| Oracle® Identity Manager Connector Guide for CA Top Secret Advanced Release 9.0.4 Part Number E10424-06 |
|
|
View PDF |
| Oracle® Identity Manager Connector Guide for CA Top Secret Advanced Release 9.0.4 Part Number E10424-06 |
|
|
View PDF |
The following sections describe the procedure to deploy the LDAP Gateway on the Oracle Identity Manager host computer:
Refer to the following section if you want to configure the connector for multiple installations of the target system:
See Also:
Chapter 3, "Connector Deployment on CA Top Secret" for the procedure to deploy the Reconciliation Agent and Provisioning Agent on the mainframeTable 2-1 describes the contents of the connector installation media.
Table 2-1 Files and Directories That Comprise the Connector
| Files and Directories | Description of Files and Contents |
|---|---|
|
etc/LDAP Gateway/ldapgateway.zip |
Files required to deploy the LDAP Gateway. |
|
Files in the etc/Provisioning and Reconciliation Connector/ directory |
Files required to deploy the Provisioning Agent and the Reconciliation Agent on the mainframe. |
|
lib/idm.jar |
Connector JAR file to be deployed on the Oracle Identity Manager system. It contains the Oracle Identity Manager process tasks adapter code. |
|
lib/topsecret-adv-agent-recon.jar lib/topsecretConnection.properties |
Files required for real-time reconciliation between the target system and Oracle Identity Manager. |
|
Files in the resources directory |
Each of these resource bundles contains locale-specific information that is used by the connector. Note: A resource bundle is a file containing localized versions of the text strings that are displayed on the user interface of Oracle Identity Manager. These text strings include GUI element labels and messages displayed on the Administrative and User Console. |
|
Files in the scripts directory:
|
Files that are used to perform first-time (initial) reconciliation with Oracle Identity Manager. |
|
scripts/user.txt |
Sample of the file containing user data that is used during initial reconciliation. This file is discussed in detail in "Running Initial Reconciliation". |
|
xml/oimTopSecretAdvancedConnector.xml |
This XML file contains definitions for the connector components related to reconciliation and provisioning. These components include:
|
|
xml/oimTopSecretTrustedXellerateUser.xml |
The XML file that contains component definitions for the connector for trusted source reconciliation. |
Copy the connector files to the destinations on the Oracle Identity Manager host computer as indicated in Table 2-2.
Note:
See "Files and Directories That Comprise the Connector" for more information about these files. Do not copy the files that are not listed in this table. Those files are used later in the deployment procedure.Table 2-2 Copying the Connector Files
| Files | Destination |
|---|---|
|
LDAP_INSTALL_DIR This is the directory on the Oracle Identity Manager host computer where you want to install the LDAP Gateway. See "Installing and Configuring the LDAP Gateway" for information about installing the LDAP Gateway. |
|
|
lib/topsecret-adv-agent-recon.jar lib/topsecretConnection.properties |
LDAP_INSTALL_DIR/etc |
|
Files in the scripts directory:
|
OIM_HOME/xellerate/JavaTasks/
|
OIM_HOME/xellerate/connectorResources/
|
|
|
xml/oimTopSecretAdvancedConnector.xml xml/oimTopSecretTrustedXellerateUser.xml |
OIM_HOME/xellerate/XLIntegrations/tops/xml/
|
Note:
While installing Oracle Identity Manager in a clustered environment, you copy the contents of the installation directory to each node of the cluster. Similarly, you must copy the files in the connectorResources directory and the JAR files to the corresponding directories on each node of the cluster.Configuring Oracle Identity Manager involves the following procedures:
Note:
In a clustered environment, you must perform these steps on each node of the cluster.When you perform the procedure described in "Copying the Connector Files", you copy the resource bundles for this connector into the OIM_HOME/xellerate/connectorResources directory. Whenever you add a new resource bundle in the connectorResources directory or make a change in an existing resource bundle, you must clear content related to connector resource bundles from the server cache.
To clear content related to connector resource bundles from the server cache:
In a command window, go to the OIM_HOME/xellerate/bin/ directory.
Note:
You must perform step 1 before you perform step 2. An exception is thrown if you run the command described in Step 2 as follows:OIM_HOME/xellerate/bin/BATCH_FILE _NAME
Enter one of the following commands:
On Microsoft Windows:
PurgeCache.bat ConnectorResourceBundle
On UNIX:
PurgeCache.sh ConnectorResourceBundle
Note:
You can ignore the exception that is thrown when you perform Step 2. This exception is different from the one mentioned in Step 1.In this command, ConnectorResourceBundle is one of the content categories that you can remove from the server cache. Refer to the following file for information about the other content categories:
OIM_HOME/xellerate/config/xlConfig.xml
When you enable logging, Oracle Identity Manager automatically stores in a log file information about events that occur during the course of provisioning and reconciliation operations. To specify the type of event for which you want logging to take place, you can set the log level to one of the following:
ALL
This level enables logging for all events.
DEBUG
This level enables logging of information about fine-grained events that are useful for debugging.
INFO
This level enables logging of messages that highlight the progress of the application at a coarse-grained level.
WARN
This level enables logging of information about potentially harmful situations.
ERROR
This level enables logging of information about error events that might allow the application to continue running.
FATAL
This level enables logging of information about very severe error events that could cause the application to stop functioning.
OFF
This level disables logging for all events.
The file in which you set the log level and the log file path depend on the application server that you use:
JBoss Application Server
To enable logging:
In the JBOSS_HOME/server/default/conf/log4j.xml file, add the following lines:
<category name="IdfTopsUserOperations">
<priority value="LOG_LEVEL"/>
</category>
In the second XML line, replace LOG_LEVEL with the log level that you want to set. For example:
<category name="IdfTopsUserOperations">
<priority value="INFO"/>
</category>
After you enable logging, log information is written to the following file:
JBOSS_HOME/server/default/log/server.log
IBM WebSphere Application Server:
To enable logging:
In the OIM_HOME/xellerate/config/log.properties file, add the following line:
log4j.logger.IdfTopsUserOperations=LOG_LEVEL
In this line, replace LOG_LEVEL with the log level that you want to set. For example:
log4j.logger.IdfTopsUserOperations=INFO
After you enable logging, log information is written to the following file:
WEBSPHERE_HOME/AppServer/logs/SERVER_NAME/SystemOut.log
BEA WebLogic Server
To enable logging:
In the OIM_HOME/xellerate/config/log.properties file, add the following line:
log4j.logger.IdfTopsUserOperations=LOG_LEVEL
In this line, replace LOG_LEVEL with the log level that you want to set. For example:
log4j.logger.IdfTopsUserOperations=INFO
After you enable logging, log information is displayed on the server console.
Oracle Application Server
To enable logging:
In the OIM_HOME/xellerate/config/log.properties file, add the following line:
log4j.logger.IdfTopsUserOperations=LOG_LEVEL
In this line, replace LOG_LEVEL with the log level that you want to set. For example:
log4j.logger.IdfTopsUserOperations=INFO
After you enable logging, log information is written to the following file:
OAS_HOME/opmn/logs/default_group~home~default_group~1.log
To import the connector XML file into Oracle Identity Manager:
Open the Oracle Identity Manager Administrative and User Console.
Click the Deployment Management link on the left navigation bar.
Click the Import link under Deployment Management. A dialog box for locating files is displayed.
Locate and open the oimTopSecretAdvancedConnector.xml file, which is in the OIM_HOME/xellerate/XLIntegrations/tops/xml/ directory. Details of this XML file are shown on the File Preview page.
Click Add File. The Substitutions page is displayed.
Click Next. The Confirmation page is displayed.
Click Next. The Provide IT Resource Instance Data page for the TopSecretResource IT resource is displayed.
Specify values for the parameters of the OIMTopSecretResourceObject IT resource. Table 2-3 lists the values to be specified.
Table 2-3 Defining IT Resources
| Parameter | Description |
|---|---|
|
AtMap User |
Name of the lookup definition containing attribute mappings that are used for provisioning Value: Note: You must not change the value of this parameter. |
|
idfPrincipalDn |
Administrator ID for connecting to the LDAP Gateway Sample value: |
|
idfPrincipalPwd |
Administrator password for connecting to the LDAP Gateway |
|
idfRootContext |
Root context for CA Top Secret Value: Note: You must not change the value of this parameter. |
|
idfServerHost |
Host name for connecting to the LDAP Gateway Value: Note: You must not change the value of this parameter. |
|
idfServerPort |
Port for connecting to the LDAP Gateway Sample value: |
Click Next. The Provide IT Resource Instance Data page for a new instance of the TopSecretResource IT resource type is displayed.
Click Skip to specify that you do not want to define another IT resource. The Confirmation page is displayed.
Click View Selections.
The contents of the XML file are displayed on the Import page. You may see a cross-shaped icon along with some nodes. These nodes represent Oracle Identity Manager entities that are redundant. Before you import the connector XML file, you must remove these entities by right-clicking each node and then selecting Remove.
Click Import. The connector file is imported into Oracle Identity Manager.
Adapters are used to implement provisioning functions. The following adapters are imported into Oracle Identity Manager when you import the connector XML file:
CreateTopsUser
OnBoardUser
ResetTopsPassword
ChangeTopsUserPassword
DeleteTopsUser
RevokeTopsUser
ResumeTopsUser
AddTopsUserToGroup
RemoveTopsUserFromGroup
AddTopsUserToDataset
RemoveTopsUserFromDataset
AddTopsUserToFacility
RemoveTopsUserFromFacility
ModifyTopsUser
RevokeTopsUserUntil
ResumeTopsUserUntil
You must compile these adapters before they can be used in provisioning operations. To compile adapters by using the Adapter Manager form:
Open the Adapter Manager form.
To compile all the adapters that you have imported into the current database, click Compile All.
If you have created your own adapters or if a new adapter is shipped with a patch that you installed, then you might need to compile one adapter at a time. To compile multiple (but not all) adapters, select the adapters you want to compile. Then, click Compile Selected.
Click Start. Oracle Identity Manager compiles the adapters that you specify.
If Oracle Identity Manager is installed in a clustered environment, then copy the compiled adapters from the OIM_HOME/xellerate/Adapter directory to the same directory on each of the other nodes of the cluster. If required, overwrite the adapter files on the other nodes.
To install and configure the LDAP Gateway:
Extract the contents of the ldapgateway.zip file to a directory on the computer on which Oracle Identity Manager is installed.
Note:
In this document, the location (and name) of the ldapgateway directory is referred to as LDAP_INSTALL_DIR.In a text editor, open the following scripts:
Open the run.sh or run.bat script from the LDAP_INSTALL_DIR/bin/ directory.
Open the run_initial_recon_provisioning script from the OIM_HOME/Xellerate/JavaTasks directory.
In the run script:
Set the JAVA_HOME property as follows:
JAVA_HOME=DIRECTORY_LOCATION\j2sdj1.4.2_13
Replace DIRECTORY_LOCATION with the full path of the directory.
If you plan to run multiple LDAP Gateways on a Linux or Solaris environment and there are not enough socket file descriptors to open up all the ports needed for the server, then add the following line:
-Djava.nio.channels.spi.SelectorProvider=sun.nio.ch.PollSelectorProvider
In the run and run_initial_recon_provisioning scripts, uncomment the line related to the application server directory. In addition, change the path to reflect the actual location of the application server directory.
Note:
The contents of the run and run_initial_recon_provisioning scripts are similar. You must make the same change in both the scripts.The lines starting with a number sign (#) are comments, as shown:
##### SET JBOSS HOME ################## #APPSERVER_HOME=/opt/ldapgateway/lib/jboss-4.0.2
To uncomment the line, remove the number sign. For example, to ensure that the connector works with JBoss Application Server, change the line to the following:
##### SET JBOSS HOME ################## APPSERVER_HOME=/opt/ldapgateway/lib/jboss-4.0.2
If you are using IBM WebSphere Application Server 6.1, then add the com.ibm.ws.wccm_6.1.0.jar file to the CLASSPATH variable in the run and run_initial_recon_provisioning scripts as shown in the following example:
rem
rem SET WEBSPHERE APPLICATION SERVER REQUIRED LIBRARIES
rem
set CLASSPATH=%CLASSPATH%;"%APPSERVER_HOME%"\lib\com.ibm.ws.wccm_6.1.0.jar
In a text editor, open the LDAP_INSTALL_DIR/conf/TOPS.properties file. In this file, specify information for the following properties of the message transport layer that you use:
For TCP/IP, the default values are as follows:
_type_=socket
_isencrypted_=true
_timeout_=5000
_authretries_=2
_host_=HOST_NAME_OR_IP_ADDRESS_OF_MAINFRAME
_port_=5790
_agentport_=5190
_nameFormat_=fn|sp|ln
_configSegment_=METADIR
_configAttrs_=ATTR1|ATTR2
The configurable properties are:
_type_: The transport type, which is TCP/IP (socket).
_host_: The host name or IP address of the mainframe.
Note:
If you are configuring the LDAP Gateway on the computer on which Oracle Identity Manager is installed, then specifylocalhost as the value of the _host_ property. If you are configuring the LDAP Gateway on a different computer, then specify the host name or IP address of the computer as the value of the _host_ property. However, it is recommended that you install the LDAP Gateway on the same computer on which Oracle Identity Manager is installed._port_: The port of the Pioneer Provisioning Agent.
_agentport_: The port that the Reconciliation Agent uses to send messages.
_nameFormat_: The property used to specify the format of the Full Name attribute.
_configSegment_: The property used to specify the name of the segment. A segment indicates how profile information is segregated in CA Top Secret. METADIR is an example of a segment. Examples of default segments are PASSWORD and CICS.
_configAttrs_: For reconciliation, you add the custom fields to the _configAttrs_ property in the TOPS.properties file that match the name of the CA Top Secret field.
In the TOPS.properties file, use the following property to specify whether you want to revoke access rights or delete users during Disable User provisioning operations:
# DEFAULT ACTION WHEN DELETE FUNCTION USED
_defaultDelete_=delete
Set revoke as the value of this property if you want the user to be disabled on the target system as the outcome of a Delete User provisioning operation.
Set delete as the value of this property if you want the user to be deleted from the target system as the outcome of a Delete User provisioning operation.
In the TOPS.properties file, use the _nameFormat_ property to specify the format of the Full Name attribute.
You can use the following as the components of the format that you specify:
Use fn to represent the first name.
Use sp to represent the space character.
Use ln to represent the last name.
Use a comma (,) to represent the comma.
Use a period (.) to represent the period.
Use the vertical bar (|) as the separator for the other components.
The following line shows a sample value for the _nameFormat_ property:
_nameFormat_=fn|sp|ln
Open the LDAP_INSTALL_DIR/etc/topsecretConnection.properties file and edit the following property:
Note:
You must also make this change in the initialTopSecretAdv.properties file, which is in the OIM_HOME/xellerate/JavaTasks directory._itResource_=NAME_OF_THE_NEW_IT_RESOURCE
Replace NAME_OF_THE_NEW_IT_RESOURCE with the name of the IT resource that you create by performing Step 8 of the procedure described in "Importing the Connector XML File".
From the LDAP_INSTALL_DIR/dist/idfserver.jar file, extract the beans.xml file, open it in an editor, and set values for the following:
Target system administrator credentials
You must change the administrator credentials stored in the following lines of the beans.xml file:
Note:
In these lines, the values that you can change are highlighted in bold font. The values that you enter in the beans.xml file must be the same as the values that you specify for the IT resource parameters and the properties in the topsecretConnection.properties and initialTopSecretAdv.properties files.See "Encrypting Passwords Used in the beans.xml File" for information about encrypting the password before you enter it in the beans.xml file.
<property name="adminUserDN" value="cn=oimTOPSAdmin,dc=TOPS,dc=com"/> <property name="adminUserPassword" value="password"/>
Port used for communication between the LDAP Gateway and the mainframe logical partition (LPAR) that you use for the connector installation
The default value of the port property is 5389. If you want to change this value, then edit the value of the port property defined in the beans.xml file:
<property name="port" value="5389"/>
To enable logging on the LDAP Gateway server:
Extract the log4j.properties file from the LDAP_INSTALL_DIR/dist/idfserver.jar file.
Ensure that the log4j.rootLogger variable is set to the following:
log4j.rootLogger=DEBUG, A1
Save and close the file.
When you use the connector, the following LDAP Gateway log files are generated in the LDAP_INSTALL_DIR/logs directory:
idfserver.log.0: This is the main log file.
topsecret-agent-recon.log: This is ongoing reconciliation log file that stores Oracle Identity Manager reconciliation messages.
topsagent.log.0: This file is currently redundant, and it will be removed in a later release.
Save the changes made to the beans.xml file, and then re-create the idfserver.jar file.
Note:
When you start using the connector, the logs for the LDAP Gateway are created in the LDAP_INSTALL_DIR/logs directory.
After editing the run.bat or run.sh file, you can start and stop the LDAP Gateway by running the following commands:
To start LDAP Gateway on UNIX, run:
bin> ./run.sh
To stop LDAP Gateway on UNIX, run:
bin> ./stop.sh
To start LDAP Gateway on Microsoft Windows, run:
bin>run.bat
To stop LDAP Gateway on Microsoft Windows, enter Ctrl + C in the command window.
Encrypting Passwords Used in the beans.xml File
To encrypt passwords that you want to enter in the beans.xml file:
In a text editor, copy one of the following script files from the installation media into a temporary directory and then open the script file in a text editor:
For Microsoft Windows:
/scripts/propertyEncrypt.bat
For UNIX:
/scripts/propertyEncrypt.sh
Specify values for the following properties in the file:
SET CLASSPATH=DIRECTORY_LOCATION\idfserver.jar
Replace DIRECTORY_LOCATION with the full path of the directory into which you copied the idfserver.jar file while deploying the connector.
For example:
SET CLASSPATH=C:\software\identityforge\ldapgateway\dist\idfserver.jar
%JAVACMD% %JVM_OPTS% -cp %CLASSPATH% com.identityforge.idfserver.util.AESCipherUtil PLAINTEXT_PASSWORD
Replace PLAINTEXT_PASSWORD with the password that you want to encrypt.
For example:
%JAVACMD% %JVM_OPTS% -cp %CLASSPATH% com.identityforge.idfserver.util.AESCipherUtil idfTopsPwd
Save the changes made to the propertyEncrypt.bat or propertyEncrypt.sh script file.
Run the script.
The script encrypts the password that you provide and displays it in the command window.
Copy the encrypted password into the beans.xml file as follows:
Extract the beans.xml file from the LDAP_INSTALL_DIR/dist/idfserver.jar file.
In this file, search for the following string:
<property name="adminUserPassword"
Replace the value of this property with the encrypted password.
For example:
<property name="adminUserPassword" value="468018DD1CDBE82E515EBF78A41C428E"/>
You can configure the connector for multiple installations of the target system. You can also configure the connector for a scenario in which multiple logical partitions (LPARs), which are not associated with the first LPAR, are configured in the target system.
For each installation of the target system, you create an IT resource and configure an additional instance of the LDAP Gateway.
To configure the connector for the second installation of the target system:
Note:
Perform the same procedure for each installation of the target system.Create an IT resource based on the OIMLDAPGatewayResourceType IT resource type.
See Also:
Oracle Identity Manager Design Console Guide for information about creating IT resources
Step 8 of "Importing the Connector XML File" for information about the parameters of the IT resource
Copy the current LDAP_INSTALL_DIR directory, including all the subdirectories, to a new location.
Note:
In the remaining steps of this procedure, LDAP_INSTALL_DIR refers to the newly copied directory.Extract the contents of the LDAP_INSTALL_DIR/dist/idfserver.jar file.
In the beans.xml file, change the value of the port in the <property name="port" value="xxxx"/> line to specify a port that is different from the port used for the first instance of the LDAP Gateway. The default port number is shown in the following example:
<bean id="listener" class="com.identityforge.idfserver.nio.Listener">
<constructor-arg><ref bean="bus"/></constructor-arg>
<property name="admin"><value>false</value></property>
<property name="config"><value>../conf/listener.xml</value></property>
<property name="port" value="5389"/>
</bean>
If you change the port number, then you must make the same change in the value of the idfServerPort parameter of the IT resource that you create.
Save and close the beans.xml file.
Open the LDAP_INSTALL_DIR/conf/TOPS.properties file and edit the following parameters:
_host_=IP_ADDRESS_OR_HOST_NAME_OF_THE_MAINFRAME
_port_=PORT_OF_THE_SECOND_INSTANCE_OF_THE_PROVISIONING_AGENT
_agentPort_=PORT_OF_THE_SECOND_INSTANCE_OF_THE_RECONCILIATION_AGENT
Note:
The value of the _agentPort_ parameter must not be the same as that of the first instance if a second LPAR, which is not associated with the first LPAR, is configured in the target system. This value can be the same as the value of the idfServerPort parameter if you have two mainframe servers with CA Top Secret running on each server.Open the LDAP_INSTALL_DIR/etc/TopSecretConnection.properties file and edit the following property:
_itResource_=NAME_OF_THE_NEW_IT_RESOURCE
|
 Copyright © 2009, Oracle and/or its affiliates. All rights reserved. Legal Notices |
|