| Oracle® Identity Manager Connector Guide for UNIX Telnet Release 9.0.1 Part Number B31141-01 |
|
|
View PDF |
| Oracle® Identity Manager Connector Guide for UNIX Telnet Release 9.0.1 Part Number B31141-01 |
|
|
View PDF |
Deploying the connector involves the following steps:
The following table lists the deployment requirements for the connector.
Configuring the target system involves the steps described in the following sections:
This section provides instructions to configure the target system on the following platforms:
Perform the following steps for Solaris and Linux environments:
Ensure that the /etc/passwd and /etc/shadow directories are available on the UNIX server.
Ensure that a passwd mirror file is created on the target server by using a command similar to the following:
cp /etc/passwd/etc/passwd1
The same file name with the path must be inserted in the Passwd Mirror File/User Mirror File (AIX) task attribute of the reconciliation scheduled task.
Ensure that a shadow mirror file is created on the target server by using a command similar to the following:
cp /etc/shadow/etc/shadow1
The name and path of this file must be specified for the Shadow Mirror File attribute of the scheduled task for reconciliation.
Perform the following steps for AIX environments:
Ensure that the /etc/passwd and /etc/security/user files are available on the server.
Ensure that a user mirror file is created on the server by using a command similar to the following:
lsuser -c -a id pgrp gecos home shell expires maxage ALL > /mainUserFile1 tr '#' ' ' < /mainUserFile1 > /mainUserFileTemp1 cat /mainUserFileTemp1 > /mainUserFile1
The name and path of this file must be specified for the Passwd Mirror File/User Mirror File (AIX) attribute of the scheduled task for reconciliation.
Note:
If you are using an HP-UX configuration, then start from Step 1. Otherwise, go to Step 5.Log in as root by specifying the user name as sam.
Click Enter.
Select to Auditing and Security and System Security Policies. A message is displayed asking if you want to convert from the system to the trusted mode.
Click OK.
If the following message is displayed, then skip Step 5:
System changed successfully to trusted system
Ensure that the /etc/passwd and /etc/shadow directories are available on the target server.
If the shadow file does not exist, then follow the installation instructions at
http://www.software.hp.com/portal/swdepot/displayInstallInfo.do?productNumber=ShadowPassword
All the patches are available in the HP patch database, which you can download from
The ShadowPW includes new files to support shadow passwords.
The following are required patches:
PHNE_23502, PHCO_24402, PHCO_25526, PHCO_25568, PHCO_27036, PHCO_27038, PHCO_27040, PHCO_27041, PHCO_27042, PHCO_27064, PHCO_28192, PHCO_28194, and PHCO_30402
Do not install a corequisite patch if it is superseded by another patch.
Apply the following guidelines when you install these patches:
When CDE is present, it is very important to install both patch PHSS_26492 and PHSS_26493.
Patch PHCO_28193 must be installed only if UUCP is present.
Patch PHCO_28176 must be installed only if the /usr/lbin/tsconvert command is present.
Patch PHCO_27035 defines the prototypes of new APIs.
Patch PHCO_27909 updates the main pages.
If necessary, patch PHCO_23578 updates the Software Distributor.
An optional patch is not installed if the underlying product is removed from the system. For example, if UUCP has been removed, then patch PHCO_28193 is not installed.
Note:
If UUCP is installed, then in order to ensure correct functioning of the
uucp command in shadow mode, you must also install patch PHCO_28193.To install the bundle:
Log in as root.
Download the ShadowPassword.depot file to the /tmp directory.
Verify that the file has been downloaded by using the swlist command as follows:
swlist -d @ complete_path/ShadowPassword.depot
The following is sample output of the swlist command:
# Initializing... # Contacting target localhost... # # Target: localhost:/tmp/ShadowPassword.depot # Bundle(s): #ShadowPassword B.11.11.02 HP-UX 11.11 Shadow Password Bundle
Note:
When you use theswlist and swinstall commands, you must specify the complete path in the source depot.Create a backup of the system before installing the product.
On a standalone system, run the swinstall command to install the product as follows:
swinstall -x autoreboot=true -s complete_path/ShadowPassword.depot \*
Verify that the ShadowPW.SHADOW file set is installed by using the swlist command as follows:
# swlist -l fileset complete_path/ShadowPW.SHADOW
The following is sample output of this command
# Initializing... # Contacting target "localhost"... # # Target: localhost:/ #ShadowPW.SHADOW B.11.11.02 HP-UX 11.11 Shadow Password Enablement
After the patches are installed, the system can be converted to use shadow passwords by running the pwconv command. This command converts the entries in the /etc/passwd file to the appropriate format in the /etc/shadow file.
Reboot the system. Remember to keep the shadow password handy.
To disable the shadow passwords and switch back to standard passwords:
Log in as root.
Run pwunconv.
Caution:
If you skip this step, then the system may become unbootable in the multiuser mode.Reboot the system.
Ensure that the /etc/shadow file does not exist and that passwords are in the /etc/password file.
You can do this by running the swremove Shadow command.
From the Shadow Password bundle, remove the enabling patches that were installed but are no longer needed. This is an optional step.
Ensure that a password mirror file is created on the server by running a command similar to the following:
cp /etc/passwd /etc/passwd1
The same file name with the path must be inserted in the Passwd Mirror File/User Mirror File (AIX) attribute of the scheduled task for reconciliation.
Ensure that a shadow mirror file is created on the server by running a command similar to the following:
cp /etc/shadow /etc/shadow1
The same file name with the path must be inserted in the Shadow Mirror File attribute of the scheduled task for reconciliation.
The connector files to be copied and the directories to which you must copy them are given in the following table. The directory paths given in the first column of this table correspond to the location of these files on the installation media.
| File in the Installation Media Directory | Destination Directory |
|---|---|
The following files in the xml directory:
|
xellerate_home/xellerate/xml |
lib/801/xliTelnet.jar |
xellerate_home/xellerate/XLIntegrations/Telnet/lib/801
|
lib/xliTelnet.jar |
xellerate_home/xellerate/JavaTasks
|
lib/xliTelnet.jar |
xellerate_home/xellerate/ScheduleTask
|
ext/sshfactory.jar |
xellerate_home/xellerate/ext
|
The following files in the tests directory:
|
xellerate_home/xellerate/tests
|
docs/B31141_01.pdf docs/html |
xellerate_home/xellerate/docs
|
To import the connector files:
Note:
If you do not import the connector files in the specified order, then the connector may not work.Open the Oracle Identity Manager Administrative and User Console.
Click the Deployment Management link on the left navigation bar.
Click the Import link under Deployment Management. A dialog box for locating files is displayed.
Locate and open the XLITelnet_DM.xml file, which is in the xellerate_home/xellerate/XLIntegrations/Telnet/xml directory. Details of this XML file are shown on the File Preview page.
Click Add File. The Substitutions page is displayed.
Click Next. The Confirmation page is displayed.
Click Next. The Provide IT Resource Instance Data page for the Telnet server- Solaris IT resource is displayedSpecify values for the parameters of the Telnet server- Solaris IT resource. Refer to the table in the "Defining IT Resources" section for information about the values to be specifiedClick Next. The Provide IT Resource Instance Data page for a new instance of the TELNET Server IT resource type is displayed.
Click Skip to specify that you do not want to define another IT resource. The Confirmation page is displayed.
See Also:
If you want to define another IT resource, then refer to Oracle Identity Manager Tools Reference Guide for instructions.Click View Selections.
The contents of the XML file are displayed in the Deployment Manager – Import window. You may see a cross-shaped icon along with some nodes. You must remove these nodes. To do this, right-click each such node and then select Remove.
Click Import. The connector file is imported into Oracle Identity Manager.
Perform the same procedure to import the XLITelnetSchedulerTask_DM.xml file, which is in the xellerate_home/xellerate/XLIntegrations/Telnet/xml directory.
If you plan to use the connector in trusted source reconciliation mode, then perform the same procedure to import the XLITelnet_Trusted_DM.xml file. This file is in the xellerate_home/xellerate/XLIntegrations/Telnet/xml directory.
Caution:
Only one connector can be configured as a trusted source. If you import theXLITelnet_Trusted_DM.xml file while you have another trusted source configured, then both connector reconciliations would stop working.After you import the connector XML files, proceed to the "Step 5: Configuring Reconciliation" section.
You must specify values for the Telnet server- Solaris IT resource parameters listed in the following table:
| Parameter Name | Parameter Description |
|---|---|
Admin UserId |
root |
Admin Password |
dead_line |
Server IP Address |
10.1.1.61 |
Port |
23 |
Server OS |
AIX, HP-UX, SOLARIS, or LINUX |
Shell Prompt |
# or $ |
Login Prompt |
login |
Password Prompt |
Password |
Whether Trusted System (HP-UX) |
YES (for trusted HP-UX System) or NO (for nontrusted HP-UX system) |
This section describes the following steps involved in configuring the Oracle IdentityManager server:
This section consists of the following:
To configure system properties:
Open the Oracle Identity Manager Design Console.
Navigate to the System Configuration page.
Add a new entry in the Server category:
Name: Default date format
Keyword: XL.DefaultDateFormat
Value: MMM dd, yyyy 'at' hh:mm:ss z
Click Save.
This procedure involves the following steps:
Open the Resource Object form, and search for the Xellerate User. On the Object Reconciliation tab, add the required reconciliation fields. Add all the reconciliation fields that would be needed to provide input for mandatory fields in the Xellerate User form. For example, fields like User Login and First Name. Only one mandatory field, Password, can be ignored. All the mandatory fields of the User Defined process form must be mapped.
Open the Process Definition form, and search for the Xellerate User. On the Reconciliation Field Mappings tab, add the required reconciliation field mappings. All the mandatory fields of the user defined process form should be mapped.
Open the Reconciliation Rules form, and create a new rule for the Xellerate User resource object, with a rule element.
After creating the rule, select the Active check box.
Configuring reconciliation involves creating scheduled tasks for User reconciliations. To create a scheduled task:
Open the Oracle Identity Design Console.
Expand the Xellerate Administration folder.
Select Task Scheduler.
Click Find. The details of the predefined scheduled tasks are displayed on two different tabs.
Enter a number in the Max Retries field. This number represents the number of times Oracle Identity Manager attempts to complete the task before assigning the ERROR status to the task.
Ensure that the Disabled and Stop Execution check boxes are cleared.
In the Start region, double-click the Start Time field. From the date-time editor that is displayed, set the date and time at which you want the task to run.
Specify that you want the task to run on a recurring basis by selecting the Recurring Intervals option.
In the Interval region, set the following schedule parameters:
To set the task to run on a recurring basis, select the Daily, Weekly, Recurring Intervals, Monthly, or Yearly option.
If you select the Recurring Intervals option, then you must almost specify the time interval at which you want to run the task on a recurring basis.
To set the task to run only once, select the Once option.
Provide values for the user-configurable attributes of the scheduled task. Refer to the appropriate table in the "Specifying Attributes for the Scheduled Task Attributes" section for information about the values to be specified.
See Also:
Oracle Identity Manager Design Console Guide for information about adding and removing task attributesClick Save. The scheduled task is created. The INACTIVE status is displayed in the Status field, because the task is not currently running. The task is run at the date and time that you set in Step 7.
Repeat Steps 5 through 11 to define the second scheduled task.
After you create both scheduled tasks, proceed to the "Step 6: Compiling Adapters" section.
You must specify values for the following attributes of the reconciliation scheduled task.
Note:
Attribute values are predefined in the connector XML file that you import. Specify values only for those attributes that you want to change.| Attribute | Description | Sample Value |
|---|---|---|
Server |
Name of the IT Resource | Telnet server- Solaris |
Passwd Mirror File/User Mirror File |
Name of the passwd mirror file/user mirror file
This attribute is used only on AIX. The SUDO user must have read and write permissions on this file. For example, suppose you run the following command to view the permissions on the mirror file:
The command generates the following output:
In this output, |
/etc/passwd1 |
Shadow Mirror File |
Name of the shadow mirror file
The SUDO user must have read and write permissions on this file. For example, suppose you run the following command to view the permissions on the mirror file:
The command generates the following output:
In this output, Note: The value of this attribute must not be null or blank, even for a trusted system. However, the reconciliation process ignores it. |
/etc/shadow1 |
Target System Recon - Resource Object name |
Name of the target system resource object | Telnet User |
Trusted Source Recon - Resource Object name |
Name of the trusted source resource object | Xellerate User |
After you specify values for these task attributes, go to Step 11 of the procedure to create scheduled tasks.
The following adapters are imported into Oracle Identity Manager when you import the connector XML file. You must compile these adapters before you can use them to provision accounts on the target system.
Telnet Disable User
Telnet Delete User
Telnet Default Shell Updated
Telnet Create User
Telnet Set Password
Telnet User UID Updated
Telnet GECOS Updated
Telnet Home Directory Updated
Telnet Primary Group Name Updated
Telnet Account Expiry Date Updated
Telnet Password Change Time Updated
Telnet Secondary Group Names Updated
Telnet Inactive Days Updated
Telnet User Login Updated
Telnet Enable User
Telnet Prepopulate User Login
Telnet Prepopulate End Date
To compile adapters by using the Adapter Manager form:
To compile all the adapters that you import into the current database, select the Compile All option.
To compile multiple (but not all) adapters, select the adapters you want to compile. Then, select the Compile Selected option.
Note:
Click Compile Previously Failed to recompile only those adapters that were not compiled successfully. Such adapters do not have anOK compilation status.Click Start. Oracle Identity Manager compiles the adapters that match the criteria you specified in Step 2.
To view detailed information about an adapter:
Highlight the adapter in the Adapter Manager form.
Double-click the row header of the adapter, or right-click the adapter.
Select Launch Adapter from the shortcut menu that is displayed. Details of the adapter are displayed.
