5 Extending the Functionality of the Connector

This chapter discusses the following optional procedures that you can perform to extend the functionality of the connector for addressing your business requirements:

• Section 5.1, "Adding Custom Fields for Target Resource Reconciliation"

• Section 5.2, "Adding Custom Multivalued Fields for Reconciliation"

• Section 5.3, "Adding Custom Fields for Provisioning"

• Section 5.4, "Removing Attributes Mapped for Target Resource Reconciliation"

• Section 5.5, "Configuring the Connector for Provisioning to Multiple Installations of the Target System"

• Section 5.6, "Configuring the Generation of Single-Use Passwords for the Reset Password Operation"

• Section 5.7, "Initial LDAP Gateway Population and Full Reconciliation"

• Section 5.8, "Configuring Windows Service"

• Section 5.9, "Customizing Log File Locations"

5.1 Adding Custom Fields for Target Resource Reconciliation

Note:

You must ensure that new attributes you add for reconciliation contain only string-format data. Binary attributes must not be brought into Oracle Identity Manager natively.

By default, the attributes listed in Table 1-4 are mapped for reconciliation between Oracle Identity Manager and the target system. If required, you can add new attributes for target resource reconciliation.

To add a custom field for reconciliation, you must first update the connector reconciliation component you are using, and then update Oracle Identity Manager. This section discusses the following topics:

• Section 5.1.1, "Adding Custom Fields for Full Reconciliation"

• Section 5.1.2, "Adding Custom Fields to Oracle Identity Manager"

5.1.1 Adding Custom Fields for Full Reconciliation

You can add custom fields for full reconciliation by specifying a value for the SingleValueAttributes attribute of the Top Secret Reconcile All Users scheduled task. See Section 4.4.1, "Full Reconciliation" for more information.

To add a custom field for scheduled task reconciliation:

1. Depending on the Oracle Identity Manager release you are using, perform one of the following steps:

   • For Oracle Identity Manager release 11.1.1.x:

     1. Log in to the Oracle Identity System Administration.

     2. On the Welcome to Oracle Identity Manager Self Service page, click Advanced in the upper-right corner of the page.

     3. On the Welcome to Oracle Identity Manager Advanced Administration page, in the System Management region, click Search Scheduled Jobs.

   • For Oracle Identity Manager release 11.1.2.x:

     1. Log in to Oracle Identity System Administration.

     2. In the left pane, under System Management, click Scheduler.

2. Search for and open the Top Secret Reconcile All Users scheduled task as follows:

   1. In the left pane, in the Search field, enter Top Secret Reconcile All Users as the search criterion. Alternatively, you can click Advanced Search and specify the search criterion.

   2. In the search results table on the left pane, click the scheduled job in the Job Name column.

3. Add the custom field to the list of attributes in the SingleValueAttributes scheduled task attribute.

4. Click Apply.

5.1.2 Adding Custom Fields to Oracle Identity Manager

After adding the custom field to the Top Secret Reconcile All users scheduled task (if using scheduled task reconciliation), you must add the custom field to the Oracle Identity Manager components.

To update Oracle Identity Manager with the custom field:

1. Log in to the Oracle Identity Manager Design Console.

2. Add the custom field to the list of reconciliation fields in the resource object as follows:

   1. Expand Resource Management and then double-click Resource Objects.

   2. Search for and open the OIMTopSecretResourceObject resource object.

   3. On the Object Reconciliation tab, click Add Field.

   4. In the Add Reconciliation Field dialog box, enter the details of the field.

      For example, if you are adding a Top Secret attribute called "Description", then enter Description in the Field Name field and select String from the Field Type list.

   5. Click Save and close the dialog box.

   6. Click Create Reconciliation Profile. This copies changes made to the resource object into MDS.

   7. Click Save.

3. Add the custom field on the process form as follows:

   1. Expand Development Tools and then double-click Form Designer.

   2. Search for and open the UD_IDF_TOPS process form.

   3. Click Create New Version, and then click Add.

   4. Enter the details of the field.

      For example, if you are adding the Description field, then enter UD_IDF_TOPS_DESCRIPTION in the Name field, and then enter the rest of the details of this field.

   5. Click Save and then click Make Version Active.

4. Create a reconciliation field mapping for the custom field in the provisioning process as follows:

   1. Expand Process Management and then double-click Process Definition.

   2. Search for and open the OIMTopsProvisioningProcess process definition.

   3. On the Reconciliation Field Mappings tab of the provisioning process, click Add Field Map.

   4. In the Add Reconciliation Field Mapping dialog box, from the Field Name field, select the value for the field that you want to add.For example, from the Field Name field, select Description.

   5. Double-click the Process Data field, and then select UD_IDF_TOPS_DESCRIPTION.

   6. Click Save and close the dialog box.

   7. Click Save.

5. If you are using Oracle Identity Manager release 11.1.2.x, then create a new UI form and attach it to the application instance to make this new attribute visible. See Section 2.4.1.2, "Creating a New UI Form" and Section 2.4.1.6, "Updating an Existing Application Instance with a New Form" for the procedures.

6. If you are adding a custom attribute or custom dataset, then set values for the _configAttrs_, _configDNames and _configDatasets_ properties in the tops.properties file. See Step 2 of Section 2.6, "Installing and Configuring the LDAP Gateway" for information about these properties.

5.2 Adding Custom Multivalued Fields for Reconciliation

To add a custom multivalued field to reconciliation, you must first update the IDF reconciliation component you are using, and then update Oracle Identity Manager.

• Section 5.2.1, "Adding Custom Multivalued Fields for Full Reconciliation"

• Section 5.2.2, "Adding Custom Multivalued Fields to Oracle Identity Manager"

5.2.1 Adding Custom Multivalued Fields for Full Reconciliation

You can add custom multivalued fields for full reconciliation by specifying a value for the multiValuedAttributes property of the Top Secret Reconcile All Users reconciliation scheduled task. See Section 4.4.2.1, "Top Secret Reconcile All Users" for more information.

To add a custom field for scheduled task reconciliation:

1. Log in to Oracle Identity System Administration.

2. Depending on the Oracle Identity Manager release you are using, perform one of the following steps:

   • For Oracle Identity Manager release 11.1.1.x:

     1. Log in to the Oracle Identity System Administration.

     2. On the Welcome to Oracle Identity Manager Self Service page, click Advanced in the upper-right corner of the page.

     3. On the Welcome to Oracle Identity Manager Advanced Administration page, in the System Management region, click Search Scheduled Jobs.

   • For Oracle Identity Manager release 11.1.2.x:

     1. Log in to Oracle Identity System Administration.

     2. In the left pane, under System Management, click Scheduler.

3. Search for and open the Top Secret Reconcile All Users as follows:

   1. On the left pane, in the Search field, enter Top Secret Reconcile All Users as the search criterion. Alternatively, you can click Advanced Search and specify the search criterion.

   2. In the search results table on the left pane, click the scheduled job in the Job Name column.

4. Add the custom field to the list of attributes in the MultiValuedAttributes property.

5. Click Apply.

5.2.2 Adding Custom Multivalued Fields to Oracle Identity Manager

After adding the custom multivalued field to the Top Secret Reconcile All users scheduled task (if using scheduled task reconciliation), you must add the custom multivalued field to the Oracle Identity Manager components.To update Oracle Identity Manager with the multivalued field:

1. Log in to the Oracle Identity Manager Design Console.

2. Create a form for the multivalued field as follows:

   1. Expand Development Tools and double-click Form Designer.

   2. Create a form by specifying a table name and description, and then click Save.

   3. Click Add and enter the details of the field.

   4. Click Save and then click Make Version Active. Figure 5-1 shows the multivalued field added on a new form.

      Figure 5-1 Multivalued Field Added on a New Form

      
      

3. Add the form created for the multivalued field as a child form of the process form as follows:

   1. Search for and open the UD_IDF_TOPS process form.

   2. Click Create New Version.

   3. Click the Child Table(s) tab.

   4. Click Assign.

   5. In the Assign Child Tables dialog box, select the newly created child form, click the right arrow, and then click OK.

   6. Click Save and then click Make Version Active. Figure 5-2 shows the child form added to the process form.

      Figure 5-2 Child Form Added to the Process Form

      
      

4. Add the new multivalued field to the list of reconciliation fields in the resource object as follows:

   1. Expand Resource Management and then double-click Resource Objects.

   2. Search for and open the OIMTopsResourceObject resource object.

   3. On the Object Reconciliation tab, click Add Field.

   4. In the Add Reconciliation Field dialog box, enter the details of the field.

      For example, enter phoneNumber in the Field Name field and select Multi-Valued Attribute from the Field Type list.

   5. Click Save and close the dialog box.

   6. Right-click the newly created field and select Define Property Fields.

   7. In the Add Reconciliation Fields dialog box, enter the details of the newly created field.

      For example, enter phonenumber in the Field Name field and select String from the Field Type list.

   8. Click Save and then close the dialog box. Figure 5-3 shows the new reconciliation field added in the resource object.

      Figure 5-3 New Reconciliation Field Added in the Resource Object

      
      

   9. Click Create Reconciliation Profile. This copies changes made to the resource object into MDS.

5. Create an entry for the field in the AtMap.Tops lookup definition, as follows:

   1. Expand Administration and then double-click Lookup Definition.

   2. Search for the AtMap.TOPS lookup definition.

   3. Click Add and enter the Code Key and decode values for the field. The Code Key value is the name of the process form field that you created for the multivalued custom field in Step 3.d. The Decode value is the name of the target system field.

      For example, enter UD_PHONENUM_PHONENUMBER in the Code Key field and then enter phonenumber in the Decode field. Figure 5-4 shows the lookup code added to the lookup definition.

      Figure 5-4 Entry Added in the Lookup Definition

      
      

   4. Click Save.

6. Create a reconciliation field mapping for the new multivalued field as follows:

   1. Expand Process Management and then double-click Process Definition.

   2. Search for and open the OIMTopsProvisioningProcess process definition.

   3. On the Reconciliation Field Mappings tab of the provisioning process, click Add Table Map.

   4. In the Add Reconciliation Table Mapping dialog box, select the field name and table name from the list, click Save, and then close the dialog box.

   5. Right-click the newly created field and select Define Property Field Map.

   6. In the Field Name field, select the value for the field that you want to add.

   7. Double-click the Process Data field, and then select UD_PHONENUM_PHONENUMBER.

   8. Select Key Field for Reconciliation Field Matching and click Save. Figure 5-5 shows the new reconciliation field mapped to a process data field in the process definition.

      Figure 5-5 New Reconciliation Field Mapped to a Process Data Field

      
      

5.3 Adding Custom Fields for Provisioning

By default, the attributes listed in Table 1-4 are mapped for provisioning between Oracle Identity Manager and the target system. If required, you can map additional attributes for provisioning.

The connector does not support the use of custom attributes in CREATE USER operations that is, TSS CREATE. Instead, custom attribute modifications should be sent in an MODIFY USER operation that is, TSS ADDTO/REPLACE/REMOVE after the user has been provisioned a resource.

To add a new attribute for provisioning:

See Also:

Oracle Fusion Middleware Performing Self Service Tasks with Oracle Identity Manager for detailed information about these steps

1. Log in to the Oracle Identity Manager Design Console.

2. Add the new attribute on the process form as follows:

   If you have added the field on the process form by performing Step 4 of Section 5.1.2, "Adding Custom Fields to Oracle Identity Manager," then you need not add the field again. If you have not added the field, then:

   1. Expand Development Tools.

   2. Double-click Form Designer.

   3. Search for and open the UD_IDF_TOPS process form.

   4. Click Create New Version, and then click Add.

   5. Enter the details of the attribute.

      For example, if you are adding the Description field, enter UD_IDF_TOPS_DESCRIPTION in the Name field, and then enter the rest of the details of this field.

   6. Click Save and then click Make Version Active.

   Note:

   OMVS and NETVIEW attributes must not be added to the AtMap.TOPS lookup definition as they are not supported for create provisioning operations.

3. To enable update of the attribute during provisioning operations, create a process task as follows:

   See Also:

   Oracle Fusion Middleware Performing Self Service Tasks with Oracle Identity Manager for detailed information about these steps

   1. Expand Process Management, and double-click Process Definition.

   2. Search for and open the OIMTopsProvisioningProcess process definition.

   3. Click Add.

   4. On the General tab of the Creating New Task dialog box, enter a name and description for the task and then select the following:

      Conditional

      Required for Completion

      Disable Manual Insert

      Allow Cancellation while Pending

      Allow Multiple Instances

   5. Click Save.

   6. Go to the Integration tab and click Add.

   7. In the Handler Selection dialog box, select Adapter, click adpMODIFYTOPSUSER, and then click the Save icon.

      The list of adapter variables is displayed on the Integration tab.

   8. To create the mapping for the first adapter variable:

      Double-click the number of the first row.

      In the Edit Data Mapping for Variable dialog box, enter the following values:

      Variable Name: Adapter return value

      Data Type: Object

      Map To: Response code

      Click the Save icon.

   9. To create mappings for the remaining adapter variables, use the data given in the following table:

      Table 5-1 Values for the Variables, Map To, Qualifier, and Literal Value lists for each variable

      Variable Number	Variable Name	Map To	Qualifier
      Second	idfResource	Process Data	LDAP_SERVER
      Third	uid	Process Data	LoginId
      Fourth	attrName	String Literal	Enter the LDAP attribute name in the Literal Value field. Example: description Table 1-5, "Unmapped User Attributes for Target Resource Reconciliation and Provisioning" for a list of unmapped user attributes and their LDAP Gateway attribute names.
      Fifth	attrValue	Process Data	Select the process form field from the drop-down list.Example: DESCRIPTION

      
      

   10. On the Responses task, click Add to add at least the SUCCESS response code, with status C. This ensures that if the custom task is successfully run, then the status of task is displayed as Completed in Oracle Identity Manager.

   11. Click the Save icon in the Editing Task dialog box, and then close the dialog box.

   12. Click the Save icon to save changes to the process definition.

4. If you are using Oracle Identity Manager release 11.1.2 or later, create a new UI form and attach it to the application instance to make this new attribute visible. See Section 2.4.1.2, "Creating a New UI Form" and Section Section 2.4.1.6, "Updating an Existing Application Instance with a New Form" for the procedures.

5.4 Removing Attributes Mapped for Target Resource Reconciliation

The SingleValueAttributes and MultiValuedAttributes properties contain the list of target system attributes that are mapped for scheduled task reconciliation. These properties are found in the Top Secret Reconcile All Users and Top Secret Reconcile All LDAP Users scheduled tasks. If you want to remove an attribute mapped for scheduled task reconciliation, then remove it from the SingleValueAttributes or MultiValuedAttributes property.

5.5 Configuring the Connector for Provisioning to Multiple Installations of the Target System

You can configure the connector for multiple installations of the target system. You can also configure the connector for a scenario in which multiple logical partitions (LPARs), which are not associated with the first LPAR, are configured in the target system.

For each installation of the target system, you create an IT resource and configure an additional instance of the LDAP Gateway.

To configure the connector for the second installation of the target system:

Note:

Perform the same procedure for all installations of the target system.

1. Create an IT resource based on the OIMLDAPGatewayResourceType IT resource type.

   See IT Resource in Oracle Fusion Middleware Developing and Customizing Applications for Oracle Identity Manager for information about creating IT resources.

   See Table 2-2, "IT Resource Parameters" for information about the parameters of the IT resource.

2. Copy the current LDAP_INSTALL_DIR directory, including all the subdirectories, to a new location on the Oracle Identity Manager computer.

   Note:

   In the remaining steps of this procedure, LDAP_INSTALL_DIR refers to the newly copied directory.

3. Extract the contents of the LDAP_INSTALL_DIR/dist/idfserver.jar file.

4. In the beans.xml file, change the value of the port in the <property name="port" value="xxxx"/> line to specify a port that is different from the port used for the first instance of the LDAP Gateway. The default port number is shown in the following example:

   <bean id="listener" class="com.identityforge.idfserver.nio.Listener">
   <constructor-arg><ref bean="bus"/></constructor-arg>
   <property name="admin"><value>false</value></property>
   <property name="config"><value>../conf/listener.xml</value></property>
   <property name="port" value="5389"/>
   </bean>
   

   When you change the port number, you must make the same change in the value of the idfServerPort parameter of the IT resource that you create by performing Step 1.

5. Save and close the beans.xml file.

6. Open the LDAP_INSTALL_DIR/conf/tops.properties file and set values for the following parameters:

   • _host_= Enter the IP address or host name of the mainframe.

   • _port_= Enter the port number for the second instance of the Provisioning agent.

   • _agentPort_= Enter the port number for the second instance of the Reconciliation agent.

     Note:

     The value of the _agentPort_ parameter must not be the same as that of the first instance if a second LPAR, which is not associated with the first LPAR, is configured in the target system. This value can be the same as the value of the idfServerPort parameter if you have two mainframe servers with CA Top Secret running on each server.

7. Save and close the tops.properties file.

8. In a Linux or Solaris environment, if there are not enough socket file descriptors to open up all the ports needed for the server, then:

   1. In a text editor, open the run script from the LDAP_INSTALL_DIR/bin directory.

   2. Add the following line in the file:

      -Djava.nio.channels.spi.SelectorProvider=sun.nio.ch.PollSelectorProvider
       
      

   3. Save and close the file.

When you perform provisioning operations:

When you use the Oracle Identity System Administration to perform provisioning, you can specify the IT resource corresponding to the CA Top Secret installation to which you want to provision the user.

5.6 Configuring the Generation of Single-Use Passwords for the Reset Password Operation

You can create and configure an adapter that generates single-use passwords when the Reset Password operation is performed. To create the adapter:

See Also:

Oracle Fusion Middleware Performing Self Service Tasks with Oracle Identity Manager for detailed information about the steps of this procedure

1. Use the Adapter Factory to create a copy of the ResetPassword adapter.

2. Add the following variables to the adapter that you create:

   passwordExpire: boolean or String

   passwordExpireInterval: String

3. The idm.jar file is located in the JavaTasks directory. When you create and map the new adapter task, use the following functions defined in this file:

   • public String resetPassword(String idfUserId, String idfNewPwd, boolean expire, String expireInDays)

   • public String resetPassword(String idfUserId, String idfNewPwd, String expireNow, String expireInDays)

   In these functions, the expire and expireNow parameters expect the value true to expire users' passwords.

4. Compile the adapter.

5. Create a process task, and associate it with the object corresponding to the event for which you want single-use passwords to be generated. For example, you can associate the process task with the Password Updated task or with the event that the PWD_EXP check box on the process form is selected.

5.7 Initial LDAP Gateway Population and Full Reconciliation

Instead of reconciling directly from the target system to OIM (which can be slow on large systems), the LDAP gateway offers an internal LDAP store that can be populated with target system users by using a single transaction to the mainframe. Oracle Identity Manager then reconciles user data from the LDAP store instead of the target system. Reconciling user, profile, and facility data from an extract file requires the following procedure:

5.7.1 Reconciliation Using a CFILE Extract File

This feature will perform full reconciliation 30% - 50% faster than the normal OOTB Scheduled Task that reconciles all users. This requires coordination with configuration changes for the Pioneer Mainframe Agent.

1. Have the Mainframe Team configure the Pioneer agent to use a generated file. (See Chapter 3, "Connector Deployment on the Mainframe"). Run the IRRXUTIL to use the EXTRACT USER or GROUP command that will generate the file of all users and data.

2. After file has completed above, open the LDAP_INSTALL_DIR/conf/tops.properties file.Set the value for the _internalEnt_ property to true.Save and close the property file.Log into the Oracle Identity System Administration.Search for and open the Top Secret Reconcile Users to Internal LDAP scheduled task. Enter values for the scheduled task properties.

   Table 4-5 describes the attributes of the scheduled task.

3. Run the scheduled task. This task will initially populate the internal LDAP store with all user profiles.

4. Once the task has completed, search for and open the Top Secret Reconcile LDAP Users to OIM scheduled task.

5. Enter values for the scheduled task properties.

   Table 5-2 describes the attributes of the scheduled task.

   Table 5-2 Attributes of the Reconcile LDAP Users to OIM Scheduled Task

   Attribute	Description
   IT Resource	Enter the name of the IT resource that was configured for the target system.Sample value: TopSecretResource
   Resource Object	Enter the name of the resource object against which the reconciliation run will be performed. Sample value: OIMTopSecretResourceObject
   Domain OU	Enter the name of the internally-configured directory in the LDAP store where the target system users will be retrieved. Sample value: tops
   MultiValuedAttributes	Enter a comma-separated list of multivalued attributes that you want to reconcile. Do not include a space after each comma. Sample value: profiles,facilities,groupIds
   SingleValueAttributes	Enter a comma-separated list of single-valued attributes that you want to reconcile. Do not include a space after each comma. Do not include attributes already listed in the MultiValueAttributes field. Sample value: uid,owner,defaultGroup,waddr1,tsoMaxSize Note: By default, Oracle Identity Manager's design form only allows entering up to 150 characters in a text field. To increase this limit, change the value of the TSA_VALUE column in the Oracle Identity Manager database.
   LDAP Time Zone	Enter the time zone ID for the server on which the LDAP gateway is hosted.Sample value: EST
   UID Case	Enter whether the user ID should be displayed in uppercase or lowercase.Sample value: upper
   R2	Enter whether the release of Oracle Identity Manager being used is 11.1.2.x. Sample value: true

   
   

6. Run the scheduled task. This task will reconcile each user from the internal LDAP store to Oracle Identity Manager.

5.8 Configuring Windows Service

In a Windows environment, the LDAP gateway server can also be installed as a Windows Service. This section describes the installation and configuration procedure of the Windows Service for the LDAP Gateway.

Overview of the Installation Process

The Windows Service for the LDAP Gateway is installed using a supplied IdentityForge batch file. The batch file for the Windows service installer should be updated with your system's JAVA_HOME, JVM, HOME, and APPLICATION_SERVICE_HOME variables. The Windows service installer uses the Apache Procrun utility prunsrv.exe to create a fully managed Windows Service for the LDAP Gateway.

Installation Steps

To install and configure the Windows Service for the LDAP Gateway, you must perform the following steps:

1. In a text editor, open the IDF-Win-Service.bat file in the <LDAP_INSTALL_DIR>/win_service directory.

   Modify the JAVA_HOME, JVM, HOME, and APPLICATION_SERVICE_HOME variables to match your environment settings. In the following example, the JAVA_HOME, JVM, HOME, and APPLICATION_SERVICE_HOME environment variables are set:

   set JAVA_HOME=C:\software\Java\jdk1.7.0_55
   set JVM=C:\software\Java\jdk1.7.0_55\jre\bin\server\jvm.dll
   set HOME=D:\software\ldapgateway5.0
   set APPLICATION_SERVICE_HOME=D:\software\ldapgateway5.0\win_service
   

2. To modify the default LDAP Gateway service name (LDAPGatewayService), perform the following steps:

   1. In IDF-Win-Service.bat file, update the "SERVICE_NAME" variable with the chosen custom service name: set SERVICE_NAME=LDAPGatewayService432

   2. In the /win_service directory, rename the LDAPGatewayService application to match the chosen custom service name.

3. To customize the log file locations, you must edit the CG_IDFLOG and CG_XMLERRLOG variables as follows:

   1. Locate the following section of the IDF-Win-Service.bat file:

      rem set CG_IDFLOG="-Didf.logpath="%CG_LOGPATH%\idfserver_custom.log"
      
      rem set CG_XMLERRLOG="-Didf.xmllogpath="%CG_LOGPATH%\idf.xml.error_custom.log"
      

   2. Uncomment the CG_IDFLOG and CG_XMLERRLOG variables and modify the variable paths to match your custom locations.

   3. Locate and uncomment the following lines in the IDF-Win-Service.bat file:

      rem set EXECUTE_STRING= "%EXECUTABLE%" //US//%SERVICE_NAME% ++JvmOptions %CG_IDFLOG%
      rem call:executeAndPrint %EXECUTE_STRING%
      rem echo .........
       
      rem set EXECUTE_STRING= "%EXECUTABLE%" //US//%SERVICE_NAME% ++JvmOptions %CG_XMLERRLOG%
       
      rem call:executeAndPrint %EXECUTE_STRING%
       
      rem echo .........
      

   4. Save and close the file.

4. Execute the following command from the command console from within the <LDAP_INSTALL_DIR>/win_service directory to install the service:

   > IDF_Win_Service install

5. If there are any problems with the installation of the service from the batch file, check the JAVA_HOME and JVM variables to make sure they are accurate.

6. Once the service is installed, you can start, stop, and restart it from the standard Windows Services manager.

Modifying or Removing the Windows Service

If you need to modify the windows service settings, it is recommended to first uninstall the service, make the modifications, and then re-install the service.

To uninstall the service, execute the following command from the <LDAP_INSTALL_DIR>/win_service directory:

> IDF_Win_Service remove

5.9 Customizing Log File Locations

The name and log location of the main LDAP gateway log file (idfserver.log) and the CFILE XML error log file (idf.xml.error.log) can be modified by adding additional arguments to the LDAP gateway server STARTUP command. These arguments are optional, and you can include one, both, or neither in the STARTUP command:

1. In a text editor, open the run script from the LDAP_INSTALL_DIR/bin directory. This run script is used to start and stop the LDAP gateway.

   (i) If using a Windows system, open the run.bat file.

   (ii) If using a UNIX system, open the run.sh file.

2. Add the arguments to the start command, located at the end of the run script:

   (i) The arguments should be added after the "-cp %CLASSPATH%" argument.

   (ii) To modify the idfserver.log path, use the argument -Didf.logpath=

   (iii) To modify the idf.xml.error.log path, use the argument -Didf.xmllogpath=

   In the following example, the start command will set the idfserver.log path to

   C:/logs/ldap/idfserver.log and the idf.xml.error.log path to C:/logs/errors/idf.xml.error.log:

   %JAVACMD% %DEBUG% %JVM_OPTS% %SECURE% -cp %CLASSPATH% -Didf.logpath="c:/logs/ldap/idfserver.log" -Didf.xmllogpath="c:/logs/errors/idf.xml.error.log" -Djava.library.path=%HOME%/lib com.identityforge.idfserver.Main %1 %2 %3 %4 %5 %6 %7 %8 %9