The LDAP Gateway acts as the intermediary between Oracle Identity Manager and the connector components on the mainframe. The following sections of this chapter describe the procedure to deploy some components of the connector, including the LDAP Gateway, on the Oracle Identity Manager host computer:
Table 3-1 describes the files and directories on the installation media.
Table 3-1 Files and Directories That Comprise the Connector
| Files and Directories | Description |
|---|---|
|
configuration/RacfAdv.xml |
This XML file contains configuration information that is used during connector installation. |
|
etc/Gateway/ldapgateway.zip |
This ZIP file contains the files required to deploy the LDAP Gateway. |
|
etc/Provisioning and Reconciliation Connector/Mainframe_RACF.zip |
This ZIP file contains the files required to deploy the Reconciliation and Provisioning Agents on the mainframe. Chapter 2, "Deploying the IDF Advanced Adapter for IBM RACF" describes the files bundled in this ZIP file. |
|
lib/racf-provisioning-adapter.jar |
This JAR file contains the code for the adapters that are used during connector operations. During connector installation, this file is copied to the Oracle Identity Manager database. |
|
Files in the resources directory |
Each of these resource bundles contains locale-specific information that is used by the connector. During connector installation, this file is copied to the Oracle Identity Manager database. Note: A resource bundle is a file containing localized versions of the text strings that include GUI element labels and messages |
|
scripts/propertyEncrypt.bat scripts/propertyEncrypt.sh |
This script is used to encrypt passwords. Section 3.5, "Installing and Configuring the LDAP Gateway" provides more information. |
|
xml/oimRacfAdvR2Connector.xml |
This XML file contains definitions of the connector components, such as the IT resource and resource object. These objects are created in Oracle Identity Manager when you import the XML file. |
|
upgrade/PostUpgradeScriptRacf.sql |
This file is used during the connector upgrade procedure for Oracle Identity Manager release 11.1.2.x. |
To run the Connector Installer:
Copy the contents of the connector installation media directory into the following directory:
OIM_HOME/server/ConnectorDefaultDirectory
Log in to Oracle Identity System Administration.
In the left pane, under System Management, click Manage Connector.
In the Manage Connector page, click Install.
From the Connector List list, select IBM RACF Advanced RELEASE_NUMBER. This list displays the names and release numbers of connectors whose installation files you copy into the default connector installation directory in Step 1.
If you have copied the installation files into a different directory, then:
In the Alternative Directory field, enter the full path and name of that directory.
To repopulate the list of connectors in the Connector List list, click Refresh.
From the Connector List, select IBM RACF Advanced RELEASE_NUMBER.
Click Load.
To start the installation process, click Continue.
The following tasks are performed in sequence:
Configuration of connector libraries
Import of the connector Target Resource user configuration XML file (by using the Deployment Manager).
Compilation of adapters
On successful completion of a task, a check mark is displayed for the task. If a task fails, then an X mark and a message stating the reason for failure are displayed. Depending on the reason for the failure, make the required correction and then perform one of the following steps:
Retry the installation by clicking Retry.
Cancel the installation and begin again from Step 1.
If all three tasks of the connector installation process are successful, then a message indicating successful installation is displayed. In addition, a list of the steps that you must perform after the installation is displayed. These steps are as follows:
Ensuring that the prerequisites for using the connector are addressed
Note:
At this stage, run the Oracle Identity Manager PurgeCache utility to load the server cache with content from the connector resource bundle in order to view the list of prerequisites. See Section 3.4.3, "Clearing Content Related to Connector Resource Bundles from the Server Cache" for information about running the PurgeCache utility.There are no prerequisites for some predefined connectors.
Configuring the IT resource for the connector
The procedure to configure the IT resource is described later in this guide.
Configuring the scheduled tasks that are created when you installed the connector. The procedure to configure these scheduled tasks is described later in this guide.
When you run the Connector Installer, it copies the connector files and external code files to destination directories on the Oracle Identity Manager host computer. These files are listed in Table 3-1.
You must specify values for the parameters of the RacfResource IT resource as follows:
Log in to Identity System Administration.
In the left pane, under Configuration, click IT Resource.
In the IT Resource Name field on the Manage IT Resource page, enter RacfResource and then click Search.
Click the edit icon for the IT resource.
From the list at the top of the page, select Details and Parameters.
Specify values for the parameters of the IT resource. Table 3-2 describes each parameter.
Table 3-2 IT Resource Parameters
| Parameter | Description |
|---|---|
|
AtMap User |
This parameter holds the name of the lookup definition containing attribute mappings that are used for provisioning. Default value: Note: You must not change the value of this parameter. |
|
idfConnectTimeoutMS |
Enter an integer value that specifies the number of milliseconds after which an attempt to establish a connection between the LDAP Gateway and Oracle Identity Manager times out. If you do not enter a value for this parameter, then the connector uses a default time out of |
|
idfPrincipalDn |
Set a user ID for an account that the connector will use to connect to the LDAP Gateway. Format: Sample value: You also set this user ID in the beans.xml file inside the idfserver.jar file. See Step 4 in Section 3.5, "Installing and Configuring the LDAP Gateway." |
|
idfPrincipalPwd |
Set a password for the account that the connector will use to connect to the LDAP Gateway. You also set this password in the files listed in the description of the idfPrincipalDn parameter. Note: Do not enter an encrypted value. |
|
idfReadTimeoutMS |
Enter an integer value that specifies the number of milliseconds after which an attempt to read data from the target system times out. If you do not enter a value for this parameter, then the connector uses a default time out of |
|
idfRootContext |
This parameter holds the root context for IBM RACF. Default value: Note: You must not change the value of this parameter. |
|
idfServerHost |
This parameter holds the host name of the computer on which you install the LDAP Gateway. For this release of the connector, you install the LDAP Gateway on the Oracle Identity Manager host computer. Default value: Note: Do not change the value of this parameter unless you have installed the LDAP Gateway on a different machine from the Oracle Identity Manager host computer. |
|
idfServerPort |
Enter the number of the port for connecting to the LDAP Gateway. Sample value: You also set this port number in the beans.xml inside the idfserver.jar file. See Step 4 in Section 3.5, "Installing and Configuring the LDAP Gateway." |
|
idfSsl |
This parameter determines whether the LDAP Gateway will use SSL to connect to the target system. Enter Sample value: |
|
idfTrustStore |
This parameter holds the directory location of the trust store containing the SSL certificate. This parameter is optional, and should only be entered when using SSL authentication. This must be the full path to the directory location. Sample value: |
|
idfTrustStorePassword |
This parameter holds the password for the SSL trust store. This parameter is optional, and should only be entered when using SSL authentication. |
|
idfTrustStoreType |
This parameter holds the trust store type for the SSL trust store. This parameter is optional, and should only be entered when using SSL authentication. Sample value: |
|
Last Modified Time Stamp |
The most recent start time of the RACF Reconcile All LDAP Users reconciliation scheduled task is stored in this parameter. See Section 5.7, "Initial LDAP Gateway Population and Full Reconciliation" for more information about this scheduled task. The format of the value stored in this parameter is as follows:
In this format:
Sample value: Default value: The reconciliation task will perform full LDAP user reconciliation when the value is 0. If the value is a non-zero, standard time-stamp value in the format given above, then incremental reconciliation is performed. Only records that have been created or modified after the specified time stamp are brought to Oracle Identity Manager for reconciliation. Note: When required, you can manually enter a time-stamp value in the specified format. |
To save the values, click Update.
Configuring Oracle Identity Manager involves performing the following procedures:
Section 3.4.1, "Creating Additional Metadata, Running Entitlement, and Catalog Synchronization Jobs"
Section 3.4.3, "Clearing Content Related to Connector Resource Bundles from the Server Cache"
You must create additional metadata such as a UI form and an application instance. In addition, you must run entitlement and catalog synchronization jobs. These procedures are described in the following sections:
Create and activate a sandbox as follows:
On the upper navigation bar, click Sandboxes. The Manage Sandboxes page is displayed.
On the toolbar, click Create Sandbox. The Create Sandbox dialog box is displayed.
In the Sandbox Name field, enter a name for the sandbox. This is a mandatory field.
In the Sandbox Description field, enter a description of the sandbox. This is an optional field.
Click Save and Close. A message is displayed with the sandbox name and creation label.
Click OK. The sandbox is displayed in the Available Sandboxes section of the Manage Sandboxes page.
From the table showing the available sandboxes in the Manage Sandboxes page, select the newly created sandbox that you want to activate.
On the toolbar, click Activate Sandbox.
The sandbox is activated.
Create a new UI form as follows. For detailed instructions, see Managing Forms in Oracle Fusion Middleware Administering Oracle Identity Manager.
In the left pane, under Configuration, click Form Designer.
Under Search Results, click Create.
Select the resource type for which you want to create the form, for example, OIMRacfResourceObject.
Enter a form name and click Create.
Create an application instance as follows. For detailed instructions, see Managing Application Instances in Oracle Fusion Middleware Administering Oracle Identity Manager.
In the System Administration page, under Configuration in the left pane, click Application Instances.
Under Search Results, click Create.
Enter appropriate values for the fields displayed on the Attributes form and click Save.
In the Form drop-down list, select the newly created form and click Apply.
Publish the application instance to an organization to make the application instance available for requesting and subsequent provisioning to users. See Managing Organizations Associated With Application Instances in Oracle Fusion Middleware Administering Oracle Identity Manager for detailed instructions.
To publish the sandbox that you created in Section 3.4.1.1, "Creating and Activating a Sandbox":
Close all the open tabs and pages.
In the upper right corner of the page, click the Sandboxes link.
The Manage Sandboxes page is displayed.
From the table showing the available sandboxes in the Manage Sandboxes page, select the sandbox that you created in Section 3.4.1.1, "Creating and Activating a Sandbox."
On the toolbar, click Publish Sandbox. A message is displayed asking for confirmation.
Click Yes to confirm. The sandbox is published and the customizations it contained are merged with the main line.
To harvest entitlements and sync catalog:
Run the scheduled jobs for lookup field synchronization. See Section 4.2, "Scheduled Tasks for Lookup Field Synchronization" for more information about these scheduled jobs.
Run the Entitlement List scheduled job to populate Entitlement Assignment schema from child process form table.
Run the Catalog Synchronization Job scheduled job.
See Predefined Scheduled Tasks in Oracle Fusion Middleware Administering Oracle Identity Manager for more information about these scheduled jobs.
For any changes you do in the Form Designer, you must create a new UI form and update the changes in an application instance. To update an existing application instance with a new form:
Create a sandbox and activate it as described in Section 3.4.1.1, "Creating and Activating a Sandbox."
Create a new UI form for the resource as described in Section 3.4.1.2, "Creating a New UI Form."
Open the existing application instance.
In the Form field, select the new UI form that you created.
Save the application instance.
Publish the sandbox as described in Section 3.4.1.4, "Publishing a Sandbox."
To localize field label that is added to the UI forms:
Log in to Oracle Enterprise Manager.
In the left pane, expand Application Deployments and then select oracle.iam.console.identity.sysadmin.ear.
In the right pane, from the Application Deployment list, select MDS Configuration.
On the MDS Configuration page, click Export and save the archive to the local computer.
Extract the contents of the archive, and open the following file in a text editor:
SAVED_LOCATION\xliffBundles\oracle\iam\ui\runtime\BizEditorBundle.xlf
Edit the BizEditorBundle.xlf file as follows:
Search for the following text:
<file source-language="en" original="/xliffBundles/oracle/iam/ui/runtime/BizEditorBundle.xlf" datatype="x-oracle-adf">
Replace with the following text:
<file source-language="en" target-language="LANG_CODE"
original="/xliffBundles/oracle/iam/ui/runtime/BizEditorBundle.xlf"
datatype="x-oracle-adf">
In this text, replace LANG_CODE with the code of the language that you want to localize the form field labels. The following is a sample value for localizing the form field labels in Japanese:
<file source-language="en" target-language="ja" original="/xliffBundles/oracle/iam/ui/runtime/BizEditorBundle.xlf" datatype="x-oracle-adf">
Search for the application instance code. The original code will be in the following format:
<trans-unit id="${adfBundle['oracle.adf.businesseditor.model.util.BaseRuntimeResourceBundle']['persdef.sessiondef.oracle.iam.ui.runtime.form.model.user.entity.userEO.UD_<Field_Name>__c_description']}">
<source><Field_Label></source>
<target/>
</trans-unit>
<trans-unit id="sessiondef.oracle.iam.ui.runtime.form.model.<UI_Form_Name>.entity. <UI_Form_Name>EO.UD_<Field_Name>__c_LABEL">
<source><Field_Label></source>
<target/>
</trans-unit>
For example, the following sample code shows the update that should be made for the FULL NAME field on a UI form named RacfUserForm1:
<trans-unit id="${adfBundle['oracle.adf.businesseditor.model.util.BaseRuntimeResourceBundle']['persdef.sessiondef.oracle.iam.ui.runtime.form.model.user.entity.userEO.UD_RACF_ADV_CN__c_description']}">
<source>FULL NAME</source>
<target/>
</trans-unit>
<trans-unit id="sessiondef.oracle.iam.ui.runtime.form.model.RacfUserForm1.entity.RacfUserForm1EO.UD_RACF_ADV_CN__c_LABEL">
<source>FULL NAME</source>
<target/>
</trans-unit>
Open the resource file from the /resources directory in the connector installation media, for example RACF-Adv_ja.properties, and get the value of the attribute from the file, for example global.udf.UD_RACF_ADV_CN=\u6C0F\u540D.
Replace the original code shown in Step 6.c with the following:
<trans-unit id="${adfBundle['oracle.adf.businesseditor.model.util.BaseRuntimeResourceBundle']['persdef.sessiondef.oracle.iam.ui.runtime.form.model.user.entity.userEO.UD_<Field_Name>__c_description']}">
<source>< global.udf.UD_Field_Name></source>
<target/>enter Unicode values here</target>
</trans-unit>
<trans-unit id="sessiondef.oracle.iam.ui.runtime.form.model.<UI_Form_Name>.entity. <UI_Form_Name>EO.UD_<Field_Name>__c_LABEL">
<source><Field_Label></source>
<target/>enter Unicode values here</target>
</trans-unit>
As an example, the code for FULL_NAME field translation would be:
<trans-unit id="${adfBundle['oracle.adf.businesseditor.model.util.BaseRuntimeResourceBundle']['persdef.sessiondef.oracle.iam.ui.runtime.form.model.user.entity.userEO.UD_RACF_ADV_CN__c_description']}">
<source>FULL_NAME</source> <target>\u6C0F\u540D</target> </trans-unit> <trans-unit id="sessiondef.oracle.iam.ui.runtime.form.model.RacfUserForm1.entity.RacfUserForm1EO.UD_RACF_ADV_CN__c_LABEL"> <source>FULL_NAME</source> <target>\u6C0F\u540D</target> </trans-unit>
Repeat Steps 6.c through 6.e for all attributes of the process form.
Save the file as BizEditorBundle_LANG_CODE.xlf. In this file name, replace LANG_CODE with the code of the language to which you are localizing. Sample file name: BizEditorBundle_ja.xlf.
Repackage the ZIP file and import it into MDS.
Log out of and log in to Oracle Identity Manager.
When you deploy the connector, the resource bundles are copied from the resources directory on the installation media into the Oracle Identity Manager database. Whenever you add a new resource bundle to the connectorResources directory or make a change in an existing resource bundle, you must clear content related to connector resource bundles from the server cache.
To clear content related to connector resource bundles from the server cache:
In a command window, switch to the OIM_HOME/server/bin directory.
Enter one of the following commands:
On Microsoft Windows: PurgeCache.bat All
On UNIX: PurgeCache.sh All
Note:
You can use the PurgeCache utility to purge the cache for any content category. RunPurgeCache.bat CATEGORY_NAME on Microsoft Windows or PurgeCache.sh CATEGORY_NAME on UNIX. The CATEGORY_NAME argument represents the name of the content category that must be purged.
For example, the following commands purge Metadata entries from the server cache:
PurgeCache.bat MetaData
PurgeCache.sh MetaData
Before running the PurgeCache utility, ensure the WL_HOME and JAVA_HOME environment variables are set.
When prompted, enter the user name and password of an account belonging to the SYSTEM ADMINISTRATORS group. In addition, you are prompted to enter the service URL in the following format:
t3://OIM_HOST_NAME:OIM_PORT_NUMBER
In this format:
Replace OIM_HOST_NAME with the host name or IP address of the Oracle Identity Manager host computer.
Replace OIM_PORT_NUMBER with the port on which Oracle Identity Manager is listening.
The IBM RACF connector supports two forms of logging, namely LDAP gateway-level logging and OIM-level logging. This section discusses the following topics:
LDAP Gateway logging operations are managed by the log4j.properties file, which can be extracted from within the ldapgateway/dist/idfserver.jar compilation file (see step 5 of Section 3.5, "Installing and Configuring the LDAP Gateway"). In the log4j.properties file, edit the rootLogger log level:
log4j.rootLogger=ERROR
The following is a list of log levels that can be used:
ALL
This level enables logging for all events.
DEBUG
This level enables logging of information about fine-grained events that are useful for debugging.
INFO
This level enables logging of messages that highlight the progress of the application at a coarse-grained level.
WARN
This level enables logging of information about potentially harmful situations.
ERROR
This level enables logging of information about error events that may allow the application to continue running.
FATAL
This level enables logging of information about very severe error events that could cause the application to stop functioning.
OFF
This level disables logging for all events.
You can also edit the log4j.properties file to configure the maximum log file size and maximum number of log files by using the following entries:
log4j.appender.FILE.MaxFileSize
Use this entry to set the maximum size of the log file in MB. The default value is 10MB.
log4j.appender.FILE.MaxBackupIndex
Use this entry to set the number of log files to create before the oldest file is overwritten. The default value is 100.
Multiple log files are available for use with the connector. Table 3-3 lists the name, location, and contents of each LDAP gateway log file.
Table 3-3 Log Files and their Contents
| Log File | Description |
|---|---|
|
nohup.out |
This log file contains the console window output from the LDAP Gateway. This file is primarily used in conjunction with the run.sh script (instead of the run.bat file). Location: ~/ldapgateway/bin/ |
|
idfserver.log |
This log file contains provisioning and reconciliation logging messages from the LDAP Gateway. This file is the primary log file used by the gateway component. Location: ~/idfserver/logs/ |
When you enable logging, Oracle Identity Manager automatically stores in a log file information about events that occur during the course of provisioning and reconciliation operations. Oracle Identity Manager uses Oracle Java Diagnostic Logging (OJDL) for logging. OJDL is based on java.util.logger.
To specify the type of event for which you want logging to take place, you can set the log level to one of the following:
ERROR:1
WARNING:1
NOTIFICATION:1
NOTIFICATION:16
TRACE:1
TRACE:16
TRACE:32
See Message Types and Levels in Oracle Fusion Middleware Administering Oracle Identity Manager for more information about the log levels.
Oracle Identity Manager level logging operations are managed by the logging.xml file which is located in the following directory:
DOMAIN_NAME/config/fmwconfig/servers/SERVER_NAME/
Loggers are used to configure logging operations for the Oracle Identity Manager functions of the connector.
To configure loggers:
In a text editor, open the DOMAIN_NAME/config/fmwconfig/servers/SERVER_NAME/logging.xml file.
Locate the logger you want to configure. If you are adding a logger for the first time, you must create the logger definition. Table 3-4, "Logger Parameters" lists the Oracle Identity Manager loggers for this connector.
| Logger | Description |
|---|---|
|
com.identityforge.IdfUserOperations |
Logs events related to provisioning operations from Oracle Identity Manager to the LDAP gateway, such as user creation and modification events. |
|
com.identityforge.util.racf.LdapOperationsImpl |
Logs events related to basic LDAP functions, including connecting to and disconnecting from the LDAP gateway. |
|
com.identityforge.racf.tasks.DeleteReconcileOIMUsersTask |
Logs events related to the RACF Delete OIM Users scheduled task. |
|
com.identityforge.racf.tasks.FindAllDatasetsTask |
Logs events related to the RACF Find All Datasets scheduled task. |
|
com.identityforge.racf.tasks.FindAllGroupsTask |
Logs events related to the RACF Find All Groups scheduled task. |
|
com.identityforge.racf.tasks.FindAllResourcesTask |
Logs events related to the RACF Find All Resources scheduled task. |
|
com.identityforge.racf.tasks.FindAllSecurityAttributesTask |
Logs events related to the RACF Find All Security Attributes scheduled task. |
|
com.identityforge.racf.tasks.ReconcileAllLdapUsersTask |
Logs events related to the RACF Reconcile All LDAP Users scheduled task. |
|
com.identityforge.racf.tasks.ReconcileAllUsersTask |
Logs events related to the RACF Reconcile All Users scheduled task. |
|
com.identityforge.racf.tasks.ReconcileDeletedLDAPUsersTask |
Logs events related to the RACF Reconcile Deleted LDAP Users scheduled task. |
|
com.identityforge.racf.tasks.ReconcileUsersToInternalLdapTask |
Logs events related to the RACF Reconcile Users to Internal LDAP scheduled task. |
Define the <logger> element and its handlers. You can use the standard odl-handler as the log handler, or write your own. For more information on configuring logging in Oracle Identity Manager, see Enabling System Logging in Oracle Fusion Middleware Administering Oracle Identity Manager.
The following is an example of a logger definition for the Reconcile All Users scheduled task:
<logger name='com.identityforge.racf.tasks.ReconcileAllUsersTask' level="TRACE:32"> <handler name="odl-handler"/> </logger>
Save the changes and close the file.
Restart Oracle Identity Manager for the changes to take effect.
Log statements will be written to the path that is defined in the log handler that you assigned in the logger definition. For example, in the above logger definition for the Reconcile All Users scheduled task (in step 3), the handler is odl-handler, which has the following default output file path:
${domain.home}/servers/${weblogic.Name}/logs/${weblogic.Name}-diagnostic.log
The IT resource contains connection information for Oracle Identity Manager to connect to the LDAP Gateway. The racf.properties file is one of the components of the gateway. This file contains information used by the gateway to connect to the mainframe. Configuring the gateway involves setting values in the racf.properties file and the other files that are used by the gateway.
To install and configure the LDAP Gateway:
Extract the contents of the ldapgateway.zip file to a directory on the computer on which you want to install the LDAP Gateway. This ZIP file is in the etc/LDAP Gateway directory on the installation media.
Note:
In this document, the location (and name) of the ldapgateway directory on the host computer is referred to as LDAP_INSTALL_DIR.In a text editor, open the LDAP_INSTALL_DIR/conf/racf.properties file. Enter values for the properties listed in this file. Table 3-5 describes these properties.
Table 3-5 Properties in the racf.properties File
| Property | Description |
|---|---|
|
agentPort |
Enter the port number on the LDAP Gateway host computer that you are going to reserve for messages sent from the mainframe by the Reconciliation Agent Voyager. The LDAP Gateway will receive messages using this port. This value should match the value of the PORT parameter in the Voyager agent control file. |
|
_configAttrs_ |
This property holds the field names of any custom target system fields that are defined in the CSDATA user segment and used during user provisioning operations. If entering more than one value, separate each value with a vertical bar (|) character. Each field name should have a corresponding configDNames entry.This step is mentioned in the following sections: For example, if you define fields with a display name of $PST15 and VEND ID, then you would enter:
|
|
_configDNames_ |
This property holds the display name(s) of RACF field(s) that are defined in the CSDATA segment and used during user reconciliation operations. If entering more than one value, separate each value with a vertical bar (|) character. Each display name should have a corresponding configAttrs entry. For example, if you define a field with a display name of $PST15 and VEND ID, then you would enter:
|
|
defaultDelete |
Enter one of the following as the value of this property:
For example:
|
|
host |
Set the host name or IP address of the mainframe as the value of this property. |
|
port |
Enter the number of the port on the mainframe that you are going to reserve for the Provisioning Agent. The LDAP Gateway will send provisioning messages to this port. This value should match the PORT parameter specified in the Pioneer provisioning agent STC. |
|
ver45 |
This property is used to determine whether the LDAP gateway must use the large (240K) socket buffer when passing messages to the target system.Values: If you set the value of this property to Default setting is |
|
auditOn |
This property is used to store audit data from IBM RACF. Default setting is |
|
domainOU |
This property is used to store user in a certain location under the ou=People tree of the internal LDAP. This needs to be unique and specific for each system if multiple systems are used within one LDAP Gateway. |
|
_stcID_ |
This property allows the real-time agent to ignore events that have been submitted to the target system by the Pioneer STC (such as by request from Oracle Identity manager).Enter the name given to the Pioneer STARTED TASK. |
|
_internalEnt_ |
This property is used to allow the real-time agent to store users in the LDAP internal store. Values: |
|
_internalGrpEnt_ |
This property is used to allow the real-time agent to store groups in the LDAP internal store. Values: |
|
_internalCREnt_ |
This property is used to allow the real-time agent to store connect and remove commands in the LDAP internal store. Values: |
|
isStreamingUsers |
This property is used by the RACF Reconcile Users to Internal LDAP scheduled task. If you set the value of this property to true, the LDAP gateway will process the USER EXTRACT data from the mainframe. If you set the value of this property to false, the LDAP gateway will not process any USER EXTRACT data. Default value: |
|
isStreamingGroups |
This property is used by the Top Secret Reconcile Users to Internal LDAP scheduled task. If you set the value of this property to true, the LDAP gateway will process the GROUP EXTRACT data from the mainframe. If you set the value of this property to false, the LDAP gateway will not process any GROUP EXTRACT data. Default value: |
|
useExtractGrp |
Use this new property for faster reconciliation. Default setting is false which will run a LISTUSER. If the default setting is set to true, an EXTRACT command will be issued instead. |
|
useExtractUser |
Use this new property for faster reconciliation. Default setting is false which will run a LISTUSER. If the property is set to true, an EXTRACT command will be issued instead and use configExtractAttrs for CSDATA fields. |
|
_configExtractAttrs_ |
Use this property to list any custom CSDATA fields for RACF. Use this when using 'useExtractUser=true' property above. Note: The value in this property must match the RACF CSDATA segment. Sample value: |
|
_extractGrp_ |
Use this property to list any custom CSDATA GROUP fields for RACF. Use this when using 'useExtractGroup=true' property above. Sample value: |
|
_allowDeleteDS_ |
This property is used for default action when a delete request occurs that will delete dataset profiles for user being deleted. If the property is set to true, deleting a user will delete both the user and the user's datasets. |
|
revokePsuspendUsers |
Use this property to specify whether users with the PSUSPEND attribute should be flagged as revoked when parsing a LIST USER result message.
|
|
resumeOnReset |
This property is used when resetting a user's password. If you set the value of this property to true, the user will be enabled during a reset password operation. If you set the value of this property to false, the user will not be enabled during a reset password operation. Default value: |
|
secretKeyValue |
This property contains the custom encryption key. This key should match the secretKey value used by the mainframe agents. See Appendix I, "Customizing AES Encryption Key" for more information on using this property. |
|
_useUnivGrp_ |
Use this property to specify whether to use universal groups instead of normal groups on the target system. Universal groups can have an unlimited number of AUTH(USE) userIDs connected to it. Values: |
|
trimOmvsUid |
This property is used with the omvsUid attribute. If you set the value of this property to true, the LDAP gateway will trim leading zeros, "0", from the omvsUid value. If you set the value of this property to false, the LDAP gateway will not trim any leading zeroes from the omvsUid value. Default value: |
|
trimNum |
This property is used with the trimOmvsUid property and specifies the number of leading zeroes to trim from a user's omvsUid attribute. Default value: |
|
newOmvsUidAttr |
This property specifies the new name to use for the omvsUid property. Default value: |
|
usePwdComplexLength |
This property is used to control the length of passwords. If you set the value of this property to true, the LDAP gateway will use the properties file password length settings. If you set the value of this property to false, the LDAP gateway will use the standard password length. Default value: |
|
idMinLength |
This property specifies the minimum UID length in characters. Default value: |
|
idMaxLength |
This property specifies the maximum UID length in characters. Default value: |
|
pwdMinLength |
This property specifies the minimum password length for a UID. Default value: |
|
pwdMaxLength |
This property specifies the maximum password length for a UID. Default value: |
|
type isencrypted timeout authretries requestorId |
These properties are no longer used in Oracle installations. Do not modify their values. |
|
errormsg-sig-file |
This property defines an error message signature XML file that contains a new error message signatures (or overrides existing error message signatures by specifying the same id). If it is an overriding entry, you must use the same id as specified in the LDAP Gateway\ldapgateway5.0-v5.3.18\dist\idfserver\com\identityforge\idfserver\back end\racf\repository\errorMsgSignatures.xml. See Section 5.11, "Handling PIONEER Error Messaging Exceptions in the Gateway". |
|
check-return-codes |
Enable or Disable the SAF and RACF return codes that are examined from Pioneer to determine if the command is succeeded. Note: Certain z/OS environments may produce warning codes that is interpreted as error codes if this feature is enabled and used with errormsg-sig-file. You must set this parameter to "no" {check-return-codes=no} if you want to use custom message signature file. See Section 5.11, "Handling PIONEER Error Messaging Exceptions in the Gateway". |
Save and close the racf.properties file.
From the LDAP_INSTALL_DIR/dist/idfserver.jar file, delete and extract the beans.xml file and then open the file in a text editor.
Note:
When installing, ensure you are using the latest Bundle Patch and consult Oracle Support with any questions.You use the beans.xml file to store the credentials of the account used by Oracle Identity Manager to connect to the LDAP Gateway. You also enter these credentials as parameters of the IT resource. During provisioning and reconciliation, the credentials passed through the IT resource are authenticated against the credentials stored in the beans.xml file. The LDAP Gateway exchanges data with the connector only after this authentication succeeds.
You enter the credentials of the LDAP Gateway user in the following lines of the beans.xml file:
<property name="adminUserDN" value="cn=idfRacfAdmin,dc=RACF,dc=com"/> <property name="adminUserPassword" value="idfRacfPwd"/>
In the first line, replace cn=idfRacfAdmin,dc=RACF,dc=com with the value that you entered for the idfPrincipalDn parameter of the IT resource. In the second line, replace idfRacfPwd with the value that you entered for the idfPrincipalPwd parameter of the IT resource. Table 3-2, "IT Resource Parameters" describes both parameters. If you want to encrypt the password before you enter it in the beans.xml file, then:
Note:
It is optional to encrypt the password that you set in the beans.xml file. However, it is recommended that you encrypt the password for security reasons.You must enter the unencrypted password as the value of the idfPrincipalPwd IT resource parameter. This is regardless of whether you enter the encrypted password in the beans.xml file.
In a text editor, copy one of the following script files from the installation media into a temporary directory and then open the script file in a text editor:
For Microsoft Windows:
/scripts/propertyEncrypt.bat
For UNIX:
/scripts/propertyEncrypt.sh
Specify values for the following properties in the file:
SET CLASSPATH=DIRECTORY_LOCATION\idfserver.jar
Replace DIRECTORY_LOCATION with the full path of the directory into which you copied the idfserver.jar file while deploying the connector.
For example:
SET CLASSPATH=C:\software\ldapgateway\dist\idfserver.jar
%JAVACMD% %JVM_OPTS% -cp %CLASSPATH% com.identityforge.idfserver.util.AESCipherUtil PLAINTEXT_PASSWORD
Replace PLAINTEXT_PASSWORD with the password that you want to encrypt.
For example:
%JAVACMD% %JVM_OPTS% -cp %CLASSPATH% com.identityforge.idfserver.util.AESCipherUtil idfRacfPwd
Save the changes made to the propertyEncrypt.bat or propertyEncrypt.sh script.
Run the script.
The script encrypts the password that you provide and displays it in the command window.
In the beans.xml file, search for the following string:
<property name="adminUserPassword">
Replace the value of this property with the encrypted password.
For example:
<property name="adminUserPassword" value="468018DD1CDBE82E515EBF78A41C428E"/>
In the beans.xml file, specify the port used for communication between the LDAP Gateway and the mainframe logical partition (LPAR) on which you installed the Reconciliation and Provisioning Agents.
Note:
The procedure to install these agents is described in the next chapter.As shown in the following line, the default value of the port property is 5389. You can change this default value to any port of your choice.
<property name="port" value="6389"/>
The port number should match the value that you specify for the idfServerPort IT resource parameter.
To enable logging for the LDAP Gateway:
Copy the log4j JAR file from the application server directory in which it is placed to the LDAP_INSTALL_DIR/lib directory.
Extract the log4j.properties file from the LDAP_INSTALL_DIR/dist/idfserver.jar file.
Enter a log level as the value of the log4j.rootLogger variable. For example:
log4j.rootLogger=ERROR, CONSOLE, FILE
See Also:
Section 3.4.4, "Enabling Logging" for more informationSave and close the file.
When you use the connector, the idfserver.log.0 log file is generated in the LDAP_INSTALL_DIR/logs directory. This file is the main LDAP Gateway operations log file.
To configure the SSL in the LDAP Gateway:
Edit the /ldapgateway/idfserver.jar beans.xml directory for the following:
<bean id="sslContextFactory" class="com.identityforge.idfserver.nettynio.SslContextFactory"> <constructor-arg><value>false</value></constructor-arg> <constructor-arg><value>../conf/testnew.jks</value></constructor-arg> <constructor-arg><value>abc123</value></constructor-arg> <constructor-arg><value>false</value></constructor-arg> </bean>
The first argument indicates we are not in client mode.
Note:
Do not change this argument.The second argument is the path to the keystore. Either change this path to your keystore or add your certificate to this keystore.
The third argument is the keystore password that you used to generate your keystore.
The fourth argument indicates whether the keystore password is encrypted. Use false for plain-text passwords, and true for encrypted passwords.
Edit a listener using the SSLChannelFactory for only "port", which is the only item you can change in the listener:
<bean id="sslListener" class="com.identityforge.idfserver.nio.Listener"> constructor-arg><ref bean="bus"/></constructor-arg> <constructor-arg><ref bean="sslChannelFactory"/></constructor-arg> <property name="admin"><value>false</value></property> <property name="config"><value>./conf/listener.xml</value></property> <property name="port" value="7389"/> <property name="threadName" value="SSLLDAPListener"/> </bean>
Add the listener to the server by uncommenting the following line:
<bean id="server" class="com.identityforge.idfserver.Server"> <property name="tasks"> <list> <ref bean="bus"/> <ref bean="decoder"/> <ref bean="listener"/> <!-- <ref bean="sslListener"/> <!-- added here --> <ref bean="client"/> <ref bean="protocol"/> <ref bean="encoder"/> <ref bean="output"/> </list> </property> <property name="nexus" ref="nexus"/> <property name="logPath" value="../logs/idfserver.log"/> </bean>
Save the changes made to the beans.xml file, and then re-create the idfserver.jar file.
Note:
When recreating the idfserver.jar: jar uvf idfserver.jar *, do not use cvf as this overwrites the required META-INF Directory.Ensure that the JAVA version is 1.7 or 1.8.
Note:
Use Oracle JAVA JRE, but not JAVA JRockit.[oracle@identity logs]$ java -version
java version "1.8.0_45"
Java(TM) SE Runtime Environment (build 1.8.0_45-b14)
Java HotSpot(TM) 64-Bit Server VM (build 25.45-b02, mixed mode)
Ensure that run.sh and stop.sh can be executed on the non-Windows systems.
o - chmod 755 run.sh o - chmod 755 stop.sh
Starting and Stopping the LDAP Gateway on UNIX
To start the LDAP Gateway on UNIX, run the following command:
bin>./run.sh
When the LDAP Gateway has started, the LDAP Gateway VERSION_NUMBER Started message is recorded in the in the LDAP_INSTALL_DIR/bin/nohup.out log file. For more information on logging, see Section 3.4.4, "Enabling Logging".
To stop the LDAP Gateway on UNIX, run the following command:
bin> ./stop_idf.sh
Starting and Stopping the LDAP Gateway on Microsoft Windows
To start the LDAP Gateway on Microsoft Windows, run the run.bat file.
When the LDAP Gateway has started, the LDAP Gateway VERSION_NUMBER Started message is recorded in the idfserver.log.
To stop the LDAP Gateway on Microsoft Windows, close the command window in which the gateway is running.