   

4. For RSA ACE Server 5.0, copy the ace_installation\AuthManager\utils\toolkit\apidemon.exe file into the XL_REMOTE\xlremote\ directory.

   Here, ace_installation is the directory in which RSA ACE Server 5.0 is installed.

Configuring Strong Authentication Between Oracle Identity Manager and the Remote Manager

To configure strong authentication between Oracle Identity Manager and the remote manager:

1. From the Oracle Identity Manager server, copy the xellerate_home\xellerate\config\xlserver.cert file to the authmgr_home\scripts\config\ directory in the RSA Authentication Manager.

2. Open the following file:

   authmgr_home\scripts\AuthMgrImportXLCert.bat
   
   

   In this file, set the following parameters:

   set JAVA_HOME=JDK_HOME
   set XL_REMOTE=XL_REMOTE
   
   

   For Solaris 9, set the following parameters in the authmgr_home/scripts/AuthMgrImportXLCert.sh file:

   export XL_REMOTE=XL_REMOTE
   export JAVA_HOME=JDK_HOME
   
   

3. Run the AuthMgrImportXLCert.bat file.

   For Solaris 9, run the AuthMgrImportXLCert.sh file.

Configuring SSL Client (Oracle Identity Manager Server) Authentication

To configure SSL client (Oracle Identity Manager Server) authentication:

1. Open the XL_REMOTE\xlremote\config\xlconfig.xml file.

2. In the <RMSecurity> section of this file, change the value of the <ClientAuth> element to true.

   The following is a code block from the xlconfig.xml file:

   <RMSecurity>
     <RMIOverSSL>true</RMIOverSSL>
     <SSLPort>12345</SSLPort>
     <SSLContextAlgorithm>TLS</SSLContextAlgorithm>
     <KeyManagerFactory>SunX509</KeyManagerFactory>
     <BindingPort>12346</BindingPort>
     <ServiceName>RManager</ServiceName>
     <LoggerConfigFilePath> log.conf</LoggerConfigFilePath>
     <ClientAuth>true</ClientAuth>
   </RMSecurity>
   
   

Multiple Oracle Identity Manager Servers Communicating with a Single Remote Manager

If a setup involves more than one Oracle Identity Manager server communicating with a single remote manager, then you must address the considerations described in this section.

The xellerate_home\xellerate\config\xlserver.cert certificate for any Oracle Identity Manager installation would have the same dname value. If you have imported this certificate from one Oracle Identity Manager installation into the target system remote manager keystore, then you cannot directly use the same certificate from another installation for the same purpose and in the same manner.

Therefore, if one Oracle Identity Manager installation is already configured with a particular remote manager and the same is needed for another Oracle Identity Manager installation, then you must first create a certificate with a different DN for the second installation before you can use this new certificate with remote manager.

Enter the following commands in the specified order. You must provide the corresponding values of JDK_HOME and xellerate_home in these commands.

1. First command

   JDK_HOME\jre\bin\keytool -genkey -alias xell2 -keyalg DSA -keysize 1024 -dname "CN=Customer1, OU=Customer, O=Customer, L=City, ST=NY, C=US" -validity 3650 -keypass xellerate -keystore xellerate_home\xellerate\config\.xlkeystore -storepass xellerate -storetype jks -provider sun.security.provider.Sun
   
   

   When you run this command, ensure that the dname value specified in the preceding command, is not same as the default value of dname, for the existing certificates in the Oracle Identity Manager keystore:

   xellerate_home\xellerate\config\.xlkeystore
   
   

   The default value is as follows:

   CN=Customer, OU=Customer, O=Customer, L=City, ST=NY, C=US
   
   

2. Second command

   JDK_HOME\jre\bin\keytool -certreq -alias xell2 -file
   xellerate_home\xellerate\config\xell1.csr -keypass xellerate -keystore
   xellerate_home\xellerate\config\.xlkeystore -storepass xellerate -storetype jks -provider sun.security.provider.Sun
   
   

3. Third command

   JDK_HOME\jre\bin\keytool -export -alias xell2 -file
   xellerate_home\xellerate\config\xlserver1.cert -keypass xellerate -keystore 
   xellerate_home\xellerate\config\.xlkeystore -storepass xellerate -storetype jks -provider sun.security.provider.Sun
   
   

   This command creates the following security certificate:

   xellerate_home\xellerate\config\xlserver1.cert
   
   

   This is the certificate that you must use for configuration purposes.

4. Fourth command

   JDK_HOME\jre\bin\keytool -import -trustcacerts -alias xel2trusted -noprompt -keystore
   xellerate_home\xellerate\config\.xlkeystore -file
   xellerate_home\xellerate\config\xlserver1.cert -storepass xellerate
   
   

For configuring strong authentication between another Oracle Identity Manager Server installation and remote manager, use the xellerate_home\xellerate\config\xlserver1.cert file instead of the xlserver.cert file.

Step 3: Copying the Connector Files

The connector files to be copied and the directories to which you must copy them are given in the following table.

Note:

The directory paths given in the first column of this table correspond to the location of the connector files in the following ZIP file on the installation media:

Collaboration and Messaging Applications\IBM Lotus Notes Domino\IBM Lotus Notes Domino Rev 1.0.0.zip

Refer to the "Files and Directories That Comprise the Connector" section for more information about these files.

File in the Installation Media Directory	Destination Directory
The following files in the xml directory: xliAuthMgrUser_DM.xml xliAuthMgrToken_DM.xml xliAuthMgrScheduledTask_DM.xml	xellerate_home\xellerate\XLIntegrations\AuthManager\xml
lib\xliACE.jar	xellerate_home\xellerate\JavaTasks xellerate_home\xellerate\ScheduleTask
For Microsoft Windows, copy the following file: scripts\AuthMgrImportXLCert.bat For Solaris, copy the following file: scripts\AuthMgrImportXLCert.sh	xellerate_home\xellerate\XLIntegrations\AuthManager\scripts
The following contents of the tests directory: config\config.properties lib\xliACETestClient.jar scripts\runTestClient.bat	xellerate_home\xellerate\XLIntegrations\AuthManager\tests
The following contents of the docs directory: B31132_01.pdf html	xellerate_home\xellerate\XLIntegrations\AuthManager\docs

Note:

Instructions to copy the contents of the remotePackage installation media directory have been covered in the "Step 2: Configuring the Target System" section.

Step 4: Importing the Connector XML Files

To import the connector XML files into Oracle Identity Manager:

1. Open the Oracle Identity Manager Administrative and User Console.

2. Click the Deployment Management link on the left navigation bar.

3. Click the Import link under Deployment Management. A dialog box for locating files is displayed.

4. Locate and open the xliAuthMgrUser_DM.xml file, which is in the xellerate_home\xellerate\XLIntegrations\AuthManager\xml directory. Details of this XML file are shown on the File Preview page.

5. Click Add File. The Substitutions page is displayed.

6. Click Next. The Confirmation page is displayed.

7. Click Next. The Provide IT Resource Instance Data page for the ACE Remote Manager IT resource is displayed.

8. Specify values for the parameters of the ACE Remote Manager IT resource. Refer to the table in the "IT Resource: ACE Remote Manager" section for information about the values to be specified.

9. Click Next. The Provide IT Resource Instance Data page for a new instance of the Remote Manager IT resource type is displayed.

10. Click Skip to specify that you do not want to define another IT resource. The Provide IT Resource Instance Data page for the ACE Server - Remote IT resource is displayed.

    See Also:

    If you want to define another IT resource, then refer to Oracle Identity Manager Tools Reference Guide for instructions.

11. Specify values for the parameters of the ACE Server - Remote IT resource. Refer to the table in the "IT Resource: ACE Server - Remote" section for information about the values to be specified.

12. Click Next. The Provide IT Resource Instance Data page for a new instance of the ACE Server IT resource type is displayed.

13. Click Skip to specify that you do not want to define another IT resource. The Confirmation page is displayed.

    See Also:

    If you want to define another IT resource, then refer to Oracle Identity Manager Tools Reference Guide for instructions.

14. Click View Selections.

    The contents of the XML file are displayed on the Import page. You may see a cross-shaped icon along with some nodes. You must remove these nodes. To do this, right-click each such node and then select Remove.

15. Click Import. The connector XML file is imported into Oracle Identity Manager.

16. Perform this procedure again to import the remaining connector XML files in the following order:

    xliAuthMgrToken_DM.xml
    xliAuthMgrScheduledTask_DM.xml
    
    

    These files are in the xellerate_home\xellerate\XLIntegrations\AuthManager\xml directory.

    Note:

    If you do not import the connector files in the correct order, then the connector may not work.

Defining IT Resources

This section provides information about the IT resources defined in the xliAuthMgrUser_DM.xml file.

IT Resource: ACE Remote Manager

You must specify values for the ACE Remote Manager IT resource parameters listed in the following table.

Parameter Name	Parameter Description
service name	RManager
url	rmi://10.1.1.114:12346

IT Resource: ACE Server - Remote

You must specify values for the ACE Remote Manager IT resource parameters listed in the following table.

Parameter Name	Parameter Description
ACEAdminMode	Host
ACEAdminPassCode	123456 This value is encrypted after it is saved.
ACEAdminUserId	jdoe

Step 5: Configuring Reconciliation

You can use the RSA Authentication Manager connector to perform reconciliation in trusted mode. The prerequisite steps to implement this are as follows:

1. Open the Resource Object form.

2. Search for the Xellerate User.

3. On the Object Reconciliation tab, add reconciliation fields as required. Add all those reconciliation fields that would be needed to provide input for the mandatory fields in the Xellerate User form, such as User Login and First Name. Although the Password field is a mandatory field, it can be ignored.

4. Open the Process Definition form.

5. Search for the Xellerate User.

6. On the Reconciliation Field Mappings tab, add the reconciliation field mappings as required. Ensure that mappings to all mandatory fields of the User Defined process form are present.

7. Open the Reconciliation Rules form.

8. Create a new rule for Object Xellerate User, with a rule element as required.

9. After you create the rule, select the Active check box.

To set up the remote manager as a trusted source for Oracle Identity Manager:

1. In RSA Authentication Manager, copy the XL_REMOTE\xlremote\config\xlserver.cert file to the following directory:

   xellerate_home\xellerate\XLIntegrations\AuthManager\scripts\config\
   
   

2. Open the following file in a text editor:

   xellerate_home\xellerate\XLIntegrations\AuthManager\scripts\AuthMgrImportRMCert.bat
   
   

   In this file, configure the following entries:

   set JAVA_HOME = jdk_home
   set XELLERATE_HOME = xellerate_home
   
   

   For Oracle Identity Manager installed on Solaris 9 or Red Hat Linux AS 2.1, open the following file in a text editor:

   xellerate_home/xellerate/XLIntegrations/AuthManager/scripts/AuthMgrImportRMCert.sh
   
   

   In this file, configure the following entries:

   export JAVA_HOME = jdk_home
   export XELLERATE_HOME = xellerate_home
   
   

3. Run the AuthMgrImportRMCert.bat file.

   For Oracle Identity Manager installed on Solaris 9 or Red Hat Linux AS 2.1, run the AuthMgrImportRMCert.sh file.

Software Tokens

Using this connector, for running provisioning functions that are specific to software tokens, you would need to provide the required input parameters, such as the Token Code.

You can determine all such token-specific parameters only after RSA Software Token application is installed on the Oracle Identity Manager server desktop or user desktop, other than the Oracle Identity Manager server.

If you are using RSA SecurID software tokens, then:

1. Download the RSA SecurID Token for Windows Desktops 3.0.5 from

   http://www.rsasecurity.com/node.asp?id=1162

2. Install the file on the Oracle Identity Manager server.

3. Copy the RSA SecurID software token file to an appropriate location on the Oracle Identity Manager server. The file to be copied is in the RSA Authentication Manager installation directory. The format of the directory path where you copy this file can be as follows:

   target_dir_location\Token1File\
   
   

   Note:

   While assigning a software token to an ACE user, you must specify the name and complete location of this file (in the DB_FILE_LOCATION\FILE_NAME.sdtid format) in the Software Token File Name process form field.

4. To import the .sdtid file into the RSA SecurID Token software application:

   1. Click Start, and then select Programs.

   2. Click RSA SecurID Software Token, and select the subcategory RSA SecurID Software Token.

      The token screen is displayed.

   3. Click the File menu, and then select Import Tokens. In the dialog box that is displayed, select the .sdtid file mentioned in Step 3.

      For example:

      target_dir_location\Token1File\FILE_NAME.sdtid
      
      

   4. Select the token serial number, and click Transfer Selected Tokens to Hard Drive. The software token is imported.

   5. On the screen that is displayed, click View and then select Advanced View.

   6. On the screen that is displayed, click View and then select Token View to view the software token number.

Defining Scheduled Tasks

Configuring reconciliation involves creating scheduled tasks for Lookup Fields and User reconciliations. To create a scheduled task:

1. Open the Oracle Identity Design Console.

2. Expand the Xellerate Administration folder.

3. Select Task Scheduler.

4. Click Find. The details of the predefined scheduled tasks are displayed on two different tabs.

5. Enter a number in the Max Retries field. This number represents the number of times Oracle Identity Manager attempts to complete the task before assigning the ERROR status to the task.

6. Ensure that the Disabled and Stop Execution check boxes are cleared.

7. In the Start region, double-click the Start Time field. From the date-time editor that is displayed, set the date and time at which you want the task to run.

8. Specify that you want the task to run on a recurring basis by selecting the Recurring Intervals option.

9. In the Interval region, set the following schedule parameters:

   • To set the task to run on a recurring basis, select the Daily, Weekly, Recurring Intervals, Monthly, or Yearly option.

     If you select the Recurring Intervals option, then you must almost specify the time interval at which you want to run the task on a recurring basis.

   • To set the task to run only once, select the Once option.

10. Provide values for the user-configurable attributes of the scheduled task. Refer to the following table for information about the values to be specified.

    See Also:

    Oracle Identity Manager Design Console Guide for information about adding and removing task attributes

    Attribute Name	Description	Sample Value
    Server	Name of the IT Resource	ACE Server Remote
    Target System Recon - Resource Object name	Name of the target system resource object	Auth Manager User
    Target System Recon - Token Resource Object name	Name of the target system resource object	Auth Manager Token
    Trusted Source Recon - Resource Object name	Name of the trusted source Resource Object	Xellerate User

    
    

11. Click Save. The scheduled task is created. The INACTIVE status is displayed in the Status field, because the task is not currently running. The task is run at the date and time that you set in Step 7.

12. Repeat Step 5 through 11 to define the second scheduled task.

Step 6: Compiling Adapters

The following adapters are imported into Oracle Identity Manager when you import the connector XML file. You must compile these adapters before you can use them to provision accounts on the target system.

• ACE ASSIGN TO GROUP

• ACE DELETE USER

• ACEASSIGNTOGROUP

• ACE CREATE USER

• ACE PrePop DefLogin

• ACE PrePop FirstName

• ACE PrePop GrpLogin

• ACE PrePop LastName

• ACE ASSIGN TOKEN

• ACE REMOVE TOKEN

• ACE DISABLE TOKEN

• ACE SET PIN

• ACE SET PIN TO NTC

• ACE TRACK LOST TOKEN

• ACE ENABLE TOKEN

• ACE TEST LOGIN

To compile adapters by using the Adapter Manager form:

1. Open the Adapter Manager form.

2. To compile all the adapters that you have imported into the current database, select the Compile All option.

   To compile multiple (but not all) adapters, select the adapters you want to compile. Then, select the Compile Selected option.

   Note:

   Click Compile Previously Failed to recompile only those adapters that were not compiled successfully. Such adapters do not have an OK compilation status.

3. Click Start. Oracle Identity Manager compiles the adapters that you specify.

To view detailed information about an adapter:

1. Highlight the adapter in the Adapter Manager form.

2. Double-click the row header of the adapter, or right-click the adapter.

3. Select Launch Adapter from the shortcut menu that is displayed. Details of the adapter are displayed.

Note:

To compile multiple adapters simultaneously, use the Adapter Manager form. To compile one adapter at a time, use the Adapter Factory form. Refer to Oracle Identity Manager Tools Reference Guide for information about how to use these forms.

Security Considerations

You must address the following security considerations before you start using the connector:

• There must be a trust relationship between Oracle Identity Manager and the remote manager. To achieve this, you must import the required certificate from the remote manager keystore to the Oracle Identity Manager server keystore.

• The remote manager provides the Client Authentication feature of SSL. This feature has been used in this connector to provide additional security. You must perform the prerequisite configuration steps described in Chapter 2, "Deploying the Connector" to enable this security feature.