test

Sun Java System Delegated Administrator 6.4 Administration Guide

Creating a Provider Organization and Service Provider Administrator

In this release of Delegated Administrator, you must use the custom service-provider template (da.provider.skeleton.ldif) provided by Delegated Administrator to create your own provider organizations and SPAs.

Note –

You also can install a sample provider organization (with subordinate organizations) and a sample SPA in your directory when you run the Delegated Administrator configuration program. You do this by choosing to Load Sample Organizations in the configuration program.

However, the sample organization template (da.sample.data.ldif) is meant to be used as an example, not as a template for creating your own provider organizations. For details about this example, see Sample Service-Provider Organization Data, later in this appendix.

Once you have created a provider organization and an SPA, the SPA can log into the Delegated Administrator console, create and manage subordinate organizations, and assign the SPA role to other users in the SPA’s organization. However, these SPAs can only manage the same provider organization.

To create another provider organization and an SPA to manage it, you should use the custom service-provider template again.

This section contains the following topics:

Entries Created by the Template

When you install your edited copy of the custom service-provider template in the directory, the following entries are created:

Figure A–2 shows an example of the entries created by installing the template. It is a Directory Information Tree (DIT) view of the organizations.

Figure A–2 is only an example. Your organization names, SPA user name, and DIT structure should be specific to your own installation.

Figure A–2 Custom Service-Provider Template: Directory Information Tree View

Custom service-provider template: Directory Information Tree view.

Nodes in the Sample Installed Custom Service-Provider Template

The nodes in the example shown in Figure A–2 are as follows:

Information Needed to Create a Provider Organization, Subordinate Organization, and SPA

To create a provider organization, one subordinate organization, and an SPA, you need to replace parameters in the custom service-provider template with information specific to your installation.

As you read about these parameters, you can look at a listing of the da.provider.skeleton.ldif shown in Custom Service-Provider Template. Or open the actual ldif file, located in the following directory:

da-base/lib/config-templates

For definitions of the attributes associated with these parameters, see “Chapter 5: Communications Suite Delegated Administrator Classes and Attributes (Schema 2)” and “Chapter 3: Messaging Server and Calendar Server Attributes” in the Sun Java Communications Suite Schema Reference.

Parameters Defining the Provider and Subordinate Organization

To create a provider organization and subordinate organization, edit the following parameters:

Parameters Defining the SPA

To create an SPA, edit the following parameters:

For instructions in how to edit the custom service-provider template and install the information in your directory, see Steps for Creating a Provider Organization and Service Provider Administrator.

Steps for Creating a Provider Organization and Service Provider Administrator

You use an ldif file, da.provider.skeleton.ldif, to perform the following procedure.

ProcedureTo create a provider organization and Service Provider Administrator

This procedure assumes that you have already installed a root suffix and a default mail domain in the directory, as shown in the following example:


o=usergroup
   o=varrius.com

  1. Create a mail domain in the directory.

    If you have not already done so, create a mail domain in your directory. The provider organization and its subordinate shared organizations will use this mail domain.

    Example:

    In the following example, siroe.com is a new mail domain under which the da.provider.skeleton.ldif file will install the provider organization and Service Provider Administrator.


    o=usergroup
   o=varrius.com
   o=siroe.com

  2. Copy and rename the da.provider.skeleton.ldif file.

    When you install Delegated Administrator, the da.provider.skeleton.ldif file is installed in the following directory:

    da-base/lib/config-templates

  3. Edit the following parameters in your copy of the da.provider.skeleton.ldif file. Replace the parameters with the correct values for your installation.

    For definitions of the parameters, see Information Needed to Create a Provider Organization, Subordinate Organization, and SPA.

    Some parameters are used more than once in the ldif file. You must search for and replace all instances of each parameter.

    A few parameters represent values for multivalued attributes. You can copy and edit these parameters, together with their associated attribute names, to allow multiple instances of these attributes in your ldif file. Multivalued parameters are noted below.

    • <ugldapbasedn>

    • <maildomain_dn>

    • <maildomain_dn_str>

    • <providerorg>

    • <servicepackage> (multivalued)

    • <domain_name> (multivalued)

    • <provider_sub_org>

    • <preferredmailhost>

    • <available_domain_name> (multivalued)

    • <available_services> (multivalued)

    • <spa_uid>

    • <spa_password>

    • <spa_firstname>

    • <spa_lastname>

    • <spa_servicepackage>

    • <spa_mailaddress>

      For definitions of the attributes associated with these parameters, see “Chapter 5: Communications Suite Delegated Administrator Classes and Attributes (Schema 2)” and “Chapter 3: Messaging Server and Calendar Server Attributes” in the Sun Java Communications Suite Schema Reference.

  4. Use the LDAP directory tool ldapmodify to install the provider organization and SPA in the directory.

    For example, you could run the following command:


    ldapmodify -D <directory manager> -w <password> \
-f <da.provider.finished.ldif>

    where

    <directory manager> is the name of the Directory Server administrator.

    <password> is the password of the Directory Service administrator.

    <da.provider.finished.ldif> is the name of the edited ldif file to be installed as a new provider organization and SPA in the directory.

    Example:

    The following example shows organization nodes and a Service Provider Administrator user installed under the siroe.com mail domain:


    o=usergroup
   o=varrius.com
   o=siroe.com
     o=MyProviderOrg
       o=MySPAUserOrg
         ou=People
            uid=user1
   o=MyProviderOrgDomainsRoot

    Note that the MyProviderOrgDomainsRoot organization is located under the root suffix, usergroup. MyProviderOrgDomainsRoot is the placeholder node created by the ldif; it holds full organizations subordinate to the MyProviderOrgorganization.

Custom Service-Provider Template

The template (da.provider.skeleton.ldif) contains parameters that you must modify to create a new provider organization and SPA.

The listing below shows the sections of the ldif file that have parameters. The listing does not include the entire file. Entries and ACIs required to support Access Manager are not included here.

You should only modify the parameters in the ldif file. Do not modify the sections of the file related to Access Manager.

da.provider.skeleton.ldif File (Relevant Sections)

#
# The following parameterized values must be replaced.
#
# <ugldapbasedn>          :: Root suffix for user/group data
# <maildomain_dn>         :: Complete dn of the mail domain underneath
#                            which the provider organization will be
#                            created.
# <maildomain_dn_str>     :: The maildomain dn with all ',' replaced
#									  by '_'. E.g.
#                            dn --\> o=siroe.com,o=SharedDomainsRoot,
#                            o=Business,dc=red,dc=iplanet,dc=com
#                            dn_str --> o=siroe.com_o=SharedDomainsRoot_
#                            o=Business_dc=red_dc=iplanet_dc=com
# <providerorg>            : Organization value for provider node.
# <servicepackage>        :: One for each service package to include.
#                            All service packages in the system 
#                            may be assigned by leaving this value empty.
# <domain_name>           :: One for each DNS name which may be assigned
#                            to a subordinate organization.
#                            These names form a proper subset (some or
#                            all) of the names listed in the <maildomain>
#                            organization's sunpreferreddomain
#                            and associateddomain attributes. 
# <provider_sub_org>      :: Organization value for the shared subordinate
#                            organization in which the Provider
#                            Administrator resides. 
# <preferredmailhost>     :: Name of the preferred mail host for the
#                            provider's subordinate organization.
# <available_domain_name> :: one for each DNS name that an organization
#                            allows an organization admin to use when
#                            creating a user's mail address.  This is
#                            a proper subset of the values given for
#                            <domain_name> (sunAssignableDomains attribute).
# <available_services>    :: One for each service packags available to an
#                            organization (sunAvailableServices attribute).
#                            These service packages form a proper subset
#                            of the ones assigned to a provider organization
#                            - <servicepackage> (sunIncludeServices 
#                            attribute).  Form is
#                            <service package name>:<count>  
#                            where count is an integer.  If count is absent
#                            then default is unlimited.
# <spa_uid>               :: The uid for the service provider administrator.
# <spa_password>          :: The password for the service provider 
#                            administrator. 
# <spa_firstname>         :: First name of the service provider 
#                            administrator.
# <spa_lastname>          :: Last name of the service provider 
#                            administrator.
# <spa_servicepackage>    :: Service package assigned to the service
#                            provider administrator.
# <spa_mailaddress>       :: The spa's mail address. The domain part of the
#                            mail address must be one of the values used for
#                            <available_domain_name>.
#


#
# Provider Organization
#
dn: o=<providerorg>,<maildomain_dn>
changetype: add
o: <providerorg>
objectClass: top
objectClass: sunismanagedorganization
objectClass: sunmanagedorganization
objectClass: organization
objectClass: sunManagedProvider
sunAllowBusinessOrgType: full
sunAllowBusinessOrgType: shared
sunBusinessOrgBase: o=<providerorg>domainsroot,<ugldapbasedn>
sunIncludeServices: <servicepackage>
sunAssignableDomains: <domain_name>
sunAllowMultipleDomains: true
sunAllowOutsideAdmins: false
sunProviderOrgDN: o=<provider_sub_org>,o=<providerorg>,<maildomain_dn>
# .
# .
# [Entries and ACIs required by Access Manager]
# .
# .

#
# Full Organizations node
#
dn: o=<providerorg>DomainsRoot,<ugldapbasedn>
changetype: add
o: <providerorg>DomainsRoot
objectClass: top
objectClass: organization
objectClass: sunmanagedorganization
# .
# .
# [Entries and ACIs required by Access Manager]
# .
# .

#
# Provider Admin Role shared organizations
#
dn: cn=Provider Admin Role,o=<providerorg>,<maildomain_dn>
changetype: add
cn: Provider Admin Role
objectClass: ldapsubentry
objectClass: nssimpleroledefinition
objectClass: nsroledefinition
objectClass: nsmanagedroledefinition
objectClass: iplanet-am-managed-role
objectClass: top
iplanet-am-role-description: Provider Admin

#
# Provider Admin Role full organizations
#
dn: cn=Provider Admin Role,o=<providerorg>DomainsRoot,<ugldapbasedn>
changetype: add
cn: Provider Admin Role
objectClass: ldapsubentry
objectClass: nssimpleroledefinition
objectClass: nsroledefinition
objectClass: nsmanagedroledefinition
objectClass: iplanet-am-managed-role
objectClass: top
iplanet-am-role-description: Provider Admin

#
# Shared Subordinate Organization. Includes 1 user who is 
# the Provider Administrator.
#
dn: o=<provider_sub_org>,=<providerorg>,<maildomain_dn>
changetype: add
preferredMailHost: <preferredmailhost>
sunNameSpaceUniqueAttrs: uid
o: <provider_sub_org>
objectClass: inetdomainauthinfo
objectClass: top
objectClass: sunismanagedorganization
objectClass: sunnamespace
objectClass: sunmanagedorganization
objectClass: organization
objectClass: sunDelegatedOrganization
objectClass: sunMailOrganization
sunAvailableDomainNames: <available_domain_name>
sunAvailableServices: <available_services>
sunOrgType: shared
sunMaxUsers: -1
sunNumUsers: 1
sunMaxGroups: -1
sunNumGroups: 0
sunEnableGAB: true
sunAllowMultipleServices: true
inetDomainStatus: active
sunRegisteredServiceName: GroupMailService
sunRegisteredServiceName: DomainMailService
sunRegisteredServiceName: UserMailService
sunRegisteredServiceName: iPlanetAMAuthService
sunRegisteredServiceName: UserCalendarService
sunRegisteredServiceName: iPlanetAMAuthLDAPService
sunRegisteredServiceName: DomainCalendarService
# .
# .
# [Entries and ACIs required by Access Manager]
# .
# .

dn: ou=People,o=<provider_sub_org>,o=<providerorg>,<maildomain_dn>
changetype: add
ou: People
objectClass: iplanet-am-managed-people-container
objectClass: organizationalUnit
objectClass: top

dn: ou=Groups,o=<provider_sub_org>,o=<providerorg>,<maildomain_dn>
changetype: add
ou: Groups
objectClass: iplanet-am-managed-group-container
objectClass: organizationalUnit
objectClass: top
# .
# .
# [Entries and ACIs required by Access Manager]
# .
# .

#
# User - provider administrator
#
dn: uid=<spa_uid>,ou=People,o=<provider_sub_org>,o=<providerorg>, \
        <maildomain_dn> 
changetype: add
sn: <spa_lastname>
givenname: <spa_firstname>
cn:  <spa_firstname> <spa_lastname>
uid: <spa_uid>
iplanet-am-modifiable-by: cn=Top-level Admin Role,<ugldapbasedn>
objectClass: inetAdmin
objectClass: top
objectClass: iplanet-am-managed-person
objectClass: iplanet-am-user-service
objectClass: iPlanetPreferences
objectClass: person
objectClass: organizationalPerson
objectClass: inetuser
objectClass: inetOrgPerson
objectClass: ipUser
objectClass: inetMailUser
objectClass: inetLocalMailRecipient
objectClass: inetSubscriber
objectClass: userPresenceProfile
objectClass: icsCalendarUser
mailhost: <preferredmailhost>
mail: <spa_mailaddress>
maildeliveryoption: mailbox
mailuserstatus: active
inetCos: <spa_servicepackage>
inetUserStatus: Active
nsroledn: cn=Provider Admin Role,o=<providerorg>,<maildomain_dn>
userPassword: <spa_password>