| Oracle® Identity Manager Connector Guide for IBM RACF Standard Release 9.0.3 Part Number B32353-01 |
|
|
View PDF |
| Oracle® Identity Manager Connector Guide for IBM RACF Standard Release 9.0.3 Part Number B32353-01 |
|
|
View PDF |
Deploying the connector involves the following steps:
If you want to configure the connector for multiple installations of IBM RACF, then perform the following procedure:
The following table lists the deployment requirements for the connector.
| Item | Requirement |
|---|---|
| Oracle Identity Manager | Oracle Identity Manager release 8.5.3 or later |
| Target systems | IBM Mainframe Server |
| Target system host platforms | RACF on z/OS 1.4 |
| External code | The following Host Access Class Library (HACL) class files obtained from IBM Host On-Demand (HOD) version 9.0:
|
| Target system user account | Instructions to create an IBM RACF user account with the required privileges are given in the "Step 4: Configuring the Target System" section.
You provide the credentials of this user account while performing the procedure in the "Defining IT Resources" section. |
Copying the connector files involves the following steps:
The connector files to be copied and the directories to which you must copy them are given in the following table.
Note:
The directory paths given in the first column of this table correspond to the location of the connector files in the following ZIP file on the installation media:Security Applications\IBM RACF\IBM RACF Standard
Refer to the "Files and Directories That Comprise the Connector" section for more information about these files.
| File in the Installation Media Directory | Destination Directory |
|---|---|
lib\JavaTask\xlUtilHostAccess.jar |
OIM_home\xellerate\JavaTasks
|
lib\ScheduleTask\xlReconRACF.jar |
OIM_home\xellerate\ScheduleTask
|
Files in the lib\ThirdParty directory |
OIM_home\xellerate\ThirdParty
|
Files in the RACF Scripts directory |
OIM_home\xellerate\RACF Scripts
|
Files in the resources directory |
OIM_home\xellerate\connectorResources
|
xml\racfResAdp.xml |
OIM_home\xlclient\
|
Note:
While installing Oracle Identity Manager in a clustered environment, you copy the contents of the installation directory to each node of the cluster. Similarly, you must copy the
connectorResources directory and the JAR files to the corresponding directories on each node of the cluster.Configuring the Oracle Identity Manager server involves the following procedures:
Note:
In a clustered environment, you must perform this step on each node of the cluster.Changing to the required input locale (language and country setting) involves installing the required fonts and setting the required input locale.
To set the required input locale:
Note:
Depending on the operating system used, you may need to perform this procedure differently.Open Control Panel.
Double-click Regional Options.
On the Input Locales tab of the Regional Options dialog box, add the input locale that you want to use and then switch to the input locale.
Whenever you add a new resource bundle in the OIM_home\xellerate\connectorResources directory or make a change in an existing resource bundle, you must clear content related to connector resource bundles from the server cache.
To clear content related to connector resource bundles from the server cache:
In a command window, change to the OIM_home\xellerate\bin directory.
Enter one of the following commands:
Note:
You must perform Step 1 before you perform this step. If you run the command as follows, then an exception is thrown:OIM_home\xellerate\bin\batch_file_name
On Microsoft Windows:
PurgeCache.bat ConnectorResourceBundle
On UNIX:
PurgeCache.sh ConnectorResourceBundle
In this command, ConnectorResourceBundle is one of the content categories that you can remove from the server cache. Refer to the following file for information about the other content categories:
OIM_home\xellerate\config\xlConfig.xml
Note:
You can ignore the exception that is thrown when you perform Step 2.To configure the target system:
Note down the Telnet and SSL port numbers specified in the TCP/IP profile file. When you perform the "Defining IT Resources" procedure, you must provide these port numbers as part of the IT resource definition.
Using FTP, upload the members (scripts) from the OIM_home\xellerate\RACF Scripts directory to a partitioned dataset with record length 80 and record format Fixed Block.
Upload the following file as a flat file or Physical Sequential (PS) file with record length 80 and record format Fixed Block.
OIM_home\xellerate\RACF Scripts\SYSTMDAT
You must provide the following information in the SYSTMDAT file:
Name of the IBM RACF database dataset
Job header, which forms a part of the background job
You must ensure that the job header contains the NOTIFY parameter in the following format:
NOTIFY=&SYSUID
Name of the RACF source dataset containing the RACF scripts that you upload to a partitioned dataset on the IBM RACF server (in Step 2 of this procedure).
Region size and dynamic resource allocation values
The name of this file must start with the high-level qualifier of the user ID that is used to perform reconciliation. For example, it can be named as XX.SYSTMDAT, where XX is the user ID on the IBM Mainframe server that is used to run reconciliation.
Create a user on the IBM Mainframe server with TSO access using an existing user account to which the Special attribute has been assigned.
Provide the user with the Special attributes.
Log on to TSO on the IBM Mainframe server using the user account that you use to create the mainframe user.
At the READY prompt, enter the following command:
Altuser NewUserIDCreated Special
Enter the following RACF commands at the READY prompt to provide the mainframe user with the ALTER permission on the directory that is to store the RACF scripts:
ADDSD RACF_Source UACC(NONE) PERMIT RACF_Source ACCESS(ALTER) ID(new_mainframe_userid) SETROPTS GENERIC(DATASET) REFRESH
Set Msgid to ON for the mainframe user as follows:
Log on to TSO on the IBM Mainframe server using the mainframe user account that you create.
At the READY prompt, enter the following command:
profile msgid
The procedure to copy the external code files involves the following steps:
Create a JAR file containing the WellKnownTrustedCAs.class and WellKnownTrusted.p12 files. These files are available as part of the HOD installation in the following directory (assuming HOD is installed in the <..\IBM> directory):
<IBM\HostOnDemand\HOD>
Copy the JAR file created in Step 1 along with the external JAR files (hoddbg2.jar, hacp.jar, habasen2.jar, and hasslite2.jar ) available in the HOD installation directory (<.IBM\HostOnDemand\HOD>) to the following directory of the Oracle Identity Manager installation:
OIM_home\Xellerate\ThirdParty
Copy the InitialLoginSequence.txt, LogOutSequence.txt, and InputFields.txt files into the following directory after making changes (if required) according to the target configuration:
OIM_home\Xellerate\ThirdParty
To import the connector XML file into Oracle Identity Manager:
Open the Oracle Identity Manager Administrative and User Console.
Click the Deployment Management link on the left navigation bar.
Click the Import link under Deployment Management. A dialog box for locating files is displayed.
Locate and open the racfResAdp.xml file, which is in the OIM_home\xlclient directory. Details of this XML file are shown on the File Preview page.
Click Add File. The Substitutions page is displayed.
Click Next. The Confirmation page is displayed.
Click Next. The Provide IT Resource Instance Data page for the RACF Server IT resource is displayed.
Specify values for the parameters of the RACF Server IT resource. Refer to the "Defining IT Resources" section for information about the values to be specified.
Click Next. The Provide IT Resource Instance Data page for a new instance of the RACF Server IT resource type is displayed.
Click Skip to specify that you do not want to define another IT resource. The Confirmation page is displayed.
See Also:
If you want to define another IT resource, then refer to Oracle Identity Manager Tools Reference Guide for instructions.Click View Selections.
The contents of the XML file are displayed on the Import page. You may see a cross-shaped icon along with some nodes. Remove these nodes by right-clicking each node and then selecting Remove.
Click Import. The connector XML file is imported into Oracle Identity Manager.
After you import the connector XML file, proceed to the "Step 7: Configuring Reconciliation" section.
You must specify values for the RACF Server IT resource parameters listed in the following table.
| Parameter | Parameter Description |
|---|---|
Admin |
Administrator ID on the IBM RACF server |
AdminCredential |
Password of the admin ID account |
Application |
TSO value to which the admin user logs in.
Sample value: |
Host |
IP address or computer name of the mainframe system |
Port |
Port number at which the server is listening |
LoginMacro |
Name and directory path of the file that is used to reach the READY prompt on the IBM Mainframe server.
Value: OIM_home\ThirdParty\loginsequence.txt
|
AutoRetry |
AutoRetry feature
The value can be |
AmountRetry |
Number of retries for the AutoRetry feature
Sample value: |
WaitTime |
Wait time between consecutive retries
Sample value: |
IsSecure |
Specifies whether or not the connection between Oracle Identity Manager and IBM RACF must be secured by using SSL
The value can be Note: It is recommended that you enable SSL to secure communication with the target system. |
LogoutMacro |
Name and directory path of the file that is used to exit from the READY prompt on the IBM Mainframe server.
Value: OIM_home\ThirdParty\logoutsequence.txt
|
IsDebug |
Specifies whether or not debugging must be performed
The value can be |
After you specify values for these IT resource parameters, proceed to Step 9 of the procedure to import connector XML files.
Configuring reconciliation involves creating the reconciliation scheduled tasks:
Expand the Xellerate Administration folder.
Select Task Scheduler.
Click Find. The details of the predefined scheduled tasks are displayed.
Enter a number in the Max Retries field. This number represents the number of times Oracle Identity Manager must attempt to complete the task before assigning the ERROR status to the task.
Ensure that the Disabled and Stop Execution check boxes are not selected.
In the Start region, double-click the Start Time field. From the date-time editor that is displayed, select the date and time at which you want the task to run.
In the Interval region, set the following schedule parameters:
To set the task to run on a recurring basis, select the Daily, Weekly, Recurring Intervals, Monthly, or Yearly option.
If you select the Recurring Intervals option, then you must also specify the time interval at which you want the task to run on a recurring basis.
To set the task to run only once, select the Once option.
Provide values for the attributes of the scheduled task. Refer to the "Specifying Values for the Scheduled Task Attributes" section for information about the values to be specified.
Click Save. The scheduled task is created. The INACTIVE status is displayed in the Status field, because the task is not currently running. The task is run at the date and time that you set in Step 7.
Repeat Steps 5 through 10 to create the second scheduled task.
After you create both scheduled tasks, proceed to the "Step 8: Compiling Adapters" section.
This section provides information about the values to be specified for the following scheduled tasks:
You must specify values for the following attributes of the lookup fields reconciliation scheduled task.
Note:
Attribute values are predefined in the connector XML file that you import. Specify values only for those attributes that you want to change.| Attribute | Description | Sample Value |
|---|---|---|
Server |
Name of the IT resource instance that the connector uses to reconcile data | RACF Server |
LookupField Name |
Name of the lookup field to be reconciled | The value can be any one of the following:
|
LookupField Target File |
Name of the file that the connector creates on the IBM Mainframe server to temporarily store data | Valid file name up to 8 characters in length
For example: |
RACF Source Directory |
Name of the directory on the IBM Mainframe server in which RACF scripts are stored | ADTTAR.DT250207.CNTL |
IsDebug |
Specifies whether or not debugging must be performed | The value can be YES or NO. The default value is NO. |
After you specify values for these task attributes, go to Step 10 of the procedure to create scheduled tasks.
You must specify values for the following attributes of the user reconciliation scheduled task.
Note:
Attribute values are predefined in the connector XML file that you import. Specify values only for those attributes that you want to change.| Attribute | Description | Value |
|---|---|---|
Target System Recon - Resource Object name |
Name of the resource object | Resource object name
For example, RACF Server |
Server |
Name of the IT resource instance that the connector uses to reconcile data | IT Resource Instance name
For example, RACF Server |
RACF Source Directory |
Specifies the IBM RACF directory in which IBM RACF scripts are stored | ADTTAR.DT250207.CNTL |
Target System New User File |
Name of the file that IBM RACF uses to store the latest image of the IBM RACF database | Valid file name up to 8 characters in length
Sample value: |
Target System Old User File |
Name of the file that IBM RACF uses to store the old image of the IBM RACF database
For first-time reconciliation, provide a dummy file name. You must ensure that this file does not exist on the IBM Mainframe. From the second reconciliation run onward, the value must be the same as the value of the Target System old User File attribute used during the first reconciliation run. |
Valid file name up to 8 characters in length |
IsDebug |
Specifies whether or not debugging must be performed | The value can be YES or NO. The default value is NO. |
After you specify values for these task attributes, go to Step 10 of the procedure to create scheduled tasks.
The following adapters are imported into Oracle Identity Manager when you import the connector XML file:
adpCREATENEWRACFUSER
adpRACFUSERDELETE
adpRACFUSERENABLE
adpADDTSOTORACFUSER
adpSETRACFUSERPASSWORD
adpUPDATERACFUSERATTRIBUTE
adpCONNECTTOGROUP
adpDISCONNECTFROMGROUP
adpREMOVETSO
adpRACFUSERDISABLE
adpRACFUPDATEPRIVILEDGE
You must compile these adapters before you can use them to provision accounts on the target system.
To compile adapters by using the Adapter Manager form:
To compile all the adapters that you import into the current database, select the Compile All option.
To compile multiple (but not all) adapters, select the adapters you want to compile. Then, select the Compile Selected option.
Click Start. Oracle Identity Manager compiles the selected adapters.
If Oracle Identity Manager is installed in a clustered environment, then copy the compiled adapters from the OIM_home\xellerate\Adapter directory to the same directory on each of the other nodes of the cluster. If required, overwrite the adapter files on the other nodes.
To view detailed information about an adapter:
Note:
This is an optional step of the deployment procedure.The CustomizedCAs.p12 file is the container for server certificates used for establishing an SSL connection. This file is compressed in the CustomizedCAs.jar file. The password for the CustomizedCAs.p12 file is hod. If the IBM Mainframe server has a certificate signed by a CA other than Verisign or Thawte, the root certificate of the CA must be added to the CustomizedCAs.p12 file for establishing the SSL connection.
The certificate can be added to the CustomizedCAs.p12 file by using a key management utility that supports PKCS12 format files. One of the tools that can be used to add the certificate is GSKkit7.0. This tool is part of IBM Host On-demand Server version 9.0.
To set up SSL connectivity between Oracle Identity Manager and the IBM Mainframe server:
Set the IsSecure parameter of the IT resource to YES.
Configure the target system to enable the required port for SSL connection.
If the certificate is issued by Thawte or any other well-known CA, then copy the WellKnownTrustedCertificatesCAs.jar file into the following directory:
OIM_home\xellerate\lib\ThirdParty
Import the certificate in the CustomizedCAs.p12 file as follows:
Extract the contents of the CustomizedCAs.jar file. This file is in the following directory:
OIM_home\xellerate\lib\ThirdParty
Add the SSL certificate in the CustomizedCAs.p12 file.
Create the CustomizedCAs.jar file with the updated CustomizedCAs.p12 and CustomizedCAs.class files.
Copy the updated JAR file into the following directory:
OIM_home\Xellerate\ThirdParty
Note:
Perform this procedure only if you want to configure the connector for multiple installations of IBM RACF. Refer to Oracle Identity Manager Design Console Guide for detailed instructions on performing each step of this procedure.To configure the connector for multiple installations of the target system:
Create and configure one resource object for each target system installation.
The Resource Objects form is in the Resource Management folder. The RACF Server resource object is created when you import the connector XML file. You can use this resource object as the template for creating the remaining resource objects.
Create and configure one IT resource for each resource object.
The IT Resources form is in the Resource Management folder. The RACF Server IT resource is created when you import the connector XML file. You can use this IT resource as the template for creating the remaining IT resources, of the same resource type.
Design one process form for each resource object.
The Form Designer form is in the Development Tools folder. The following process forms are created when you import the connector XML file:
UD_DB_RACF (main form)
UD_CO_GROUP and UD_ADD_TSO (child forms)
You can use these process forms as templates for creating the remaining process forms.
Create and configure one process definition for each resource object.
The Process Definition form is in the Process Management folder. The RACF User process definition is created when you import the connector XML file. You can use this process definition as the template for creating the remaining process definitions.
While creating process definitions for each target system installation, the following steps that you must perform are specific to the creation of each process definition:
From the Object Name lookup field, select the resource object that you create in Step 1.
From the Table Name lookup field, select the process form that you create in Step 3.
While mapping the adapter variables for the IT Resource data type, ensure that you select the IT resource that you create in Step 2 from the Qualifier list.
Configure reconciliation for each target system installation. Refer to the "Step 7: Configuring Reconciliation" section for instructions. Note that only the values of the following attributes are to be changed for each reconciliation scheduled task:
Target System Recon - Resource Object name
Server
If required, modify the fields to be reconciled for the Xellerate User resource object.
When you use the Administrative and User Console to perform provisioning, you can specify the IT resource corresponding to the IBM RACF installation to which you want to provision the user.
