| Oracle® Identity Manager Connector Guide for CA ACF2 Advanced Release 9.0.4 Part Number E10423-03 |
|
|
View PDF |
| Oracle® Identity Manager Connector Guide for CA ACF2 Advanced Release 9.0.4 Part Number E10423-03 |
|
|
View PDF |
The following sections in this chapter describe the procedure to deploy the LDAP Gateway on the Oracle Identity Manager host computer:
Refer to the following section if you want to configure the connector for multiple installations of the target system:
See Also:
Chapter 3, "Connector Deployment on CA ACF2" for the procedure to deploy the Reconciliation Agent and Provisioning Agent on the mainframeTable 2-1 describes the contents of the connector installation media.
Table 2-1 Files and Directories That Comprise the Connector
| Files and Directories | Description of Files and Contents |
|---|---|
|
etc/LDAP Gateway/ldapgateway.zip |
Files required to deploy the LDAP Gateway. |
|
Files in the etc/Provisioning and Reconciliation Connector/ directory:
|
Files required to deploy the Provisioning Agent and the Reconciliation Agent on the mainframe. |
|
lib/idm.jar |
The connector JAR file to be deployed on the Oracle Identity Manager system. It contains the Oracle Identity Manager process tasks adapter code. |
|
lib/acf2-adv-agent-recon.jar lib/acf2Connection.properties |
Files required to enable real-time reconciliation between the target system and Oracle Identity Manager. |
|
Files in the resources directory |
Each of these resource bundles contains locale-specific information that is used by the connector. Note: A resource bundle is a file containing localized versions of the text strings that are displayed on the user interface of Oracle Identity Manager. These text strings include GUI element labels and messages displayed on the Administrative and User Console. |
|
Files in the scripts directory:
|
Files that are used to perform first-time (initial) reconciliation with Oracle Identity Manager. |
|
scripts/user.txt |
Sample of the file containing user data that is used during initial reconciliation. This file is discussed in detail in "Running Initial Reconciliation". |
|
xml/oimAcf2AdvancedConnector.xml |
This XML file contains definitions for the connector components related to reconciliation and provisioning. These components include:
|
|
Xml/oimAcf2TrustedXellerateUser.xml |
The XML file that contains component definitions for the connector for trusted source reconciliation. |
Copy the following connector files to the destination directories on the Oracle Identity Manager host computer as indicated in Table 2-2.
Note:
See "Files and Directories That Comprise the Connector" for more information about these files. Do not copy the files that are not listed in this table. Those files are used later in the deployment procedure.Table 2-2 Copying the Connector Files
| Files | Destination |
|---|---|
|
LDAP_INSTALL_DIR This is the directory on the Oracle Identity Manager system where you want to install the LDAP Gateway. See "Installing and Configuring the LDAP Gateway" for information about installing the LDAP Gateway. |
|
|
lib/acf2Connection.properties |
LDAP_INSTALL_DIR/etc |
|
Files in the scripts directory:
|
OIM_HOME/xellerate/JavaTasks |
|
OIM_HOME/xellerate/connectorResources/ |
|
|
xml/oimAcf2AdvancedConnector.xml xml/oimAcf2TrustedXellerateUser.xml |
OIM_HOME/xellerate/XLIntegrations/acf2/xml/ |
Note:
While installing Oracle Identity Manager in a clustered environment, you copy the contents of the installation directory to each node of the cluster. Similarly, you must copy the files in the connectorResources directory and the JAR files to the corresponding directories on each node of the cluster.Configuring Oracle Identity Manager involves the following procedures:
Note:
In a clustered environment, you must perform these steps on each node of the cluster.When you perform the procedure described in "Copying the Connector Files", you copy the resource bundles for this connector into the OIM_HOME/xellerate/connectorResources directory. Whenever you add a new resource bundle in the connectorResources directory or make a change in an existing resource bundle, you must clear content related to connector resource bundles from the server cache.
To clear content related to connector resource bundles from the server cache:
In a command window, go to the OIM_HOME/xellerate/bin/ directory.
Note:
You must perform step 1 before you perform step 2. An exception is thrown if you run the command described in Step 2 as follows:OIM_HOME/xellerate/bin/BATCH_FILE_NAME
Enter one of the following commands:
On Microsoft Windows:
PurgeCache.bat ConnectorResourceBundle
On UNIX:
PurgeCache.sh ConnectorResourceBundle
Note:
You can ignore the exception that is thrown when you perform Step 2. This exception is different from the one mentioned in Step 1.In this command, ConnectorResourceBundle is one of the content categories that you can remove from the server cache. Refer to the following file for information about the other content categories:
OIM_HOME/xellerate/config/xlConfig.xml
When you enable logging, Oracle Identity Manager automatically stores in a log file information about events that occur during the course of provisioning and reconciliation operations. To specify the type of event for which you want logging to take place, you can set the log level to one of the following:
ALL
This level enables logging for all events.
DEBUG
This level enables logging of information about fine-grained events that are useful for debugging.
INFO
This level enables logging of messages that highlight the progress of the application at a coarse-grained level.
WARN
This level enables logging of information about potentially harmful situations.
ERROR
This level enables logging of information about error events that may allow the application to continue running.
FATAL
This level enables logging of information about very severe error events that could cause the application to stop functioning.
OFF
This level disables logging for all events.
The file in which you set the log level and the log file path depend on the application server that you use:
JBoss Application Server
To enable logging:
In the JBOSS_HOME/server/default/conf/log4j.xml file, add the following lines:
<category name="COM.IDENTITYFORGE.ORACLE.INTEGRATION.IDFACF2USEROPERATIONS">
<priority value="LOG_LEVEL"/>
</category>
In the second XML line, replace LOG_LEVEL with the log level that you want to set. For example:
<category name="COM.IDENTITYFORGE.ORACLE.INTEGRATION.IDFACF2USEROPERATIONS"> <priority value="INFO"/> </category>
After you enable logging, log information is written to the following file:
JBOSS_HOME/server/default/log/server.log
IBM WebSphere Application Server
To enable logging:
In the OIM_HOME/xellerate/config/log.properties file, add the following line:
log4j.logger.COM.IDENTITYFORGE.ORACLE.INTEGRATION.IDFACF2USEROPERATIONS=LOG_LEVEL
In this line, replace LOG_LEVEL with the log level that you want to set. For example:
log4j.logger.COM.IDENTITYFORGE.ORACLE.INTEGRATION.IDFACF2USEROPERATIONS=INFO
After you enable logging, log information is written to the following file:
WEBSPHERE_HOME/AppServer/logs/SERVER_NAME/startServer.log
BEA WebLogic Server
To enable logging:
In the OIM_HOME/xellerate/config/log.properties file, add the following line:
log4j.logger.COM.IDENTITYFORGE.ORACLE.INTEGRATION.IDFACF2USEROPERATIONS=LOG_LEVEL
In this line, replace LOG_LEVEL with the log level that you want to set. For example:
log4j.logger.COM.IDENTITYFORGE.ORACLE.INTEGRATION.IDFACF2USEROPERATIONS=INFO
After you enable logging, log information is written to the following file:
WEBLOGIC_HOME/user_projects/domains/DOMAIN_NAME/SERVER_NAME/SERVER_NAME.log
Oracle Application Server
To enable logging:
In the OIM_HOME/xellerate/config/log.properties file, add the following line:
log4j.logger.COM.IDENTITYFORGE.ORACLE.INTEGRATION.IDFACF2USEROPERATIONS=LOG_LEVEL
In this line, replace LOG_LEVEL with the log level that you want to set. For example:
log4j.logger.COM.IDENTITYFORGE.ORACLE.INTEGRATION.IDFACF2USEROPERATIONS=INFO
After you enable logging, log information is written to the following file:
OAS_HOME/opmn/logs/default_group~home~default_group~1.log
To import the connector XML file into Oracle Identity Manager:
Open the Oracle Identity Manager Administrative and User Console.
Click the Deployment Management link on the left navigation pane.
Click the Import link under Deployment Management. A dialog box for locating files is displayed.
Locate and open the oimAcf2AdvancedConnector.xml file, which is in the OIM_HOME/xellerate/XLIntegrations/acf2/xml/ directory. Details of this XML file are shown on the File Preview page.
You must import the XML file for trusted source reconciliation, acf2TrustedXellerateUser.xml, after the other XML file is imported. In other words, you must import oimAcf2AdvancedConnector.xml regardless of whether you want to implement target resource or trusted source reconciliation. If you want to implement trusted source reconciliation, then import the acf2TrustedXellerateUser.xml file after the first one is imported.
Click Add File. The Substitutions page is displayed.
Click Next. The Confirmation page is displayed.
Click Next. The Provide IT Resource Instance Data page is displayed.
Create an IT resource based on the OIMLDAPGatewayResourceType IT resource type. You must specify values for the IT resource parameters listed in Table 2-3.
Table 2-3 Defining IT Resources
| Parameter | Description |
|---|---|
|
AtMap User |
Name of the lookup definition containing attribute mappings that are used for provisioning Value: Note: You must not change the value of this parameter. |
|
idfPrincipalDn |
The administrator ID for connecting to the LDAP Gateway Sample value: |
|
idfPrincipalPwd |
The administrator password for connecting to the LDAP Gateway Sample value: See step 9 of "Installing and Configuring the LDAP Gateway" for information about changing the password. |
|
idfRootContext |
The root context for CA ACF2 Value: dc=acf2,dc=com Note: You must not change the value of this parameter. |
|
idfServerHost |
Host name for connecting to the LDAP Gateway Sample value: Note: You must not change the value of this parameter if you install the LDAP Gateway on the host computer as the one on which Oracle Identity Manager is installed. If you install the LDAP Gateway on a different computer, then specify the host name or IP address of that computer. |
|
idfServerPort |
The port for connecting to the LDAP Gateway Sample value: |
Click Next. The Provide IT Resource Instance Data page for a new instance of the OIMLDAPGatewayResourceType IT resource type is displayed.
Click Skip to specify that you do not want to define another IT resource. The Confirmation page is displayed.
Click View Selections.
The contents of the XML file are displayed on the Import page. You may see a cross-shaped icon along with some nodes. These nodes represent Oracle Identity Manager entities that are redundant. Before you import the connector XML file, you must remove these entities by right-clicking each node and then selecting Remove.
Click Import. The connector file is imported into Oracle Identity Manager.
Adapters are used to implement provisioning functions. The following adapters are imported into Oracle Identity Manager when you import the connector XML file:
CreateUserAcf2
OnBoardAcf2User
ResetAcf2Password
ChangeAcf2UserPassword
DeleteAcf2User
RevokeAcf2User
ResumeAcf2User
ModifyAcf2User
ModifyAcf2UserRemove
AssignACF2UserToDataset
UnAssignAcf2UserFromDataset
You must compile these adapters before they can be used in provisioning operations. To compile adapters by using the Adapter Manager form:
To compile all the adapters that you have imported into the current database, click Compile All.
If you have created your own adapters or if a new adapter is shipped with a patch that you installed, then you might need to compile one adapter at a time. To compile multiple (but not all) adapters, select the adapters you want to compile. Then, click Compile Selected.
Click Start. Oracle Identity Manager compiles the adapters that you specify.
If Oracle Identity Manager is installed in a clustered environment, then copy the compiled adapters from the OIM_HOME/xellerate/Adapter directory to the same directory on each of the other nodes of the cluster. If required, overwrite the adapter files on the other nodes.
To install and configure the LDAP Gateway:
Extract the contents of the ldapgateway.zip file to a directory on the computer on which Oracle Identity Manager is installed.
Note:
In this document, the location (and name) of the ldapgateway directory is referred to as LDAP_INSTALL_DIR.In a text editor, open the following scripts:
Open the run.sh or run.bat script from the LDAP_INSTALL_DIR/bin/ directory.
Open the run_initial_recon_provisioning script from the OIM_HOME/Xellerate/JavaTasks directory.
In the run script:
Set the JAVA_HOME property as follows:
JAVA_HOME=DIRECTORY_LOCATION\j2sdj1.4.2_13
Replace DIRECTORY_LOCATION with the full path of the directory.
If you plan to run multiple LDAP Gateways on a Linux or Solaris environment and there are not enough socket file descriptors to open up all the ports needed for the server, then add the following line:
-Djava.nio.channels.spi.SelectorProvider=sun.nio.ch.PollSelectorProvider
In the run and run_initial_recon_provisioning scripts, uncomment the line related to the application server directory. In addition, change the path to reflect the actual location of the application server directory.
Note:
The contents of the run and run_initial_recon_provisioning scripts are similar. You must make the same change in both the scripts.The lines starting with a number sign (#) are comments, as shown:
##### SET JBOSS HOME ################## #APPSERVER_HOME=/opt/ldapgateway/lib/jboss-4.0.2
To uncomment the line, remove the number sign. For example, to ensure that the connector works with JBoss Application Server, change the line to the following:
##### SET JBOSS HOME ################## APPSERVER_HOME=/opt/ldapgateway/lib/jboss-4.0.2
If you are using IBM WebSphere Application Server 6.1, then add the com.ibm.ws.wccm_6.1.0.jar file to the CLASSPATH variable in the run and run_initial_recon_provisioning scripts as shown in the following example:
rem
rem SET WEBSPHERE APPLICATION SERVER REQUIRED LIBRARIES
rem
set CLASSPATH=%CLASSPATH%;"%APPSERVER_HOME%"\lib\com.ibm.ws.wccm_6.1.0.jar
In a text editor, open the LDAP_INSTALL_DIR/conf/acf2.properties file. In this file, specify information for the following properties of the message transport layer that you use:
For TCP/IP, the default values are as follows:
_type_=socket
_isencrypted_=true
_timeout_=5000
_authretries_=1
_host_=HOST_NAME_OR_IP_ADDRESS_OF_MAINFRAME
_port_=5790
_agentport_=5190
The configurable properties are:
_type_: The transport type, which is TCP/IP (socket)
_host_: The host name of IP Address of the mainframe
Note:
If you are configuring the LDAP Gateway on the computer on which Oracle Identity Manager is installed, then specifylocalhost as the value of the _host_ property. If you are configuring the LDAP Gateway on a different computer, then specify the host name or IP address of the computer as the value of the _host_ property. However, it is recommended that you install the LDAP Gateway on the same computer on which Oracle Identity Manager is installed._port_: The port of the Pioneer Provisioning Agent
_agentport_: The port that the Voyager Reconciliation Agent needs to send messages
In the acf2.properties file, use the following property to specify whether you want to revoke access rights or delete users during Disable User provisioning operations:
# DEFAULT ACTION WHEN DELETE FUNCTION USED
_defaultDelete_=delete
Set revoke as the value of this property if you want the user to be disabled on the target system as the outcome of a Delete User provisioning operation.
Set delete as the value of this property if you want the user to be deleted from the target system as the outcome of a Delete User provisioning operation.
In the acf2.properties file, use the _nameFormat_ property to specify the format of the Full Name attribute.
You can use the following as the components of the format that you specify:
Use fn to represent the first name.
Use sp to represent the space character.
Use ln to represent the last name.
Use a comma (,) to represent the comma.
Use a period (.) to represent the period.
Use the vertical bar (|) as the separator for the other components.
The following line shows a sample value for the _nameFormat_ property:
_nameFormat_=fn|sp|ln
Open the LDAP_INSTALL_DIR/etc/acf2Connection.properties file and edit the following property:
Note:
You must also make this change in the initialAcf2Adv.properties file, which is in the OIM_HOME/xellerate/JavaTasks directory._itResource_=NAME_OF_THE_NEW_IT_RESOURCE
Replace NAME_OF_THE_NEW_IT_RESOURCE with the name of the IT resource that you create by performing Step 8 of the procedure described in "Importing the Connector XML File".
From the LDAP_INSTALL_DIR/dist/idfserver.jar file, extract the beans.xml file, open it in an editor, and set values for the following:
Target system administrator credentials
You must change the administrator credentials stored in the following lines of the beans.xml file:
Note:
In these lines, the values that you can change are highlighted in bold font. The values that you enter in the beans.xml file must be the same as the values that you specify for the IT resource parameters and the properties in the acf2Connection.properties and initialAcf2Adv.properties files.<property name="adminUserDN" value="cn=idfAcf2Admin,dc=acf2,dc=com"/> <property name="adminUserPassword" value="password"/>
Port used for communication between the LDAP Gateway and the mainframe logical partition (LPAR) that you use for the connector installation
The default value of the port property is 5389. If you want to change this value, then edit the value of the port property defined in the beans.xml file:
<property name="port" value="5389"/>
Save the changes made to the beans.xml file, and then re-create the idfserver.jar file.
Note:
When you start using the connector, the logs for the LDAP Gateway are created in the LDAP_INSTALL_DIR/logs directory.You can configure the connector for multiple installations of the target system. You can also configure the connector for a scenario in which multiple logical partitions (LPARs), which are not associated with the first LPAR, are configured in the target system.
For each installation of the target system, you create an IT resource and configure an additional instance of the LDAP Gateway.
To configure the connector for the second installation of the target system:
Note:
Perform the same procedure for each additional installation of the target system.Create an IT resource based on the OIMLDAPGatewayResourceType IT resource type.
See Also:
Oracle Identity Manager Design Console Guide for information about creating IT resources
Step 8 of "Importing the Connector XML File" for information about the parameters of the IT resource
Copy the current LDAP_INSTALL_DIR directory, including all the subdirectories, to a new location.
Note:
In the remaining steps of this procedure, LDAP_INSTALL_DIR refers to the newly copied directory.Extract the contents of the LDAP_INSTALL_DIR/dist/idfserver.jar file.
In the beans.xml file, change the value of the port in the <property name="port" value="xxxx"/> line to specify a port that is different from the port used for the first instance of the LDAP Gateway. The default port number is shown in the following example:
<bean id="listener" class="com.identityforge.idfserver.nio.Listener">
<constructor-arg><ref bean="bus"/></constructor-arg>
<property name="admin"><value>false</value></property>
<property name="config"><value>../conf/listener.xml</value></property>
<property name="port" value="5389"/>
</bean>
If you change the port number, then you must make the same change in the value of the idfServerPort parameter of the IT resource that you create.
Save and close the bean.xml file.
Open the LDAP_INSTALL_DIR/conf/acf2.properties file and edit the following properties:
_host_=IP_ADDRESS_OR_HOST_NAME_OF_THE_MAINFRAME
_port_=PORT_OF_THE_SECOND_INSTANCE_OF_THE_PROVISIONING_AGENT
_agentPort_=PORT_OF_THE_SECOND_INSTANCE_OF_THE_RECONCILIATION_AGENT
Note:
The value of the _agentPort_ property must not be the same as that of the first instance if a second LPAR, which is not associated with the first LPAR, is configured in the target system. This value can be the same as the value of the idfServerPort property if you have two mainframe servers with CA ACF2 running on each server.Open the LDAP_INSTALL_DIR/etc/acf2Connection.properties file and edit the following property:
_itResource_=NAME_OF_THE_NEW_IT_RESOURCE
|
 Copyright © 2009, Oracle and/or its affiliates. All rights reserved. Legal Notices |
|