Oracle Fusion Middleware Release Notes for Identity Synchronization for Windows 6.0 Service Pack 1, 11g Release 1 (11.1.1.7.0)

11g Release 1 (11.1.1.7.0)

E28964-01

Contents

List of Tables

Title and Copyright Information

Preface

- Audience

- Conventions Used in Guide

- Oracle Directory Server Enterprise Edition Documentation Set

- Related Reading

- Redistributable Files

- Documentation, Support, and Training

- Oracle Software Resources

- Documentation Accessibility

Part I Information for All Platforms

1 Before You Begin Installation

- 1.1 What's New in This Release

- 1.2 Hardware Requirements

- 1.3 Software Requirements

- 1.3.1 Supported Platforms and Additional Required Software

- 1.3.2 Required Installation Privileges and Credentials

- 1.3.3 Requirements in a Firewall Environment

- 1.3.3.1 Message Queue Requirements

- 1.3.3.2 Installer Requirements

- 1.3.3.3 Core Component Requirements

- 1.3.3.4 Console Requirements

- 1.3.3.5 Connector Requirements

- 1.4 Obtaining the Software as Part of Directory Server Enterprise Edition

- 1.4.1 To Download Oracle Directory Server Enterprise Edition 11g R1 (11.1.1.7.0)

- 1.4.2 Minimum Patch Level Requirements

- 1.4.3 Contents of the Zip Distribution File

- 1.5 Completing Pre-Installation Tasks

- 1.5.1 Add Missing LICENSE.txt file on Windows

- 1.5.2 Create a Configuration Suffix for Identity Synchronization for Windows

- 1.5.3 Gather Information Required by the Installer

- 1.5.4 (Linux Only) Verify Environment Settings

- 1.5.5 Verify JDK Compatibility

- 1.5.6 Resolve DNS Dependencies

- 1.5.7 Resolve Linux Dependencies

- 1.6 Basic Identity Synchronization for Windows Operations

- 1.6.1 Opening the Administration Console

- 1.6.2 Starting and Stopping Synchronization

- 1.6.2.1 To Start or Stop Synchronization Using the Console

- 1.6.2.2 To Start or Stop Synchronization at the Command Line

- 1.6.3 Starting and Stopping Services

- 1.6.3.1 To Start Services

- 1.6.3.2 To Stop Services

2 Understanding Deployment Issues

- 2.1 Installing the Critical ISW Patch Set

- 2.2 Installing or Upgrading Sun Java System Message Queue

- 2.2.1 To Install Message Queue 4.3

- 2.2.2 To Upgrade Pre-3.6 Versions of Message Queue

- 2.3 Configuring Group Synchronization

- 2.4 Synchronization With Active Directory 2008

- 2.5 Using SUL Filters

- 2.6 Tuning the Client Timeout Setting

- 2.7 Verifying that Uninstallation is Complete

3 Known Bugs and Limitations

- 3.1 Identity Synchronization for Windows Limitations

- 3.2 Performing Data Recovery When System or Application Fails

- 3.2.1 Bidirectional Synchronization

- 3.2.2 Unidirectional Synchronization

- 3.2.2.1 To Perform Unidirectional Synchronization

- 3.2.3 Directory Source Specific Recovery Procedures

- 3.2.3.1 Microsoft Active Directory

- 3.2.3.2 To Change the Domain Controller

- 3.2.3.3 Failover and Directory Server

- 3.2.3.4 To Manage Identity Synchronization for Windows 6.0 Service Pack 1 Fail Over

- 3.3 Known Issues in Identity Synchronization for Windows 6.0 Service Pack 1

Part II Windows Upgrade & Migration, and New Installation

4 Migrating from Identity Synchronization for Windows 6.0 on Windows

- 4.1 Obtaining the Latest Identity Synchronization for Windows Release

- 4.2 Preparing for Migration

- 4.2.1 Schedule an appropriate time for migration

- 4.2.2 Disable the group synchronization and account lockout

- 4.2.2.1 Using the Administration Console

- 4.2.2.2 Using the Command-Line Interface

- 4.2.3 Unpack the Identity Synchronization for Windows 6.0 Service Pack 1 patch content

- 4.2.4 Export the current Identity Synchronization for Windows 6.0 Service Pack 1 configuration setting to an XML file

- 4.2.5 Add a clear text password to the exported configuration file

- 4.2.6 Stop synchronization

- 4.2.7 Verify that your system is in a quiescent state

- 4.2.8 Stop the Identity Synchronization for Windows 6.0 Service Pack 1 services

- 4.2.9 Save the connector states

- 4.3 Uninstalling Identity Synchronization for Windows 6.0 Components

- 4.4 Installing Identity Synchronization for Windows 6.0 Service Pack 1

- 4.5 Confirming the Installation

5 Installing From Scratch on Windows

- 5.1 Creating Required Data Stores in Directory Server

- 5.2 Obtaining the Identity Synchronization for Windows Software

- 5.3 Preparing for Identity Synchronization for Windows Installation

- 5.4 Installing the Software

- 5.5 Checking the Software Version

Part III Solaris Upgrade & Migration, and New Installation

6 Migrating from Identity Synchronization for Windows 6.0 on Solaris

- 6.1 Obtaining the Latest Identity Synchronization for Windows Release

- 6.2 Preparing for Migration

- 6.2.1 Schedule an appropriate time for migration

- 6.2.2 Disable the group synchronization and account lockout

- 6.2.2.1 Using the Administration Console

- 6.2.2.2 Using the Command-Line Interface

- 6.2.3 Unpack the Identity Synchronization for Windows 6.0 Service Pack 1 patch content

- 6.2.4 Export the current Identity Synchronization for Windows 6.0 Service Pack 1 configuration setting to an XML file

- 6.2.5 Add a clear text password to the exported configuration file

- 6.2.6 Stop synchronization

- 6.2.7 Verify that your system is in a quiescent state

- 6.2.8 Stop the Identity Synchronization for Windows 6.0 Service Pack 1 services

- 6.2.9 Save the connector states

- 6.2.10 Start the Identity Synchronization for Windows 6.0 Service Pack 1 services

- 6.3 Uninstalling Identity Synchronization for Windows 6.0 Components

- 6.4 Installing Identity Synchronization for Windows 6.0 Service Pack 1

- 6.5 Confirming the Installation

7 Installing From Scratch on Solaris

- 7.1 Creating Required Data Stores in Directory Server

- 7.2 Obtaining the Identity Synchronization for Windows Software

- 7.3 Preparing for Identity Synchronization for Windows Installation

- 7.4 Installing the Software

- 7.5 Checking the Software Version

Part IV Linux Upgrade & Migration, and New Installation

8 Migrating from Identity Synchronization for Windows 6.0 on Linux

- 8.1 Obtaining the Latest Identity Synchronization for Windows Release

- 8.2 Preparing for Migration

- 8.2.1 Schedule an appropriate time for migration

- 8.2.2 Disable the group synchronization and account lockout

- 8.2.2.1 Using the Administration Console

- 8.2.2.2 Using the Command-Line Interface

- 8.2.3 Unpack the Identity Synchronization for Windows 6.0 Service Pack 1 patch content

- 8.2.4 Export the current Identity Synchronization for Windows 6.0 Service Pack 1 configuration setting to an XML file

- 8.2.5 Add a clear text password to the exported configuration file

- 8.2.6 Stop synchronization

- 8.2.7 Verify that your system is in a quiescent state

- 8.2.8 Exit the Console

- 8.2.9 Stop the Identity Synchronization for Windows Daemons

- 8.2.10 Save the connector states

- 8.3 Uninstalling Identity Synchronization for Windows 6.0 Components

- 8.3.1 Uninstall Identity Synchronization for Windows and Connectors

- 8.3.2 Unconfigure the Administration Server

- 8.3.3 Remove the Administration Server

- 8.3.4 Remove Message Queue

- 8.3.5 Edit the productregistry File

- 8.3.6 Delete the Identity Synchronization for Windows Data from the Configuration Server

- 8.4 Installing Identity Synchronization for Windows 6.0 Service Pack 1

- 8.5 Confirming the Installation

9 Installing From Scratch on Linux

- 9.1 Creating Required Data Stores in Directory Server

- 9.2 Obtaining the Identity Synchronization for Windows Software

- 9.3 Preparing for Identity Synchronization for Windows Installation

- 9.4 Installing the Software

- 9.5 Checking the Software Version

Index

List of Tables

- 1-1 Identity Synchronization for Windows Hardware Requirements

- 1-2 Supported Platforms and Additional Required Software

- 1-3 Minimum Patch Level Requirements

- 1-4 Contents of ODSEE_Identity_Synchronization_for_Windows Directory

- 1-5 Property Values Required by Identity Synchronization for Windows Core Installation

- 1-6 idsync startsync Arguments

Oracle® Fusion Middleware

Release Notes for Identity Synchronization for Windows 6.0 Service Pack 1

11g Release 1 (11.1.1.7.0)

E28964-01

January 2013

Provides the latest installation instructions that will assist you in a smooth installation of Oracle Identity Synchronization for Windows 6.0 Service Pack 1.

Oracle Fusion Middleware Release Notes for Identity Synchronization for Windows 6.0 Service Pack 1, 11g Release 1 (11.1.1.7.0)

E28964-01

Copyright © 2001, 2013, Oracle and/or its affiliates. All rights reserved.

Primary Author:  Gina Cariaga

This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.

The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.

If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable:

U.S. GOVERNMENT END USERS: Oracle programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, delivered to U.S. Government end users are "commercial computer software" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to the programs. No other rights are granted to the U.S. Government.

This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications that may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications.

Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.

Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group.

This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services.

Preface

Identity Synchronization for Windows is a component of Oracle Directory Server Enterprise Edition.

Identity Sychronization for Windows synchronizes user account information, including passwords, between Oracle Directory Server Enterprise Edition and Windows (both Active Directory and Windows NT). Identity Synchronization for Windows helps build a scalable and security enriched password synchronization solution for small, medium, and large enterprises.

These Release Notes for Identity Synchronization for Windows 6.0 Service Pack 1 provide instructions for migrating previous versions of Identity Synchronization for Windows, and for installing a new instance of Identity Synchronization for Windows where no instance already exists.

Audience

This guide is intended for administrators of Oracle Directory Server Enterprise Edition, and Identity Synchronization for Windows software.

Conventions Used in Guide

- Examples Used in This Guide

- Section *, "Default Paths"

- Section *, "Log Locations"

- Typographic Conventions

- Shell Prompts in Command Examples

- Symbol Conventions

Examples Used in This Guide

For consistency reasons, the same example data is used throughout this guide. Replace these values with the appropriate values for your system.

Variable

Values used in examples

Suffix (SUFFIX_DN)

dc=example,dc=com

Instance path (INSTANCE_PATH)

For Directory Server: /local/dsInst/

For Directory Proxy Server: /local/dps/

Hostnames (HOST)

host1, host2, host3

Port (PORT)

LDAP: Default for root: 389. Default for non-root: 1389

SSL default: Default for root: 636. Default for non-root: 1636

Default Paths

The table in this section describes the default paths that are used in this document. For complete descriptions of the files installed, see Chapter 1, Directory Server Enterprise Edition File Reference, in Oracle Directory Server Enterprise Edition Reference.

Placeholder

Description

Default Value

install-path

Represents the base installation directory for Directory Server Enterprise Edition software.

When you install from a zip distribution using unzip, the install-path is the current-directory/dsee7.

When you install from a native package distribution, the default install-path is /opt/SUNWdsee7.

instance-path

Represents the full path to an instance of Directory Server or Directory Proxy Server.

Documentation uses /local/dsInst/ for Directory Server and /local/dps/ for Directory Proxy Server.

No default path exists. Instance paths must nevertheless always be found on a local file system.

On Solaris systems, the /var directory is recommended:

serverroot

Represents the parent directory of the Identity Synchronization for Windows installation location

Depends on your installation. Note that the concept of a serverroot no longer exists for Directory Server and Directory Proxy Server.

isw-hostname

Represents the Identity Synchronization for Windows instance directory

Depends on your installation

/path/to/cert8.db

Represents the default path and file name of the client's certificate database for Identity Synchronization for Windows

current-working-dir/cert8.db

serverroot/isw-hostname/logs/

Represents the default path on Windows to the Identity Synchronization for Windows local log files for the System Manager, each connector, and the Central Logger

Depends on your installation

serverroot/isw-hostname/logs/central/

Represents the default path to the Identity Synchronization for Windows central log files

Depends on your installation

Log Locations

The following are log locations for supported platforms.

Linux Log Locations

Identity Synchronization for Windows Installation Logs

/var/sadm/install/logs

Identity Synchronization for Windows Instance Logs

/var/opt/sun/isw/logs

Message Queue Installation Logs

/var/install/logs/mq

Message Queue Instance Logs

/var/opt/sun/mq/instances/isw-broker/log

Solaris Log Locations

Identity Synchronization for Windows Installation Logs

/var/sadm/install/logs/

Identity Synchronization for Windows Logs

/var/opt/SUNWisw/logs

Message Queue Installation Logs

/var/install/logs/mq

Message Queue Instance Logs

/var/imq/instances/isw-broker/log

Windows Log Locations

Identity Synchronization for Windows Instance Logs

C:\Program Files\Sun\MPS\isw-hostname\logs

Message Queue Installation Logs

C:\Program Files\Sun\MessageQueue\var\install\logs\mq

Message Queue Instance Logs

C:\Program Files\Sun\MessageQueue\var\mq\instances\isw-broker\log

Typographic Conventions

The following table describes the typographic conventions that are used in this book.

Typeface

Meaning

Example

AaBbCc123

The names of commands, files, and directories, and onscreen computer output

Edit your.login file.

Use ls a to list all files.

machine_name% you have mail.

AaBbCc123

What you type, contrasted with onscreen computer output

machine_name% su

Password:

aabbcc123

Placeholder: replace with a real name or value

The command to remove a file is rm filename.

AaBbCc123

Book titles, new terms, and terms to be emphasized

Read Chapter 6 in the User's Guide.

A cache is a copy that is stored locally.

Do not save the file.

Note: Some emphasized items appear bold online.

Shell Prompts in Command Examples

The following table shows the default UNIX system prompt and superuser prompt for shells that are included in the Oracle Solaris OS. Note that the default system prompt that is displayed in command examples varies, depending on the Oracle Solaris release.

Shell

Prompt

Bash shell, Korn shell, and Bourne shell

$

Bash shell, Korn shell, and Bourne shell for superuser

#

C shell

machine_name%

C shell for superuser

machine_name#

Symbol Conventions

The following table explains symbols that might be used in this book.

Symbol

Description

Example

Meaning

[ ]

Contains optional arguments and command options.

ls [-l]

The -l option is not required.

{ | }

Contains a set of choices for a required command option.

-d {y|n}

The -d option requires that you use either the y argument or the n argument.

${ }

Indicates a variable reference.

${com.sun.javaRoot}

References the value of the com.sun.javaRoot variable.

-

Joins simultaneous multiple keystrokes.

Control-A

Press the Control key while you press the A key.

+

Joins consecutive multiple keystrokes.

Ctrl+A+N

Press the Control key, release it, and then press the subsequent keys.

>

Indicates menu item selection in a graphical user interface.

File > New > Templates

From the File menu, choose New. From the New submenu, choose Templates.

Oracle Directory Server Enterprise Edition Documentation Set

The Oracle Directory Server Enterprise Edition documentation set is an updated set of guides previously released under the names Sun Java Enterprise System Enterprise Directory Server 6.x and Sun Directory Server Enterprise Edition 7.0.

This documentation set explains how to use Oracle Directory Server Enterprise Edition to evaluate, design, deploy, and administer directory services. In addition, it shows how to develop client applications for Directory Server Enterprise Edition. The Oracle Fusion Middleware Directory Server Enterprise Edition Documentation Library is available at http://docs.oracle.com/cd/E29127_01/index.htm.

The following table lists the documents that make up the Directory Server Enterprise Edition documentation set.

Document Title

Contents

Release Notes for Oracle Directory Server Enterprise Edition

Contains the latest information about Directory Server Enterprise Edition, including known problems.

Evaluation Guide for Oracle Directory Server Enterprise Edition

Introduces the key features of this release. Demonstrates how these features work and what they offer in the context of a deployment that you can implement on a single system.

Deployment Planning Guide for Oracle Directory Server Enterprise Edition

Explains how to plan and design highly available, highly scalable directory services based on Directory Server Enterprise Edition. Presents the basic concepts and principles of deployment planning and design. Discusses the solution life cycle, and provides high-level examples and strategies to use when planning solutions based on Directory Server Enterprise Edition.

Installation Guide for Oracle Directory Server Enterprise Edition

Explains how to install the Directory Server Enterprise Edition software. Shows how to configure the installed software and verify the configured software.

Upgrade and Migration Guide for Oracle Directory Server Enterprise Edition

Provides instructions for upgrading from versions 7.0, and 6.x installations, and instructions for migrating version 5.2 installations.

Oracle Directory Server Enterprise Edition Administrator's Guide

Provides command-line instructions for administering Directory Server Enterprise Edition.

For hints and instructions about using the Directory Service Control Center, DSCC, to administer Directory Server Enterprise Edition, see the online help provided in DSCC.

Reference for Oracle Directory Server Enterprise Edition

Introduces technical and conceptual foundations of Directory Server Enterprise Edition. Describes its components, architecture, processes, and features.

Man Page Reference for Oracle Directory Server Enterprise Edition

Describes the command-line tools, schema objects, and other public interfaces that are available through Directory Server Enterprise Edition. Individual sections of this document can be installed as online manual pages.

Developer's Guide for Oracle Directory Server Enterprise Edition

Shows how to develop directory client applications with the tools and APIs that are provided as part of Directory Server Enterprise Edition.

Troubleshooting Guide for Oracle Directory Server Enterprise Edition

Provides information for defining the scope of the problem, gathering data, and troubleshooting the problem areas by using various tools.

Deployment Planning Guide for Identity Synchronization for Windows

Provides general guidelines and best practices for planning and deploying Identity Synchronization for Windows.

Identity Synchronization for Windows Installation Guide

Describes how to install and configure Identity Synchronization for Windows.

Release Notes for Identity Synchronization for Windows 6.0 Service Pack 1

(This guide) Provides the latest information and installation instructions for Identity Synchronization for Windows 6.0 SP1 that is bundled with Directory Server Enterprise Edition 11g R1 (11.1.1.5).

Related Reading

Identity Synchronization for Windows uses Message Queue with a restricted license. Message Queue documentation is available at http://www.oracle.com/technetwork/indexes/documentation/index.html.

Identity Synchronization for Windows works with Microsoft Windows password policies.

- Information about password policies for Windows 2003 and 2008, is available in the Microsoft documentation (http://technet.microsoft.com/en-us/windowsserver/default.aspx) online.

- Information about the Microsoft Certificate Services Enterprise Root certificate authority, is available in the Microsoft support documentation (http://support.microsoft.com/default.aspx?scid=kb;en-us;247078) online.

- Information about configuring LDAP over SSL on Microsoft systems, is available in the Microsoft support documentation (http://support.microsoft.com/default.aspx?scid=kb;en-us;321051) online.

Redistributable Files

Directory Server Enterprise Edition does not provide any files that you can redistribute.

Documentation, Support, and Training

See the following web sites for additional resources:

- Documentation (http://www.oracle.com/technetwork/indexes/documentation/index.html)

- Support (http://www.oracle.com/us/support/systems/index.html)

- Training (http://education.oracle.com)

Oracle Software Resources

Oracle Technology Network (http://www.oracle.com/technetwork/index.html) offers a range of resources related to Oracle software:

- Discuss technical problems and solutions on the ODSEE Discussion Forum (http://forums.oracle.com/forums/forum.jspa?forumID=877) and the Directory Services blog (http://blogs.oracle.com/directoryservices/).

- See the latest announcements on the Directory Services blog (http://blogs.oracle.com/directoryservices/).

- Download ODSEE 11g Example Files (http://www.oracle.com/technetwork/middleware/id-mgmt/learnmore/odsee11113-examples-350399.zip).

Documentation Accessibility

For information about Oracle's commitment to accessibility, visit the Oracle Accessibility Program website at http://www.oracle.com/pls/topic/lookup?ctx=acc&id=docacc.

Access to Oracle Support

Oracle customers have access to electronic support through My Oracle Support. For information, visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=info or visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=trs if you are hearing impaired.

Part I

Information for All Platforms

Part I contains the following chapters:

- Chapter 1, "Before You Begin Installation"

- Chapter 2, "Understanding Deployment Issues"

- Chapter 3, "Known Bugs and Limitations"

1 Before You Begin Installation

This chapter provides information about tasks you must complete before you can start the Identity Synchronization for Windows 6.0 Service Pack 1 installer. The chapter contains the following sections:

- What's New in This Release

- Hardware Requirements

- Software Requirements

- Obtaining the Software as Part of Directory Server Enterprise Edition

- Completing Pre-Installation Tasks

- Basic Identity Synchronization for Windows Operations

1.1 What's New in This Release

- This release of Identity Synchronization for Windows 6.0 Service Pack 1 contains updated versions of the JDK, NSS and Message Queue components. No change has been made to Identity Synchronization for Windows 6.0 Service Pack 1 itself.

- This release of Identity Synchronization for Windows 6.0 Service Pack 1 is available and downloadable only as a component of Oracle Directory Server Enterprise Edition 11g Release 1 (11.1.1.7.0) and later releases.

- Customers running Identity Synchronization for Windows 6.0 SP1 through Directory Server Enterprise Edition 7.0 should upgrade to the Identity Synchronization for Windows 6.0 Service Pack 1 that is bundled with Oracle Directory Server Enterprise Edition 11g Release 1 (11.1.1.7.0).

1.2 Hardware Requirements

Identity Synchronization for Windows software requires the following hardware.

Table 1-1 Identity Synchronization for Windows Hardware Requirements

Component

Platform Requirement

RAM

512 MB for evaluation purposes wherever components are installed. More memory is preferred.

Local disk space

400 MB disk space for minimal installation alongside Directory Server Enterprise Edition.

1.3 Software Requirements

Before you attempt to install Identity Synchronization for Windows, be sure to resolve the following platform and sofware issues:

- Supported operating systems may require additional software. See Table 1-2, "Supported Platforms and Additional Required Software".

- Your operating system may have additional patch requirements. See Table 1-3, "Minimum Patch Level Requirements".

- Installing Identity Synchronization for Windows 6.0 Service Pack 1 on an unsupported platform will have unpredictable results. Installing Identity Synchronization for Windows 6.0 Service Pack 1 in a Solaris zone is not supported.

- Windows Server 2008 is not a supported installation platform for Identity Synchronization for Windows. So, although you can synchronize with Active Directory 2008 data, installing this release of Identity Synchronization for Windows 6.0 Service Pack 1 on Windows Server 2008 or 2008R2 is not supported.

1.3.1 Supported Platforms and Additional Required Software

The following table lists supported platforms for Identity Synchronization for Windows.

Table 1-2 Supported Platforms and Additional Required Software

Supported OS Versions

Architecture

Additional Required Software

Solaris 10 for SPARC, x86, and AMD 64 architectures

64–bit

For the latest patch information, see My Oracle Support (https://support.oracle.com/CSP/ui/flash.html).

- For SPARC, the recommended patch cluster is 10_Recommended.zip.

- For x64, the recommended patch cluster is 10_x86_Recommended.zip.

Solaris 9 for SPARC and x86 architectures

64–bit and 32–bit

For the latest patch information, see My Oracle Support (https://support.oracle.com/CSP/ui/flash.html).

- For SPARC, the recommended patch cluster is 9_Recommended.zip.

- For x64, the recommended patch cluster is 9_x86_Recommended.zip.

Red Hat Enterprise Linux Advanced Server 4.0 Update 2 for x86 architecture

64–bit and 32–bit

The following compatibility libraries are recommended:

- compat-gcc-32-3.2.3-47.3.i386.rpm

- compat-gcc-32-c++-3.2.3-47.3.i386.rpm

The following compatibility library is required:

compat-libstdc++-33-3.2.3-47.3.rpm

Note that even when running Red Hat on a 64-bit system, 32-bit system libraries are installed. These compatibility libraries are available from Red Hat media or from https://www.redhat.com/rhn/rhndetails/update/.

See also Section 1.5.7, "Resolve Linux Dependencies."

Windows 2003
Server Enterprise Edition and Standard Edition

32–bit

Service Pack 1

See Section 1.5.1, "Add Missing LICENSE.txt file on Windows," and Section 1.5.6, "Resolve DNS Dependencies."

Note:

Identity Synchronization for Windows is not supported on SUSE or HP-UX systems. For these and for other unsupported operating systems, you should investigate using Oracle Directory Integration Platform. See Oracle Fusion Middleware Administrator's Guide for Oracle Directory Integration Platform for more information.

See also the Oracle Fusion Middleware 11gR1 Certification Matrix (http://www.oracle.com/technetwork/middleware/downloads/fmw-11gr1certmatrix.xls).

1.3.2 Required Installation Privileges and Credentials

To install Identity Synchronization for Windows, you must provide credentials for the following.

- Configuration Directory Server

- Directory Server to be synchronized

- Active Directory

See Chapter 3, Installing Core, in Oracle Identity Synchronization for Windows 6.0 Installation and Configuration Guide for details.

In addition, you must have the following privileges to install Identity Synchronization for Windows.

- On Solaris and Red Hat systems, you must install as root.

- On Windows systems, you must install as Administrator.

Note:

When you enter passwords by using the text-based installer, the program automatically masks the passwords so passwords are not echoed in the clear. The text-based installer is supported on Solaris and Red Hat systems only.

1.3.3 Requirements in a Firewall Environment

You can run Identity Synchronization for Windows in a firewall environment. The following sections list the server ports that you must expose through the firewall.

1.3.3.1 Message Queue Requirements

By default, Message Queue uses dynamic ports for all services except for its port mapper. To access the Message Queue broker through a firewall, the broker should use fixed ports for all services.

After installing the core, you must set the imq.<service_name>.<protocol_type>.port broker configuration properties. Specifically, you must set the imq.ssljms.tls.port option. See the Message Queue documentation at http://www.oracle.com/technetwork/indexes/documentation/legacy-glassfish-message-queue-306290.htmlfor more information.

1.3.3.2 Installer Requirements

The Identity Synchronization for Windows installer must be able to communicate with the Directory Server acting as the configuration directory.

- If you are installing an Active Directory connector, the installer must be able to contact Active Directory's LDAP port, 389.

- If you are installing a Directory Server connector or a Directory Server plug-in (subcomponent), the installer must be able to contact the Directory Server LDAP port, default 389.

1.3.3.3 Core Component Requirements

The Message Queue, system manager, and command line interface must be able to reach the Directory Server where the Identity Synchronization for Windows configuration is stored.

1.3.3.4 Console Requirements

The Identity Synchronization for Windows console must be able to reach the following:

- Active Directory over LDAP, port 389, or LDAPS, port 636

- Active Directory Global Catalog over LDAP, port 3268, or LDAPS, port 3269

- Each Directory Server over LDAP or LDAPS

- Administration Server

- Message Queue

1.3.3.5 Connector Requirements

All connectors must be able to communicate with Message Queue. In addition, the following connector requirements must be met.

- The Active Directory connector must be able to access the Active Directory Domain Controller over LDAP, port 389, or LDAPS, port 636.

- The Directory Server connector must be able to access Directory Server instances over LDAP, default port 389, or LDAPS, default port 636.

1.4 Obtaining the Software as Part of Directory Server Enterprise Edition

Identity Synchronization for Windows 6.0 Service Pack 1 is a part of the Oracle Directory Server Enterprise Edition 11g R1 (11.1.1.7.0) bundle. The Directory Server Enterprise Edition Certification Matrix, which contains a frequently updated list of hardware and software compatible with Directory Server Enterprise Edition, is available at http://www.oracle.com/technetwork/middleware/downloads/odsee-11gr1certmatrix-161592.xls

1.4.1 To Download Oracle Directory Server Enterprise Edition 11g R1 (11.1.1.7.0)

Go to the download page for Oracle Identity Management 11g at http://www.oracle.com/technetwork/middleware/downloads/oid-11g-161194.html.

Directory Server Enterprise Edition 11g Release 1 (11.1.1.7.0) is available in zip distribution for all supported platforms.

1.4.2 Minimum Patch Level Requirements

Use the following table to identify the required patch numbers for each supported operating system.

Table 1-3 Minimum Patch Level Requirements

Operating System

Patch Number

Solaris 9 SPARC

119211-25, 125358-13

Solaris 9 x86 (32-bit)

125359-13, 119212-25

Solaris 10 SPARC (64-bit)

119213-25, 125358-13

Solaris 10 x86, AMD64, I64 (64-bit)

125359-13, 119214-25

Linux RH 4.0U2 (x86 & AMD64)

121656-24

1.4.3 Contents of the Zip Distribution File

The following table lists the contents of the ODSEE_Identity_Synchronization_for_Windows directory after you have unzipped the Identity Synchronization for Windows download bundle.

Table 1-4 Contents of ODSEE_Identity_Synchronization_for_Windows Directory

Operating System

Identity Synchronization for Windows Files

Solaris 9, 10 SPARC (64-bit)

HotFix-6.0SP1_COMBO_5_20110722
HotFix-6.0SP1_COMBO_5_20110722/README
HotFix-6.0SP1_COMBO_5_20110722/isw-generic.zip
README.txt
144589-01/isw.6.0.sp1.solaris.sparc.zip
144589-01/README.144589-01
144589-01/patchinfo
jdk/*
mq4_3-installer/*
packages/SunOS5.9/SUNWjss
packages/SunOS5.9/SUNWpr
packages/SunOS5.9/SUNWprd
packages/SunOS5.9/SUNWtls
packages/SunOS5.9/SUNWtlsu
patches/125358-15
patches/SunOS5.10/119213-27
patches/SunOS5.9/119211-27

Solaris 9 x86 (32-bit) and

Solaris 10 x86, AMD64, I64 (64-bit)

HotFix-6.0SP1_COMBO_5_20110722
HotFix-6.0SP1_COMBO_5_20110722/README
HotFix-6.0SP1_COMBO_5_20110722/isw-generic.zip
README.txt
144590-01/isw.6.0.sp1.solaris.x86.zip
144590-01/README.144590-01
144590-01/patchinfo
jdk/*
mq4_3-installer/*
packages/SunOS5.9/SUNWjss
packages/SunOS5.9/SUNWpr
packages/SunOS5.9/SUNWprd
packages/SunOS5.9/SUNWtls
packages/SunOS5.9/SUNWtlsu
patches/125359-15
patches/SunOS5.10/119214-27
patches/SunOS5.9/119212-27

Linux RH 4.0U2 (x86 & AMD64) (32-bit)

HotFix-6.0SP1_COMBO_5_20110722
HotFix-6.0SP1_COMBO_5_20110722/README
HotFix-6.0SP1_COMBO_5_20110722/isw-generic.zip
README.txt
144591-01/*
jdk/*
mq4_3-installer/*
packages/*
patches/RHEL4.0/121656-26

Windows (Server Enterprise & Standard Edition)

HotFix-6.0SP1_COMBO_5_20110722
HotFix-6.0SP1_COMBO_5_20110722\README
HotFix-6.0SP1_COMBO_5_20110722\isw-generic.zip
144592-01\README.144592-01
144592-01\LEGAL_LICENSE.TXT
144592-01\isw.6.0.sp1.windows.zip
jdk\jdkfb-1_5_0_29-windows-i586-p.exe
mq4_3-installer\*
README.txt

1.5 Completing Pre-Installation Tasks

The following is a checklist of issues you must resolve before you run the Identity Synchronization for Windows 6.0 Service Pack 1 installer. These tasks are not optional, they are required for a successful installation. Details for each task are included in sections immediately following the checklist.

- Add Missing LICENSE.txt file on Windows

- Create a Configuration Suffix for Identity Synchronization for Windows

- Gather Information Required by the Installer

- (Linux Only) Verify Environment Settings

- Verify JDK Compatibility

- Resolve DNS Dependencies

- Resolve Linux Dependencies

- Review Chapter 3, "Known Bugs and Limitations."

1.5.1 Add Missing LICENSE.txt file on Windows

When you install Identity Synchronization for Windows 6.0 Service Pack 1 on a Windows system, the core installation fails when installing the bundled Administration Server.

The Administration Server installation checks for the presence of a LICENSE.txt file in the same directory as the setup.exe file associated with the administration server in the admserv_package subtree.To work around this issue, create a file named LICENSE.txt file in same directory where the setup.exe file associated with the administration server in the admserv_package subtree is located.

1.5.2 Create a Configuration Suffix for Identity Synchronization for Windows

Create a suffix such as ou=isw-config for storing Identity Synchronization for Windows configuration data. In production environments, create this suffix on a Directory Server other than the Directory Server that contains your user data. See the chapter that suits your need:

- For Windows, see Chapter 5, "Creating Required Data Stores in Directory Server."

- For Solaris, see Chapter 7, "Creating Required Data Stores in Directory Server."

- For Linux, see Chapter 9, "Creating Required Data Stores in Directory Server."

1.5.3 Gather Information Required by the Installer

The following is a list of properties for which you must enter values when running the Identity Synchronization for Windows 6.0 Service Pack 1 installer. In the following table, an asterisk (*) indicates that a default value is automatically provided.

Table 1-5 Property Values Required by Identity Synchronization for Windows Core Installation

Attribute

Description

Configuration Directory Host

Fully qualified domain name (FQDN) of a Directory Server instance (affiliated with the local Administration Server) where Identity Synchronization for Windows configuration information will be stored

Configuration Directory Port*

Port where the Identity Synchronization for Windows configuration directory is installed. (Default port is 389)

Configuration Root Suffix

Root suffix in which to store the Identity Synchronization for Windows configuration

See Section 1.5.2, "Create a Configuration Suffix for Identity Synchronization for Windows."

Administrator User ID*

Configuration directory Administrator's user ID

Administrator Password

Configuration directory Administrator's password

Configuration Password

Password that will be used to encrypt sensitive parts of the configuration. You must enter this password when you use the console, use command line utilities, or install other components.

Java Home*

Location of the Java Virtual Machine to be used by installed components. Make sure this value matches the JAVA_HOME value. See Section 1.5.5, "Verify JDK Compatibility" for the required JDK release level included with Identity Synchronization for Windows.

Server Root Directory*

Path and directory name of the Administration Server installation server root. The Console will be installed in this location.

Installation Directory (on Solaris or Linux platforms)

Path and directory name of the Identity Synchronization for Windows installation directory. Core binaries, libraries, and executable will be installed in this directory.

Instance Directory (on Solaris or Linux platforms)

Path and directory name of the Identity Synchronization for Windows instance directory. Configuration information that changes (such as log files) will be stored in this directory.

Message Queue Installation Directory

Location of an existing Message Queue instance and fully qualified host name and port of the new Broker instance.

Message Queue Configuration Directory

Path and directory name of the Message Queue instance directory

Message Queue Local Host Name

Fully qualified domain name (FQDN) of the local host machine.

Broker Port Number*

Unused port number for the Message Queue broker to use. (Default port is 7676)

Active Directory Host*

Fully qualified domain name (FQDN) of the host that stores Active Directory configuration data.

Active Directory Port

Port number of the host that stores Active Directory user data

Active Directory User

User with permission to read and modify Active Directory entries. If object deletion is configured, then the user must be a domain administrator.

Active Directory User password

Password of the user with permission to modify Active Directory configuration

1.5.4 (Linux Only) Verify Environment Settings

- The JDK must be installed from RPM, and it must be first in the path. Insert the following before /usr/bin in your environments PATH:
/usr/java/jdk<java_version>/bin

For example:export PATH=/usr/java/jdk1.5.0_29/bin:$PATH

- Before starting the Java console, any installers or uninstaller, set the LD_LIBRARY_PATH in your environment. For example:
LD_LIBRARY_PATH=/opt/sun/private/lib:/opt/sun/isw/lib:$LD_LIBRARY_PATH

export LD_LIBRARY_PATH

1.5.5 Verify JDK Compatibility

A compatible JDK version must be installed properly to ensure a successful Identity Synchronization for Windows installation. Follow these guidelines.

- For Identity Synchronization for Windows 6.0 and 6.0 SP1 (including ODSEE 11.1.1.3.0), use JDK 1.5.0_9.

- For Identity Synchronization for Windows bundled in ODSEE 11.1.1.5.x and 11.1.1.7.x, use JDK 1.5.0_29.

- On Linux, install the JDK from the RPM.

- Set JAVA_HOME to your installed JDK before starting installation or starting the Java console.

- On Solaris, install all the included JDK packages, starting with SUNWj5rt and SUNWj5rtx. Install SUNWj5cfg last.

1.5.6 Resolve DNS Dependencies

- Identity Synchronization for Windows uses the first entry from the hosts file. In the hosts file, be sure to put the FQDN of the Identity Synchronization for Windows host server immediately following the IP address. This eliminates host-only references that come up during installation or configuration. For example:
1192.168.0.10    host.example.com     host     host-alias

- The system Identity Synchronization for Windows is being installed on must be able to resolve its domain and host fully-qualified domain name (FQDN).

- Any Windows host that will have Identity Synchronization for Windows core installed on it must be a member of an Active Directory domain. Installation on a workgoup system is not supported.

1.5.7 Resolve Linux Dependencies

- The Linux system ISW must have the rpm-build tools and compat-lib* libraries present as provided by the "developer" standard bundle and "legacy-developer" bundles from the RHEL/OEL sofware additions. These are available from the installation media. The compat-libstdc++296.i386 and libtermcap.i386 libraries must be installed

- JDK must be installed from the RPM. See the Linux section in Section 1.5.4, "(Linux Only) Verify Environment Settings."

- Identity Synchronization for Windows must be installed as root. You can install Identity Synchronization for Windows as root and then reconfigure Identity Synchronization for Windows to run as a non-root user after initial installation and configuration are complete.

1.6 Basic Identity Synchronization for Windows Operations

In the course of upgrading, migrating or installing Identity Synchronization for Windows, you will use the administration console to complete Identity Sychronization for Windows configuration. Before you use the Java console for the first time, install the included patch bundle described during the install process for each platform. See Section 2.1, "Installing the Critical ISW Patch Set."

This section provides the following instructions:

- Opening the Administration Console

- Starting and Stopping Synchronization

- Starting and Stopping Services

1.6.1 Opening the Administration Console

In the course of installing or migrating Identity Synchronization for Windows, you may want to use the administration console.

To open the administration console, run the following command:

- On Solaris
/var/mps/serverroot/startconsole

- On Linux
/var/Sun/mps/startconsole

- On Windows
C:\Program Files\Sun\MPS\startconsole.exe

1.6.2 Starting and Stopping Synchronization

Starting and stopping synchronization does not start or stop individual Java processes, daemons, or services. Once you begin synchronization, stopping synchronization only pauses the operation. When you restart synchronization, the program resumes synchronization from where it stopped and no change will be lost.

1.6.2.1 To Start or Stop Synchronization Using the Console

1. In the Oracle Directory Server Enterprise Edition Server Console navigation pane, select the Identity Synchronization for Windows instance.

2. When the Identity Synchronization for Windows pane is displayed, click the Open button in the upper right corner.

3. When you are prompted, enter the configuration password.

4. Select the Tasks tab.

- To start synchronization, click Start Synchronization.

- To stop synchronization, click Stop Synchronization.

1.6.2.2 To Start or Stop Synchronization at the Command Line

You can use the startsync or stopsync subcommands from the command line.

On Solaris

/opt/SUNWisw/bin/idsync

On Linux

/opt/sun/isw/bin/idsync

On Windows

C:\Program Files\Sun\MPS\isw instance-name\bin\idsync

- Using startsync

- Using stopsync

1.6.2.2.1 Using startsync

To start synchronization, open a terminal window (or a Command Window) and type the idsync startsync command as follows:

idsync startsync [-D bind-DN] -w bind-password | -
[-h Configuration Directory-hostname] [-p Configuration Directory-port-no]
[-s rootsuffix] -q configuration_password [-Z]
[-P cert-db-path] [-m secmod-db-path]

For example:

idsync startsync -w admin_password -q configuration_password

The following table describes the arguments that are unique to startsync.

Table 1-6 idsync startsync Arguments

Argument

Description

[-y]

Does not prompt for command confirmation.

1.6.2.2.2 Using stopsync

You can use the stopsync subcommand to stop synchronization from the command line.

To stop synchronization, open a terminal window (or a Command Window) and type the idsync stopsync command as follows:

idsync stopsync [-D bind-DN] -w bind-password | -
[-h Configuration Directory-hostname] [-p Configuration Directory-port-no]
[-s rootsuffix] -q configuration_password [-Z]
[-P cert-db-path] [-m secmod-db-path]

For example:

idsync stopsync -w admin_password -q configuration_password

1.6.3 Starting and Stopping Services

Identity Synchronization for Windows and Message Queue are installed as daemons on Solaris and Linux, and as services on Windows. These processes start automatically when the system boots, but you can also start and stop them manually.

Note:

When starting or restarting services, be sure you start the services in this order: first start Message Queue, then start Identity Synchronization for Windows and Directory Server.

1.6.3.1 To Start Services

1. Start Message Queue.

On Solaris:

- From the command line, enter /etc/init.d/imq start .

On Linux:

- From the command line, enter /etc/init.d/imq start .

On Windows: From the Windows Start menu

1. Select Start > Settings > Control Panel > Administrative Services.

2. When the Administrative Services dialog box is displayed, double-click the Services icon to open the Services dialog box.

3. Select Message Queue Broker, and then select Action > Start from the menu bar.
From the command line, enter the net command to control the services.

To check the Message Queue status:

On Solaris or Linux

You can verify that Message Queue is stopped on Linux or Solaris.

# cd /usr/jdk/jdk1.5.0_29/bin
# jps -mlv | grep -i broker

You will see Java command line with broker in the name return if Message Queue is running.

The jps command is part of the JDK installation and is located in the bin directory of your JDK. For example: /usr/java/jdk1.5.0_29/bin/jps

On Windows

Use the windows services management console to monitor the status of the IMQ process. The services management console is under Administrative Tools in the Windows Start menu. You can also access it from Administrative Tools in the Control Panel.

2. Start Identity Synchronization for Windows .

On Solaris:

- From the command line, enter /etc/init.d/isw start.

On Linux:

- From the command line, enter /etc/init.d/isw start.

On Windows:

1. Select Start > Settings > Control Panel > Administrative Services.

2. When the Administrative Services dialog box is displayed, double-click the Services icon to open the Services dialog box.

3. Select Identity Synchronization for Windows and then select Action > Start from the menu bar.
From the command line, enter the net command to control the services.

3. Start Directory Server Enterprise Edition.

On Solaris or Linux

# install-root/dsee7/bin/dsadm start instance-path

On Windows

C:\ install-root\dsee7\bin\dsadm start instance-path

1.6.3.2 To Stop Services

If any single service among Identity Synchronization for Windows, Message Queue, or Directory Server Enterprise Edition is down for longer than 15 minutes, then you must stop and then restart all three services.

1. Stop Directory Server Enterprise Edition.

On Solaris or Linux

# install-root/dsee7/bin/dsadm stop instance-path

On Windows

C:\ install-root\dsee7\bin\dsadm stop instance-path

2. Stop Identity Synchronization for Windows.

Note:

Pause 30 seconds after stopping the service before starting it again. Connectors can take several seconds to cleanly shut themselves down. You can Telnet to the Identity Synchronization for Windows port to determined whether it stopped.

On Solaris:

- From the command line, enter /etc/init.d/isw stop.

On Linux:

- From the command line, enter /etc/init.d/isw stop.

On Windows: From the Windows Start menu

1. Select Start > Settings > Control Panel > Administrative Services.

2. When the Administrative Services dialog box is displayed, double-click the Services icon to open the Services dialog box.

3. Select Identity Synchronization for Windows and then select Action > Stop from the menu bar.

3. Stop Message Queue.

Note:

Pause 30 seconds after stopping the service before starting it again. Connectors can take several seconds to cleanly shut themselves down. You can Telnet to the Message Queue port to determined whether it stopped.

On Solaris:

- From the command line, enter /etc/init.d/imq stop.

On Linux:

- From enter /etc/init.d/imq stop.

On Windows:

1. Select Start > Settings > Control Panel > Administrative Services.

2. When the Administrative Services dialog box is displayed, double-click the Services icon to open the Services dialog box.

3. Select Message Queue, and then select Action > Stop from the menu bar.

4. Verify that Message Queue is stopped by checking the output of the jpscommand.

On Solaris or Linux

# cd /usr/jdk/jdk1.5.0_29/bin
# jps -mlv | grep -i broker

On Windows

Use the Windows services management console (MMC) to monitor the status of the IMQ process. To start the MCC, from the Start menu, go to Administrative Tools. As an alternative, you can go Control Panel > Administrative Tools.

2 Understanding Deployment Issues

This chapter provides important formation about software related to Identity Synchronization for Windows 6.0 Service Pack 1 . In some cases you may have to resolve related software issues before you can run the Identity Synchronization for Windows 6.0 Service Pack 1 installer. This chapter contains the following sections:

- Installing the Critical ISW Patch Set

- Installing or Upgrading Sun Java System Message Queue

- Configuring Group Synchronization

- Synchronization With Active Directory 2008

- Using SUL Filters

- Tuning the Client Timeout Setting

- Verifying that Uninstallation is Complete

2.1 Installing the Critical ISW Patch Set

Included with the Identity Synchronization for Windows bundle is the critical ISW 6.0SP1 CUMIL5 patch set. This patch set should be installed after ISW core installation, but before the Java console is used to create a configuration for ISW.

See the README file contained in the HotFix-6.0SP1_COMBO_5_20110722 bundle. Instructions for installing the ISW 6.0SP1 CUMIL5 patch set are contained in the installation and migration overview sections for each platform. The patch set is Java-based, and it works similarly on all supported platforms.

2.2 Installing or Upgrading Sun Java System Message Queue

Identity Synchronization for Windows 6.0 Service Pack 1 requires the installation and configuration of Message Queue software. This guide provides instructions for installing or upgrading Message Queue to the 4.3 release.

If you are installing a new instance of Identity Synchronization for Windows, you must first complete the steps for installing NSS and NSPR components, the included JDK, and Message Queue.

If you are migrating from version 6.0 or an from earlier 6.0 Service Pack 1 installation of Identity Synchronization for Windows, before upgrading your Message Queue installation, you must complete the steps for cleaning up and exporting configuration.

For detailed instructions, see the "Preparing for Migration" section of one of the following platform-based chapters:

- Chapter 4, "Migrating from Identity Synchronization for Windows 6.0 on Windows"

- Chapter 6, "Migrating from Identity Synchronization for Windows 6.0 on Solaris"

- Chapter 8, "Migrating from Identity Synchronization for Windows 6.0 on Linux"

Identity Synchronization for Windows 6.0 Service Pack 1 also supports Message Queue 3.7 Update 1 (the version that is provided with Java Enterprise System 5 update 1).

To determine which Message Queue version you are running, run the mqbrokerd command.

On Solaris

# /usr/bin/imqbrokerd -version

On Linux

# /opt/sun/mq/bin/imqbrokerd -version

On Windows

C:\Program Files\Sun\MessageQueue\mq\bin\imqbrokerd -version

2.2.1 To Install Message Queue 4.3

See the Sun Java System Message Queue 4.3 Installation Guide.The complete Message Queue 4.3 documentation is available at http://download.oracle.com/docs/cd/E19340-01/index.html

Note:

The graphic installer must not be run on a sub-display other than 0.

If the Message Queue installer fails to start, then make sure that your DISPLAY environment variable is set to host:display.0.

2.2.2 To Upgrade Pre-3.6 Versions of Message Queue

If you are running a pre-3.6 version of Message Queue, then use the following steps to upgrade your installation.

1. Run the installer:

On Solaris and Linux

# cd ODSEE_Identity_Synchronization_for_Windows/mq4_3-installer/
# ./installer

On Windows

C:\install\odsee-11.1.1.5.0\ODSEE_Identity_Synchronization_for_Windows\mq4_3-installer

C:\run installer.vbs

Where C:\install\odsee-11.1.1.5.0\ is the directory where download zip was unpacked.

The Installer's Welcome screen is displayed. Click Next.

2. Read and accept the product license agreement.
Make sure the radio button labeled "I accept the terms in the license agreement" is selected, then click Next.

3. In the JDK Selection screen, specify the version 1.5.0_29 JDK installed for Identity Synchronization for Windows, then click Next.

4. In the Multilingual Packages screen, specify whether to install multilingual packages, then click Next.
By default, Message Queue is installed to operate in the English language only. The Multilingual Packages screen allows you to install it for use in another language.

5. In the Upgrade screen, make sure the radio button labeled "Upgrade" is selected, then click Next.
If an earlier version of Message Queue exists on your system, or if any of the shared components on which Message Queue depends need to be upgraded from earlier versions, the Upgrade screen displays them in a scrollable list along with their current and required versions. If no upgrades are needed, the existing components are simply listed with their version numbers and a notation that they will remain at their current versions. In this case, the "Upgrade" and "Do not upgrade" radio buttons do not appear; just click Next to proceed to the next step.

Caution:

It is possible that upgrading Message Queue's shared components may break other software components on your system that depend on the earlier versions previously installed. Be sure there are no such dependencies before proceeding with the upgrade.

6. In the Ready to Install screen, click Install.

7. In the Register window, provide the required information and then click Next.

8. In the Create and Account screen, provide the required information, and then click Next.

9. In the Installer Summary screen, you can review the installation status and then click Exit.

You can now install Identity Synchronization for Windows.

2.3 Configuring Group Synchronization

Identity Synchronization for Windows can be configured to work with "Domain Global Security" as well as "Domain Global Distribution" groups on Active Directory. If you use Identity Synchronization for Windows 6.0 Service Pack 1 to synchronize groups, you must use the following configuration:

- Map the following Directory Server (DS) attributes to Active Directory (AD):

- DS uid to AD samaccountname

- DS cn to AD cn

- Define the creation expression.

- For Directory Server, the default is uid=%uid%,sync_base.

- For Active Directory, the default is cn=%cn%,sync_base.

- In Directory Server, specify the uid attribute as the RDN for synchronized groups.

In spite of this configuration, group synchronization still has the following limitations:

- Concurrent modifications of a specific attribute is not supported with synchronized groups.

- Synchronization of nested groups fails.

- If you create new users in Directory Server, and add those users to an existing group, the users must also be created in the corresponding connector before the synchronization of that group between Directory Server and Active Directory will work.

2.4 Synchronization With Active Directory 2008

Synchronization between Identity Synchronization for Windows 6.0 Service Pack 1 and Active Directory 2008 (including R2 and R2+) is supported, with the following restrictions:

- Fine-grained password policies.
These are supported, as long as the service complies with the configuration described here.

Active Directory, up to and including version 2003, uses Group Policy (GPO) that is global and domain-wide. The password policy and account lockout settings are therefore global in nature. In Active Directory 2008, domain level, fine-grained PSOs (password setting objects) can be configured for individual users or groups. Identity Synchronization for Windows 6.0 Service Pack 1 requires the password policy and account lockout settings to be uniform between Active Directory and Directory Server. This uniformity must include the PSOs, to avoid unpredictable behavior. Specifically, the following PSO attributes must have the same values in Active Directory and Directory Server:

- msDS-LockoutThreshold Determines how many failed password attempts are allowed before locking out a user account.

- msDS-LockoutObservationWindow Determines the time after which a bad password counter is reset.

- msDS-LockoutDuration Determines how long an account is locked out after too many failed password attempts.

- Read-only domain controllers.
These are not supported. Identity Synchronization for Windows 6.0 Service Pack 1 uses failover server for all operations. Unlike Directory Server read-only replicas, a read-only domain controller cannot be a part of the Active Directory failover setup.

A Directory Server replica uses a password plug-in that redirects all writable requests to the masters. This functionality cannot be provided in Active Directory, as there is no such plug-in.

Note:

Windows Server 2008 is not a supported installation platform for Identity Synchronization for Windows . So, although you can synchronize with Active Directory 2008 data, installing Identity Synchronization for Windows 6.0 Service Pack 1 on Windows Server 2008 is not supported. For more information, see Chapter 1, "Software Requirements.".

Windows 2008 does not alleviate the current group synchronization restrictions that are described in Configuring Group Synchronization.

2.5 Using SUL Filters

Verify any LDAP filters you plan on using within the SUL configuration by testing them with the ldapsearch command provided with Directory Server Enterprise Edition. Verify your configured search base as well as filters for both Active Directory and Directory Server Enterprise Edition LDAP servers with which you will be synchronizing.

Also, a group and its members should be defined in the same SUL, Members of a group are not synchronized if they are defined in a different SUL than their group.

2.6 Tuning the Client Timeout Setting

By default, Identity Synchronization for Windows 6.0 Service Pack 1 is configured with a client time-out period of two minutes. If your Active Directory server is under a heavy load, this setting can be too short and cause failures between the two servers. In this case, increase the client timeout setting. Complete the following steps.

1. Stop Identity Synchronization for Windows.
See Section 1.6.3, "Starting and Stopping Services."

2. Make a backup of the WatchList.properties file.
By default, this file is located here:

On Solaris

/var/opt/SUNWisw/resources/WatchList.properties

On Linux

/var/opt/sun/isw/resources/WatchList.properties

On Windows

C:\Program Files\Sun\MPS\isw-win2k3-isw\resources\WatchList.properties

3. In WatchList.properties, change the value of the following setting.

-Dcom.sun.directory.wps.CLIENT_TIME_LIMIT=value

where value is the maximum number of milliseconds to wait for an operation to complete. The value must be from 0 through 600000. A value of 0 specifies that the client waits for server to complete the operation. The default value is the recommended minimum of 120000 milliseconds.

The following example sets CLIENT_TIME_LIMIT to 300,000 milliseconds, or 5 minutes.

-Dcom.sun.directory.wps.CLIENT_TIME_LIMIT=300000

4. Save and close the WatchList.properties file.

5. Restart Identity Synchronization for Windows.
See Section 1.6.3, "Starting and Stopping Services."

2.7 Verifying that Uninstallation is Complete

When Identity Synchronization for Windows 6.0 Service Pack 1 is uninstalled, the productregistry file may not be updated.

After uninstalling Identity Synchronization for Windows, use a text editor to edit one of the following files, depending on your installation.

On Solaris

/var/sadm/install/productregistry

On Linux

/var/opt/sun/install/productregistry

On Windows

C:\WINDOWS\SysWOW64\productregistry

You can also use Windows Explorer to search for productregistry under your C:\WINDOWS path.

If the file still contains any entries for isw, delete them.

3 Known Bugs and Limitations

This section lists the bugs fixed inIdentity Synchronization for Windows 6.0 Service Pack 1 and describes the known issues at the time of the release of this service pack. This chapter contains the following topics:

- Identity Synchronization for Windows Limitations

- Performing Data Recovery When System or Application Fails

- Known Issues in Identity Synchronization for Windows 6.0 Service Pack 1

Note:

Any reference to "Directory Server" in this section is to the Directory Server that is provided with Oracle Directory Server Enterprise Edition.

3.1 Identity Synchronization for Windows Limitations

This section lists product limitations. Limitations are not always associated with a change request number.

Installation in virtualized environment is not supported.

Installation of Identity Synchronization for Windows 6.0 Service Pack 1 in virtualized environments or on systems running zones is not supported.

Do not change file permissions by hand.

Changes to file permissions for installed Identity Synchronization for Windows 6.0 Service Pack 1 product files can in some cases prevent the software from operating properly.

To work around this limitation, install products as a user having appropriate user and group permissions.

No failover for the Identity Synchronization for Windows 6.0 Service Pack 1 core service.

If you lose the system where the Identity Synchronization for Windows 6.0 Service Pack 1 core service is installed, you must install it again.

Take a backup of ou=services (configuration branch ofIdentity Synchronization for Windows 6.0 Service Pack 1 DIT) in LDIF format and use this information when you reinstall Identity Synchronization for Windows.

Change in authentication behavior on Microsoft Windows 2003 SP1

When you install Windows 2003 SP1, by default users are allowed one hour to access their accounts using their old passwords.

As a result, when users change their passwords on Active Directory, the on-demand sync attribute dspswvalidate is set to true, and the old password can be used to authenticate against Directory Server. The password synchronized on Directory Server is then the prior, old password, rather than the current Active Directory password.

See the Microsoft Windows support documentation (http://support.microsoft.com/?kbid=906305) for details on how to turn off this functionality.

Include the admin jars path in the CLASSPATH variable.

The CLASSPATH variable should contain the location of the admin jars, otherwise a noClassDefFound error is displayed during resynchronization.

Synchronization stops if servers with connectors stop

Synchronization stops if Directory Server or Active Directory servers configured within the connectors are down. Only limited failover is possible during on-demand authentication. If a configured Directory Server or Active Directory server is down, Identity Synchronization for Windows will go from a "SYNCING" state into a "READY" state until the target Directory Server or Active systems are brought back online.

3.2 Performing Data Recovery When System or Application Fails

After hardware or application failure, you might have to restore the data from backup in some of the synchronized directory sources.

After completing the data recovery, however, you must perform an additional procedure to ensure that the synchronization can proceed normally.

The connectors generally maintain information about the last change that was propagated to the message queue.

This information, which is called the connector state, is used to determine the subsequent change that the connector has to read from its directory source. If the database of a synchronized directory source is restored from a backup, then the connector state might no longer be valid.

Windows-based connectors for Active Directory and for Windows NT also maintain an internal database. The database is a copy of the synchronized data source. The database is used to determine what has changed in the connected data source. The internal database is no longer be valid once the connected Windows source is restored from a backup.

In general, the idsync resync command can be used to repopulate the recovered data source.

Note:

Resynchronization cannot be used to synchronize passwords with one exception. The -i ALL_USERS option can be used to invalidate passwords in Directory Server. This works if the resynchronization data source is Windows. The SUL list must also include only Active Directory systems.

Use of the idsync resync command, however, might not be an acceptable option in every situation.

Caution:

Before executing any of the steps detailed that follow, make sure that synchronization is stopped.

3.2.1 Bidirectional Synchronization

Use the idsync resync command with the appropriate modifier settings, according to the synchronization settings. Use the recovered directory source as the target of the resync operation.

3.2.2 Unidirectional Synchronization

If recovered data source is a synchronization destination, then the same procedure can be followed as for bidirectional synchronization.

If recovered data source is a synchronization source, then idsync resync can still be used to repopulate the recovered directory source. You need not change the synchronization flow settings in the Identity Synchronization for Windows configuration. The idsync resync command allows you to set synchronization flow independent of the configured flows with the -o Windows|Sun option.

Consider the following scenario as an example. Bidirectional synchronization is setup betweenIdentity Synchronization for Windows 6.0 Service Pack 1 and Active Directory.

- The database of a Microsoft Active Directory server has to be recovered from a backup.

- In Identity Synchronization for Windows, this Active Directory Source is configured for the SUL AD.

- Bidirectional synchronization for modifies, creates and deletes is set up between this Active Directory Source and aIdentity Synchronization for Windows 6.0 Service Pack 1 Source.

3.2.2.1 To Perform Unidirectional Synchronization

1. Stop synchronization.

idsync stopsync -w - -q -

2. Resynchronize Active Directory Source. Also, resynchronize modifies, creations, and deletes.

idsync resync -c -x -o Sun -l AD -w bind-DN -w  bind-password -q configuration-password

3. Restart synchronization.

idsync startsync -w bind-DN -w  bind-password -q configuration-password

3.2.3 Directory Source Specific Recovery Procedures

The following procedures correspond to specific directory sources.

3.2.3.1 Microsoft Active Directory

If Active Directory can be restored from a backup, then follow the procedures in the sections covering either bidirectional, or unidirectional synchronization.

You might, however, have to use a different domain controller after a critical failure. In this case, follow these steps to update the configuration of the Active Directory Connector.

3.2.3.2 To Change the Domain Controller

1. Open the administration console.

- On Solaris
/var/mps/serverroot/startconsole

- On Linux
/var/Sun/mps/startconsole

- On Windows
C:\Program Files\Sun\MPS\startconsole.exe

2. Select the Configuration tab. Expand the Directory Sources node.

3. Select the appropriate Active Directory Source.

4. Click Edit controller, and then select the new domain controller.
Make the selected domain controller the NT PDC FSMO role owner of the domain

5. Save the configuration.

6. Stop the Identity Synchronization service on the host where the Active Directory Connector is running.

7. Delete all the files except the directories, under ServerRoot/isw-hostname/persist/ADPxxx. Here, xxx is the number portion of the Active Directory Connector identifier.
For example, 100 if the Active Directory Connector identifier is CNN100.

8. Start the Identity Synchronization service on the host where the Active Directory Connector is running.
See Section 1.6.3, "Starting and Stopping Services."

9. Follow the steps according to your synchronization flow in the unidirectional or the bidirectional synchronization sections.

3.2.3.3 Failover and Directory Server

Either the Retro Changelog database, or the database with synchronized users, or both can be affected by a critical failure.

3.2.3.4 To Manage Identity Synchronization for Windows 6.0 Service Pack 1 Fail Over

1. Retro Changelog Database.
Changes that theIdentity Synchronization for Windows 6.0 Service Pack 1 connector could not process might have occurred in the Retro Changelog database. Restoration of the Retro Changelog database only makes sense if the backup contains some unprocessed changes. Compare the most recent entry in the accessor.state file with the last changenumber in the backup.

On Solaris

/var/opt/SUNWisw/persist/ADP100/accessor.state

On Linux

/var/opt/sun/isw/persist/ADP100/accessor.state

On Windows

C:\Program Files\Sun\MPS\isw-hostname persist\ADP100\accessor.state

Where hostname is replaced with the host name as seen in the folder name in the MPS path.

If the value in accessor.state is greater than or equal to the changenumber in the backup, do not restore the database. Instead, recreate the database.

After the Retro Changelog database is recreated, make sure that you run idsync prepds. Alternatively, click Prepare Directory Server from the Sun Directory Source window in the Identity Synchronization for Windows 6.0 Service Pack 1 management console.

The Identity Synchronization for Windows 6.0 Service Pack 1 connector detects that the Retro Changelog database is recreated and log a warning message. You can safely ignore this message.

2. Synchronized Database.
If no backup is available for the synchronized database, then the Identity Synchronization for Windows 6.0 Service Pack 1 connector has to be reinstalled.

If the synchronized database can be restored from a backup, then follow the procedures in either the bidirectional or the unidirectional synchronization sections.

3.3 Known Issues in Identity Synchronization for Windows 6.0 Service Pack 1

This section lists known issues. Known issues are associated with a change request number.

Synchronizing existing entries on a new setup fails with Error 65 objectclass violation.

If you have a complex custom objectclass design for your Directory Server entries, then make sure to populate the Auxiliary ObjectClass configuration with any of your custom ObjectClasses that are within your user entries. In some configurations it might be necessary to complete the first synchronization with schema-checking turned OFF in the directory server. You will re-enable schema checking after the initial synchronization is complete. If you run into this issue and are not able to work around it, then open a Support ticket.

4997513

On Windows 2003 systems, the flag that indicates the user must change his password at the next login is set by default.

When you create users on Windows 2003 systems with the user must change pw at next login flag set, users are created on Directory Server with no password. The next time the users log into Active Directory, the users must change their passwords. The change invalidates their passwords on Directory Server. The change also forces on-demand synchronization the next time those users authenticate to Directory Server.

Until users change their password on Active Directory, users are not able to authenticate to Directory Server.

5077227

Problems can occur when attempting to view the Identity Synchronization for Windows 6.0 Service Pack 1 console with PC Anywhere 10 with Remote Administration 2.1. PC Anywhere version 9.2 has been seen not to cause errors. If problems persist, remove the remote administration software. Alternatively, VNC can be used. VNC is not known to cause any issues when displaying the Identity Synchronization for Windows 6.0 Service Pack 1 console.

5097751

If you install Identity Synchronization for Windows 6.0 Service Pack 1 on a Windows system that is formatted with FAT 32 system, then no ACLs are available. Furthermore, no access restrictions are enforced for the setup. To ensure security, use only Windows NTFS system to install Identity Synchronization for Windows.

6251334

User deletion synchronization cannot be stopped even after changing the Active Directory source. Deletion synchronization therefore continues when the Synchronized Users List has been mapped to a different organizational unit, OU, in the same Active Directory Source. The user appears to have been deleted on the Identity Synchronization for Windows 6.0 Service Pack 1 instance. The user appears as deleted even if the user is deleted from the Active Directory source which does not have a SUL mapping.

6254516

When Identity Synchronization for Windows 6.0 Service Pack 1 plug-in is configured on the consumers with command-line, the plug-in does not create a new subcomponent ID for the consumers. The plug-in configuration does not create new IDs for consumers.

6288169

The password synchronization plug-in for Identity Synchronization for Windows 6.0 Service Pack 1 tries to bind to the Active Directory for accounts that have not been synchronized even before checking the accountlock and passwordRetryCount.

To resolve this issue, enforce a password policy on the LDAP server. Also, configure Access Manager to use the following filter on user search:

(| ( !(passwordRetryCount=*) ) (passwordRetryCount <=2) )

This workaround, however, throws a user not found error when too many login attempts are made over LDAP. The workaround does not block the Active Directory account.

6331956

Identity Synchronization for Windows console fails to start if o=NetscapeRoot is replicated.

6332183

Identity Synchronization for Windows 6.0 Service Pack 1 might log exceptions stating that a user already exists, if the Add action flows from Directory Server to the Active Directory before the Delete can. A race condition might occur where the add operation is performed before the delete operation during synchronization, thus cause Active Directory to log an exception.

For example, if a user, dn: user1, ou=isw_data, is added to an existing group, dn: DSGroup1,ou=isw_data, when the user is deleted from the group, the uniquemember of the group is modified. If the same user is added to a group that has the same DN, (for userdn: user1, ou=isw_data), an Add operation is performed. At this point, Identity Synchronization for Windows 6.0 Service Pack 1 might log exceptions stating that the user already exists.

6332197

Identity Synchronization for Windows throws errors when groups, with user information of users not yet created, are synchronized on Directory Server.

6335193

You might try to run the resynchronization command to synchronize users from Directory Server to Active Directory. The creation of the group entity fails if unsynchronized users are added to an unsynchronized group.

To resolve this issue, you should run the resync command twice for the synchronization to happen correctly.

6336471

Identity Synchronization for Windows 6.0 Service Pack 1 plug-in cannot search through chained suffixes. As a result, the modify and bind operations cannot be performed on the Directory Server instance.

6339444

You can specify the scope of synchronization with the Synchronization Users List using the Browse button on the Base DN pane. When you specify the scope, the subsuffixes are not retrieved.

To work around this issue, add ACIs to permit anonymous access for reads and searches.

6379804

During the upgrade of core components of Identity Synchronization for Windows 6.0 Service Pack 1 to version 1.1 SP1 on Windows systems, the updateCore.bat file contains a hard-coded incorrect reference to Administration Server. As a result, the upgrade process does not complete successfully.

To resolve this problem, replace two instances of references to Administration Server in the upgrade script.

Replace the following instructions on lines 51 and 95 of the upgrade script. Change lines as follows.

net stop "Sun Java(TM) System Administration Server 5.2"

Instead, the lines should read as follows:

net stop admin52-serv

After making the specified changes, rerun the upgrade script.

6386664

Identity Synchronization for Windows synchronizes user and group information between Active Directory and Identity Synchronization for Windows 6.0 Service Pack 1 when group synchronization feature is enabled. The synchronization should ideally happen only after issuing the resync command from the command line.

6388815

Active Directory connectors and Directory Server connectors crash when an attempt is made to synchronize nested groups as such synchronization is not currently supported.

6388872

For Windows Creation Expressions in an Identity Synchronization for Windows 6.0 Service Pack 1 to Active Directory, the flow cn=%cn% works both for users and groups. For every other combination, Identity Synchronization for Windows 6.0 Service Pack 1 shows errors during synchronization.

6444341

The Identity Synchronization for Windows 6.0 Service Pack 1 uninstallation program is not localized. WPSyncResources_X.properties files fail to be installed in the /opt/sun/isw/locale/resources directory.

To work around this issue, copy the missing WPSyncResources_X.properties files from the installer/locale/resources directory by hand.

6444878

Install and set up Java Development Kit version 1.5.0_06 before running Administration Server.

6444896

When performing a text-based installation of Identity Synchronization for Windows 6.0 Service Pack 1 , leaving the administrator password empty and typing return causes the installation program to exit.

6452425

If you install Identity Synchronization for Windows 6.0 Service Pack 1 on a Solaris system where the SUNWtls package version 3.11.0 is installed, the Administration Server might not launch. To resolve this, uninstall the SUNWtls package before you install Identity Synchronization for Windows.

6452538

On Windows platforms, Message Queue 3.5 used by Identity Synchronization for Windows 6.0 Service Pack 1 requires a PATH value less than 1 kilobyte in length. Longer values are truncated.

6472296

After installation in the Japanese locale on Windows systems, Identity Synchronization for Windows 6.0 Service Pack 1 user interfaces are not fully localized.

To work around this issue, include unzip.exe in the PATH environment variable before starting the installation.

6477567

In Directory Server Enterprise Edition 11g Release 1 (11.1.1), The Directory Server plug-in for Identity Synchronization for Windows 6.0 Service Pack 1 is installed with Directory Server installation. The Identity Synchronization for Windows 6.0 Service Pack 1 installer does not install the Directory Server plug-in. Instead, Identity Synchronization for Windows 6.0 Service Pack 1 only configures the plug-in.

In this release of Identity Synchronization for Windows 6.0 Service Pack 1 , the text-based installer does not prompt you to configure the Directory Server plug-in for Identity Synchronization for Windows 6.0 Service Pack 1 during the installation process. As a workaround, run the Idsync dspluginconfig command in the terminal window after the Identity Synchronization for Windows 6.0 Service Pack 1 installation is completed.

6485333

The installer and uninstaller on Windows systems are not internationalized.

6486505

On Windows, Identity Synchronization for Windows 6.0 Service Pack 1 supports only English and Japanese locales.

6492125

The Identity Synchronization for Windows 6.0 Service Pack 1 online help contents displays square boxes instead of multi-byte characters for CCK locales.

6501886

When the Active Directory domain administrator password changes, the Identity Synchronization for Windows 6.0 Service Pack 1 Console has been seen to show a warning. The warning shown is Invalid credentials for Host-hostname.domainnname, even when the password used is valid.

6529349

On Solaris SPARC, Identity Synchronization for Windows 6.0 Service Pack 1 might not uninstall due to the absence of the /usr/share/lib/mps/secv1/jss4.jar file. This happens only during the installation of the product, when the installer detects the already installed instance of the SUNWjss package and does not update it.

As a workaround, before uninstalling the product, complete the following steps:

Make a backup copy of the install-path/SUNWisw/runUninstaller.sh file and modify the $JAVA_EXEC line. Change the command to include the secv1 path to the jss4.jar file.For example:

$JAVA_EXEC -Djava.library.path=./lib \-classpath "${SUNWjss}/usr/share/lib/mps/jss4.jar:\
${SUNWjss}/usr/share/lib/mps/secv1/jss4.jar:\
${SUNWxrcsj}/sfw/share/lib/xerces-200.jar:./lib/installsdk.jar:\./lib/ldap.jar:./lib/webstart.jar:\
${SUNWiquc}/usr/share/lib/jms.jar:.:./lib/install.jar:\
./resources:./locale/resources:./lib/common.jar:\
./lib/registry.jar:./lib/ldapjdk.jar:./installer/registry/resources" \
-Djava.util.logging.config.file=./resources/Log.properties \
-Djava.util.logging.config.file=../resources/Log.properties \
-Dcom.sun.directory.wps.logging.redirectStderr=false \
-Dcom.sun.directory.wps.logging.redirectStdout=false \
uninstall_ISW_Installer $1

6879679

The Identity Synchronization for Windows 6.0 Service Pack 1 stop script is not called on reboot.

On the Solaris operating system, if the system is rebooted by the command shutdown -i6 -g0 -y, the stop script is not called and the pid in the pid.txt file is not cleared. As a result, Identity Synchronization for Windows 6.0 Service Pack 1 sometimes fails to start automatically after the operating system is rebooted.

To work around this limitation, create the following hard link:

$ ln /etc/rc2.d/K41isw /etc/rc0.d/K41isw

6915508

The Identity Synchronization for Windows installer fails out of heap space with Java version 1.5.0_22 (or greater) and default max heap.

You will see the exception start with:

Exception in thread "main" java.lang.OutOfMemoryError: Java heap space

Edit runinstaller.sh to change the exec and set a max heap larger than default. Set this where you see the first "JAVA_EXEC=" statement in the file , near line 212. After the change the line will read:

JAVA_EXEC="$JAVA_HOME/bin/java -Xmx512M"

In this example, the setting is changed to 512MB max heap. Then the installer proceeds with no issues.

6920471

The /var/sadm/install/logs directory might not be created when the installation occurs. In this case, installation log entries are written to standard out instead of a log file. As a workaround, create the /var/sadm/install/logs directory before installing Identity Synchronization for Windows 6.0 Service Pack 1 .

6962426

When you start the Identity Synchronization for Windows 6.0 Service Pack 1 console on a Red Hat Linux 4.0 64–bit system, you might encounter the following error:

java.lang.UnsatisfiedLinkError

This problem arises because the RPM package seamonkey-nss-1.0.3-0.el4.1 that is shipped with Red Hat Linux 4.0 64–bit conflicts with the sun-nss-3.12.6–1 package. To enable the console to start correctly, set the LD_LIBRARY_PATH environment variable as follows:

export LD_LIBRARY_PATH=/opt/sun/private/lib/:$LD_LIBRARY_PATH

6967645

When you create an Active Directory connector on a Linux system, using the installer script, you might encounter the following error:

java.lang.UnsatisfiedLinkError

This problem arises because of a conflict with the RPM package /usr/lib/libnss3.so. To work around this problem, set the LD_LIBRARY_PATH environment variable as follows:

export LD_LIBRARY_PATH=/opt/sun/private/lib/:$LD_LIBRARY_PATH

6974782

When you install Identity Synchronization for Windows 6.0 Service Pack 1 on a Windows system, the core installation fails when installing the bundled Administration Server.

The Administration Server installation checks for the presence of a LICENSE.txt file in the installation directory (the same directory as the setup.exe file). To work around this issue, create a dummy LICENSE.txt file in the installation directory.

6976249

When Directory Server and Microsoft Active Directory are synchronized, and you restore entries from a backup Directory Server instance, the entries in Active Directory and Directory Server are no longer synchronized. Directory Server entries are created, they are propagated to Active Directory, and then Active Directory entries are also created. But the entries created in Active Directory contain objectguid values which are different from Directory Server entries that contain dspswuserlink values.

To work around this problem, follow these steps to re-link the entries.

1. Delete the dspswuserlink attribute from the Directory Server entries.

2. Resync the unlinked entries.

On Solaris

/opt/SUNWisw/bin/idsync resync -f linkusers.cfg -D bind-DN -w bind-password -q configuration-password -k

On Linux

/opt/sun/isw/bin/idsync resync -f linkusers.cfg -D bind-DN -w bind-password -q configuration-password -k

On Windows

C:\Program Files\Sun\MPS\isw-hostname\bin\idsync  resync -f linkusers.cfg -D bind-DN -w bind-password -q configuration-password -k

where hostname is the directory name as shown within the MPS path.

7018916 and 12308010
Password quality check functionality in the Directory Server synchronized host must be disabled in order to perform the entries synchronization from Active Directory to Directory Server. Set the configuration parameter as following: pwd-check-enabled: off
12387882
The LD_LIBRARY_PATH environment variable must be set properly to restart Identity Synchronization for Windows 6.0 Service Pack 1 on the Linux platform. Do one of the following:

- Set LD_LIBRARY_PATH=/opt/sun/private/lib/:$LD_LIBRARY_PATH in the terminal where you launch /etc/init.d/isw start

- Add the /opt/sun/private/lib/ pathname in the LD_LIBRARY_PATH variable defined in the /opt/sun/isw/bin/start_watchdog.sh shell script.

Part II

Windows Upgrade & Migration, and New Installation

Part II contains the following chapters:

- Chapter 4, "Migrating from Identity Synchronization for Windows 6.0 on Windows"

- Chapter 5, "Installing From Scratch on Windows"

4 Migrating from Identity Synchronization for Windows 6.0 on Windows

When you migrate from Identity Synchronization for Windows 6.0, you first export the existing configuration and uninstall Identity Synchronization for Windows 6.0. Then you install Identity Synchronization for Windows 6.0 Service Pack 1 , and apply the configuration exported from Identity Synchronization for Windows 6.0. This chapter contains the following sections:

- Obtaining the Latest Identity Synchronization for Windows Release

- Preparing for Migration

- Uninstalling Identity Synchronization for Windows 6.0 Components

- Installing Identity Synchronization for Windows 6.0 Service Pack 1

- Confirming the Installation

4.1 Obtaining the Latest Identity Synchronization for Windows Release

See Section 1.4, "Obtaining the Software as Part of Directory Server Enterprise Edition."

4.2 Preparing for Migration

The following is a checklist of required tasks you must complete before you can successfully migrate Identity Synchronization for Windows 6.0 Service Pack 1 .

- Schedule an appropriate time for migration

- Disable the group synchronization and account lockout

- Unpack the Identity Synchronization for Windows 6.0 Service Pack 1 patch content

- Export the current Identity Synchronization for Windows 6.0 Service Pack 1 configuration setting to an XML file

- Add a clear text password to the exported configuration file

- Stop synchronization

- Verify that your system is in a quiescent state

- Stop the Identity Synchronization for Windows 6.0 Service Pack 1 services

- Save the connector states

4.2.1 Schedule an appropriate time for migration

Schedule an appropriate time for migration.

Migration typically requires four to eight hours, depending on your system's performance and the configuration of Identity Synchronization for Windows 6.0 Service Pack 1 .

4.2.2 Disable the group synchronization and account lockout

You can use either the administration console or the command-line interface to complete these tasks.

4.2.2.1 Using the Administration Console

1. Open the administration console.
C:\Program Files\Sun\MPS\startconsole.exe

2. Go to Configuration > Groups, and deselect the Enable Group Synchronization checkbox.

3. Go to Configuration > Account Lockout, and deselect the Enable Account Lockout Synchronization checkbox.

4. Click Save.

4.2.2.2 Using the Command-Line Interface

Use the idsync command in the following directory:

C:\Program Files\Sun\MPS\isw-instance-name\bin\idsync

To disable group synchronization:

# idsync groupsync -d -D  Directory-Manager-DN -w bind-password [-h Configuration-Directory-hostname] [-p Configuration-Directory-port-number] -s rootsuffix [-Z] -q configuration-password -t AD-group-type

To disable account lockout:

# idsync accountlockout -d -D  Directory-Manager_DN -w  bind-password -h Configuration Directory-hostname -p Configuration-Directory-port-number -s rootsuffix [-Z] [-P cert-db-path [-m secmod db path] -q configuration-password -t max-lockout-attempts

4.2.3 Unpack the Identity Synchronization for Windows 6.0 Service Pack 1 patch content

Unpack the Identity Synchronization for Windows 6.0 Service Pack 1 patch content.

# unzip.exe zipped_patch_file

To identify the zipped_patch_file for your installation, see Section 1.4.2, "Minimum Patch Level Requirements.".

After the patch files are unzipped, the migration subdirectory contains the migration tools:

- export11cnf.jar

- checktopics.jar

4.2.4 Export the current Identity Synchronization for Windows 6.0 Service Pack 1 configuration setting to an XML file

Export the current Identity Synchronization for Windows 6.0 Service Pack 1 configuration setting to an XML file.

Change the current directory to migration and run the export11cnf.jar file with the following usage:

# java -jar export11cnf.jar -D bind_DN -w bind_password | -
[-h configuration_directory_hostname] [-p configuration_directory_port_number]
-s root_suffix [-Z] -q configuration_password | -
-f xml_configuration_filename_to_export

The following example shows a typical use:

# java -jar export11cnf.jar -D "cn=directory manager"
-w - -h "test.example.com" -p 389 -s "ou=isw_config" -q - -f export.cfg

4.2.5 Add a clear text password to the exported configuration file

Add clear text passwords to the exported configuration file.

Edit the exported configuration file, and enter a password between the double quotation marks for each of six cleartextPassword fields. You must provide three passwords for the Directory Server user, and three passwords for the Active Directory user.

4.2.6 Stop synchronization

You can either use the administration console, or run the idsync stopsync command. See Section 1.6.2, "Starting and Stopping Synchronization."

4.2.7 Verify that your system is in a quiescent state

Make sure that the current directory is migration, and run the checktopics.jar file with the following usage:

# java -jar checktopics.jar -D bind_DN -w bind_password | -
[-h configuration_directory_hostname] [-p configuration_directory_port_number]
-s root_suffix [-Z] -q configuration_password | -

The following example shows a typical use:

# java -jar checktopics.jar -D "cn=directory manager"
-w - -h "test.example.com" -p 389 -s "ou=isw_config" -q -

If the system is in a quiescent state, checktopics.jar displays the following message:

There are no synchronization messages currently in the Message Queue

If checktopics.jar does not display this message, follow these steps:

1. Restart synchronization. See Section 1.6.2, "Starting and Stopping Synchronization.".

2. Wait until the synchronization messages are applied to the destination connector.

3. Stop synchronization again. See Section 1.6.2, "Starting and Stopping Synchronization."

4. Run the checktopics.jar file again.

4.2.8 Stop the Identity Synchronization for Windows 6.0 Service Pack 1 services

Stop the Identity Synchronization for Windows 6.0 Service Pack 1 services. See Section 1.6.3, "Starting and Stopping Services."

4.2.9 Save the connector states

Save the connector states by backing up the persist and etc directories from the existing 6.0 installation tree.

Change the current directory to server_root\isw-hostname and run the following commands:

# %JAVA_HOME%\bin\jar -cfM %TEMP%\connector-state.jar persist etc

4.3 Uninstalling Identity Synchronization for Windows 6.0 Components

Repeat the following procedure for each of the Identity Synchronization for Windows components installed on your system in this order: First uninstall Active Directory Connectors, then uninstall Directory Server Connectors and Plug-ins, and finally uninstall the Identity Synchronization for Windows Core.

1. Run the uninstaller located at C:\Program Files\Sun\MPS\isw-instance-name/uninstall.cmd.

2. Provide the requested passwords.

3. Each time you run the uninstaller, remove only one component. If you remove more than one component at a time, results may be unpredicatable.

See "Chapter 9, Removing the Software" in Sun Java System Directory Server Enterprise Edition 6.0 Installation Guide for more information.

4.4 Installing Identity Synchronization for Windows 6.0 Service Pack 1

To install Identity Synchronization for Windows 6.0 Service Pack 1 complete these steps:

1. Prepare for installation as described in Section 5.3, "Preparing for Identity Synchronization for Windows Installation."

2. Install the Identity Synchronization for Windows 6.0 Service Pack 1 core, as described in Chapter 3, Installing Core, in Oracle Identity Synchronization for Windows 6.0 Installation and Configuration Guide.

3. Install the HotFix-6.0SP1_COMBO_5_20110722 patch included within the 11.1.1.7.0 ODSEE release. Note that on Windows the command is the similar to the example in the README file.
However, on Windows paths, such as the following:

Install.cmd C:\Program Files\Sun\MPS\isw-hostname-isw C:\Program Files\Sun\MPS\java\jars

you must replace the variable hostname with the proper value from within the MPS path for your Identity Synchronization for Windows installation.

4. To import your version 6.0 configuration XML file, run the idsync importcnf command located in the following directory:
C:\Program Files\Sun\MPS\isw instance-name\bin\

# idsync importcnf -w admin_password -q configuration_password -f xml_configuration_filename_to_import

For more information about using idsync importcnf, see Using importcnf in Oracle Identity Synchronization for Windows 6.0 Installation and Configuration Guide.

5. (Optional) Install the group synchronization and deletion flow features as described in these sections:

- Specifying Configuration Settings for Group Synchronization in Oracle Identity Synchronization for Windows 6.0 Installation and Configuration Guide

- Specifying How Deletions Flow in Oracle Identity Synchronization for Windows 6.0 Installation and Configuration Guide

6. Install the Identity Synchronization for Windows 6.0 Service Pack 1 connectors as described in Chapter 5, Installing Connectors, in Oracle Identity Synchronization for Windows 6.0 Installation and Configuration Guide.

7. (Optional) Configure account lockout.

C:\Program Files\Sun\MPS\isw-instance-name\bin\idsync

# idsync accountlockout -d -D  Directory-Manager_DN -w  bind-password -h Configuration Directory-hostname -p Configuration-Directory-port-number -s rootsuffix [-Z] [-P cert-db-path [-m secmod db path] -q configuration-password -t max-lockout-attempts

8. Configure the Identity Synchronization for Windows 6.0 Service Pack 1 plug-in as described in Using dspluginconfig in Oracle Identity Synchronization for Windows 6.0 Installation and Configuration Guide.

9. Stop Identity Synchronization for Windows services. See Section 1.6.3, "Starting and Stopping Services."

10. Delete the Identity Synchronization for Windows 6.0 Service Pack 1 persist and etc directories and all their contents from the instance directory, and replace them with Identity Synchronization for Windows version 6.0 persist and etc directories that you backed up in Section 4.2, "Preparing for Migration.".
Use these commands:

cd serverroot\isw-hostname
# rd /s etc persist
# %JAVA_HOME%\bin\jar -xf %TEMP%\connector-state.jar

11. Start the Identity Synchronization for Windows 6.0 Service Pack 1 services.
See Section 1.6.3, "Starting and Stopping Services."

12. Start synchronization.
See Section 1.6.2, "Starting and Stopping Synchronization."

4.5 Confirming the Installation

To confirm that the Identity Synchronization for Windows 6.0 Service Pack 1 installation has been successful, run the following command:

C:\Program Files\Sun\MPS\isw-win2k3-isw\bin\idsync -V

The output should be the same as the following:

common.jar    : 6 2009Q1_SP1 (ISW build id:2010.116.1643 built by svbld)
connector.jar : 6 2009Q1_SP1 (ISW build id:2010.116.1643 built by svbld)
install.jar   : 6 2009Q1_SP1 (ISW build id:2010.116.1643 built by svbld)
registry.jar  : 6 2009Q1_SP1 (ISW build id:2010.116.1643 built by svbld)
ui.jar        : 6 2009Q1_SP1 (ISW build id:2010.116.1643 built by svbld)
watchdog.jar  : 6 2009Q1_SP1 (ISW build id:2010.116.1643 built by svbld)
manager.jar   : 6 2009Q1_SP1 (ISW build id:2010.116.1643 built by svbld)

5 Installing From Scratch on Windows

This chapter provides instructions for installing Identity Synchronization for Windows 6.0 Service Pack 1 in a greenfield environment, an environment where no instance of Identity Synchronization for Windows already exists. This chapter contains the following sections:

- Creating Required Data Stores in Directory Server

- Obtaining the Identity Synchronization for Windows Software

- Preparing for Identity Synchronization for Windows Installation

- Installing the Software

- Checking the Software Version

5.1 Creating Required Data Stores in Directory Server

The LDAP directory used to store the Identity Synchronization for Windows configuration and synchronization data must be created and configured manually before you run the Identity Synchronization for Windows installer.

When creating tthis type of Directory Server instance, observe the following recommendations:

- Do not use an existing 5.2x Directory Server o=NetscapeRoot for the Identity Synchronization for Windows configuration data store. Create a new Directory Server that includes an instance of Identity Synchronization for Windows and is dedicated to Identity Synchronization for Windows configuration (o=NetscapeRoot ) and synchronization ( ou=isw_config) data stores.
For example, create a new ou=isw_config suffix, and then allow the Identity Synchronization for Windows administration console to create its own o=NetscapeRoot suffix on the same server during installation. Be sure to create a Top Entry when you create the new ou=isw_config suffix. When creating the ou=isw_config suffix using DSCC, on the "Step5 : Choose Data Options" page, choose "Create Top Entry for the suffix. "

There should be no exisisting o=NetscapeRoot suffix when installing the Identity Synchronization for Windows Java console.

- Configure the configuration data store so that the o=NetscapeRoot suffix that Identity Synchronization for Windows uses is not replicated with configuration changes from multiple management domains.

- The Identity Synchronization for Windows configuration suffix should not reside in a replicated suffix.  Use something like ou=isw_config as a root suffix.

- Avoid using anything other than o or ou notation for the Identity Synchronization for Windows configuration suffix. Using dc suffix notation can cause install to fail.

- The o=NetscapeRoot suffix must not be a parent of the ou=isw_config suffix.

- Use a non-standard root level suffix so it is not a part of user LDAP space.

For detailed steps, see "Creating Directory Sources" in "Chapter 4, Configuring Core Resources" of the Oracle Identity Synchronization for Windows 6.0 Installation and Configuration Guide.

5.2 Obtaining the Identity Synchronization for Windows Software

See Section 1.4, "Obtaining the Software as Part of Directory Server Enterprise Edition."

5.3 Preparing for Identity Synchronization for Windows Installation

1. Review the following sections of this document:

- Section 1.5, "Completing Pre-Installation Tasks"

- Section 3.3, "Known Issues in Identity Synchronization for Windows 6.0 Service Pack 1"

2. After you unzip the distribution file, the directory should contain the following components:

- HotFix-6.0SP1_COMBO_5_20110722 directory

- The Identity Synchronization for Windows 6.0 Service Pack 1 patch

- JDK 5.0_u29

- Message Queue 4.3

3. Install JDK 5.0_u29.
Install the packages available under the appropriate jdk directory.

Launch the .exe file.

4. Install Message Queue 4.3.
See Section 2.2, "Installing or Upgrading Sun Java System Message Queue." for detailed information.

5. Unpack the Identity Synchronization for Windows 6.0 Service Pack 1 binaries.
Change to the patch-id directory that corresponds to your platform and unzip the Identity Synchronization for Windows zip file.

For example:

C:\> cd 144592-01
C:\> unzip.exe isw.6.0.sp1.windows.zip

5.4 Installing the Software

Before You Begin. Manually stop the Application Server and Identity Syncrhonication for Windows services and consoles. See Section 1.6.2, "Starting and Stopping Synchronization" and Section 1.6.3, "Starting and Stopping Services."

1. Install the Identity Synchronization for Windows 6.0 Service Pack 1 Core.
For more information, see Chapter 3, Installing Core, in Oracle Identity Synchronization for Windows 6.0 Installation and Configuration Guide.

2. Install the HotFix-6.0SP1_COMBO_5_20110722 patch included within the 11.1.1.7.0 ODSEE release. Follow the instructions contained in the README file within the hotfix path. In summary:

1. Manually stop the Administration Server service.

2. Manually stop the Identity Synchronization for Windows service.

3. Close the Application Server and Identity Synchronization for Windows consoles.
Be sure to wait until all processes are stopped. This could take a full minute or more.

4. Launch the Install command without specifying any parameters.

3. Configure the Identity Synchronization for Windows 6.0 Service Pack 1 Core.
For more information, see Chapter 4, Configuring Core Resources, in Oracle Identity Synchronization for Windows 6.0 Installation and Configuration Guide.

4. Start the Identity Synchronization for Windows services.
See Section 1.6.3, "Starting and Stopping Services."

5. Start synchronization.
See Section 1.6.2, "Starting and Stopping Synchronization."

5.5 Checking the Software Version

To confirm that the Identity Synchronization for Windows 6.0 Service Pack 1 installation has been successful, run the following command:

C:\Program Files\Sun\MPS\isw-win2k3-isw\bin\idsync -V

The output should be the same as the following:

common.jar    : 6 2009Q1_SP1 (ISW build id:2010.116.1139 built by svbld)
connector.jar : 6.0SP1_COMBO_5_20110722 (ISW build id:2011.203.1459 built by pduc)
install.jar   : 6.0SP1_COMBO_5_20110722 (ISW build id:2011.203.1459 built by pduc)
registry.jar  : 6.0SP1_COMBO_5_20110722 (ISW build id:2011.203.1459 built by pduc)
ui.jar        : 6.0SP1_COMBO_5_20110722 (ISW build id:2011.203.1459 built by pduc)
watchdog.jar  : 6 2009Q1_SP1 (ISW build id:2010.116.1139 built by svbld)
manager.jar   : 6.0SP1_COMBO_5_20110722 (ISW build id:2011.203.1459 built by pduc)

Part III

Solaris Upgrade & Migration, and New Installation

Part III contains the following chapter:

- Chapter 6, "Migrating from Identity Synchronization for Windows 6.0 on Solaris"

- Chapter 7, "Installing From Scratch on Solaris"

6 Migrating from Identity Synchronization for Windows 6.0 on Solaris

When you migrate from Identity Synchronization for Windows 6.0, you first export the existing configuration and uninstall Identity Synchronization for Windows 6.0. Then you install Identity Synchronization for Windows 6.0 Service Pack 1 , and apply the configuration exported from Identity Synchronization for Windows 6.0. This chapter contains the following sections:

- Obtaining the Latest Identity Synchronization for Windows Release

- Preparing for Migration

- Uninstalling Identity Synchronization for Windows 6.0 Components

- Installing Identity Synchronization for Windows 6.0 Service Pack 1

- Confirming the Installation

6.1 Obtaining the Latest Identity Synchronization for Windows Release

See Section 1.4, "Obtaining the Software as Part of Directory Server Enterprise Edition."

6.2 Preparing for Migration

The following is a checklist of required tasks you must complete before you can successfully migrate Identity Synchronization for Windows 6.0 Service Pack 1 .

- Schedule an appropriate time for migration

- Disable the group synchronization and account lockout

- Unpack the Identity Synchronization for Windows 6.0 Service Pack 1 patch content

- Export the current Identity Synchronization for Windows 6.0 Service Pack 1 configuration setting to an XML file

- Add a clear text password to the exported configuration file

- Stop synchronization

- Verify that your system is in a quiescent state

- Stop the Identity Synchronization for Windows 6.0 Service Pack 1 services

- Save the connector states

- Start the Identity Synchronization for Windows 6.0 Service Pack 1 services

6.2.1 Schedule an appropriate time for migration

Schedule an appropriate time for migration.

Migration typically requires four to eight hours, depending on your system's performance and the configuration of Identity Synchronization for Windows 6.0 Service Pack 1 .

6.2.2 Disable the group synchronization and account lockout

You can use either the administration console or the command-line interface to complete these tasks.

6.2.2.1 Using the Administration Console

1. Open the administration console.
# /var/mps/serverroot/startconsole

2. Go to Configuration > Groups, and deselect the Enable Group Synchronization checkbox.

3. Go to Configuration > Account Lockout, and deselect the Enable Account Lockout Synchronization checkbox.

4. Click Save.

6.2.2.2 Using the Command-Line Interface

Use the idsync command in the following directory: /opt/SUNWisw/bin/idsync

To disable group synchronization:

# idsync groupsync -d -D  Directory-Manager-DN -w bind-password [-h Configuration-Directory-hostname] [-p Configuration-Directory-port-number] -s rootsuffix [-Z] -q configuration-password -t AD-group-type

To disable account lockout:

# idsync accountlockout -d -D  Directory-Manager_DN -w  bind-password -h Configuration Directory-hostname -p Configuration-Directory-port-number -s rootsuffix [-Z] [-P cert-db-path [-m secmod db path] -q configuration-password -t max-lockout-attempts

6.2.3 Unpack the Identity Synchronization for Windows 6.0 Service Pack 1 patch content

Unpack the Identity Synchronization for Windows 6.0 Service Pack 1 patch content which is located here: ODSEE_Identity_Synchronization_for_Windows/144590-01

# unzip isw.6.0.sp1.solaris.x86.zip

After the patch files are unzipped, the migration subdirectory contains the migration tools:

- export11cnf.jar

- checktopics.jar

6.2.4 Export the current Identity Synchronization for Windows 6.0 Service Pack 1 configuration setting to an XML file

Export the current Identity Synchronization for Windows 6.0 Service Pack 1 configuration setting to an XML file.

Change the current directory to migration and run the export11cnf.jar file with the following usage:

# java -jar export11cnf.jar -D bind_DN -w bind_password | -
[-h configuration_directory_hostname] [-p configuration_directory_port_number]
-s root_suffix [-Z] -q configuration_password | -
-f xml_configuration_filename_to_export

The following example shows a typical use:

# java -jar export11cnf.jar -D "cn=directory manager"
-w - -h "test.example.com" -p 389 -s "ou=isw_config" -q - -f export.cfg

6.2.5 Add a clear text password to the exported configuration file

Add clear text passwords to the exported configuration file.

Edit the exported configuration file, and enter a password between the double quotation marks for each of six cleartextPassword fields. You must provide three passwords for the Directory Server user, and three passwords for the Active Directory user.

6.2.6 Stop synchronization

You can either use the administration console, or run the idsync stopsync command. See Section 1.6.2, "Starting and Stopping Synchronization."

6.2.7 Verify that your system is in a quiescent state

Make sure that the current directory is migration, and run the checktopics.jar file with the following usage:

java -jar checktopics.jar -D bind_DN -w bind_password | -
[-h configuration_directory_hostname] [-p configuration_directory_port_number]
-s root_suffix [-Z] -q configuration_password | -

The following example shows a typical use:

java -jar checktopics.jar -D "cn=directory manager"
-w - -h "test.example.com" -p 389 -s "ou=isw_config" -q -

If the system is in a quiescent state, checktopics.jar displays the following message:

There are no synchronization messages currently in the Message Queue

If checktopics.jar does not display this message, follow these steps:

1. Restart synchronization. See Section 1.6.2, "Starting and Stopping Synchronization."

2. Wait until the synchronization messages are applied to the destination connector.

3. Stop synchronization again. See Section 1.6.2, "Starting and Stopping Synchronization."

4. Run the checktopics.jar file again.

6.2.8 Stop the Identity Synchronization for Windows 6.0 Service Pack 1 services

Stop the Identity Synchronization for Windows 6.0 Service Pack 1 services. See Section 1.6.3, "Starting and Stopping Services."

6.2.9 Save the connector states

Save the connector states by backing up the persist and etc directories from the existing 6.0 installation tree.

Change the current directory to the server_instance_root directory and run the following command:

$ tar cf /var/tmp/connector-state.tar persist etc

Note:

To identify the server_instance_root on Solaris systems, run:

pkginfo -l SUNWiswfc | grep BASEDIR

6.2.10 Start the Identity Synchronization for Windows 6.0 Service Pack 1 services

See Section 1.6.3, "Starting and Stopping Services."

6.3 Uninstalling Identity Synchronization for Windows 6.0 Components

Repeat the following procedure for each of the Identity Synchronization for Windows components installed on your system in this order: First uninstall Active Directory Connectors, then uninstall Directory Server Connectors and Plug-ins, and finally uninstall the Identity Synchronization for Windows Core.

Caution:

Before running the uninstaller, see Bug Number 6529349 in Chapter 3, "Known Bugs and Limitations."

1. Run the uninstaller located at /opt/SUNWisw/runUninstaller.sh.
If the installer fails with a "No DN entered" error, then run the installer in text mode the following way :

# /opt/SUNWisw/runUninstaller.sh -nodisplay

2. Provide the requested passwords.

3. Each time you run the uninstaller, remove only one component. If you remove more than one component at a time, results may be unpredicatable.

See "Chapter 9, Removing the Software" in Sun Java System Directory Server Enterprise Edition 6.0 Installation Guide for more information.

6.4 Installing Identity Synchronization for Windows 6.0 Service Pack 1

To install Identity Synchronization for Windows 6.0 Service Pack 1 complete these steps:

1. Prepare for installation as described in Section 7.3, "Preparing for Identity Synchronization for Windows Installation."

2. Install the Identity Synchronization for Windows 6.0 Service Pack 1 core, as described in Chapter 3, Installing Core, in Oracle Identity Synchronization for Windows 6.0 Installation and Configuration Guide.
When installation is complete, do not start the console. Proceed directly to the next step.

3. Install the HotFix-6.0SP1_COMBO_5_20110722 patch included within the 11.1.1.7.0 ODSEE release. Follow the instructions conainted in the README file within the hotfix path. For example on Solaris:

# unzip -q isw-generic.zip
# ./Install /opt/SUNWisw /var/mps/serverroot

4. To import your version 6.0 configuration XML file, run the idsync importcnf from the following path:
/opt/SUNWisw/bin/

# idsync importcnf -w admin_password -q configuration_password -f xml_configuration_filename_to_import

For more information about using idsync importcnf, see Using importcnf in Oracle Identity Synchronization for Windows 6.0 Installation and Configuration Guide.

5. (Optional) Install the group synchronization and deletion flow features as described in these sections:

- Specifying Configuration Settings for Group Synchronization in Oracle Identity Synchronization for Windows 6.0 Installation and Configuration Guide

- Specifying How Deletions Flow in Oracle Identity Synchronization for Windows 6.0 Installation and Configuration Guide

6. Install the Identity Synchronization for Windows 6.0 Service Pack 1 connectors as described in Chapter 5, Installing Connectors, in Oracle Identity Synchronization for Windows 6.0 Installation and Configuration Guide.

7. (Optional) Configure account lockout.

# cd /opt/SUNWisw/bin/idsync

# idsync accountlockout -d -D  Directory-Manager_DN -w  bind-password -h Configuration Directory-hostname -p Configuration-Directory-port-number -s rootsuffix [-Z] [-P cert-db-path [-m secmod db path] -q configuration-password -t max-lockout-attempts

8. Configure the Identity Synchronization for Windows 6.0 Service Pack 1 plug-in as described in "Using dspluginconfig " in theOracle Identity Synchronization for Windows 6.0 Installation and Configuration Guide.

9. Stop Identity Synchronization for Windows services. See Section 1.6.3, "Starting and Stopping Services."

10. Delete the Identity Synchronization for Windows 6.0 Service Pack 1 persist and etc directories and all their contents from the instance directory, and replace them with Identity Synchronization for Windows version 6.0 persist and etc directories that you backed up in Section 6.2.9, "Save the connector states".
On Solaris and Linux systems, use these commands:

# cd server-instance-root
# rm -rf etc persist
# tar xf /var/tmp/connector-state.tar

Note:

To identify the server_instance_root on Solaris systems, run:

# pkginfo -l SUNWiswfc | grep BASEDIR

11. Start the Identity Synchronization for Windows 6.0 Service Pack 1 services.
See Section 1.6.3, "Starting and Stopping Services."

12. Start synchronization.
See Section 1.6.2, "Starting and Stopping Synchronization."

6.5 Confirming the Installation

To confirm that the Identity Synchronization for Windows 6.0 Service Pack 1 installation has been successful, run the following command:

$/opt/sun/isw/bin/idsync -V

The output should be the same as the following:

common.jar    : 6 2009Q1_SP1 (ISW build id:2010.116.1643 built by svbld)
connector.jar : 6 2009Q1_SP1 (ISW build id:2010.116.1643 built by svbld)
install.jar   : 6 2009Q1_SP1 (ISW build id:2010.116.1643 built by svbld)
registry.jar  : 6 2009Q1_SP1 (ISW build id:2010.116.1643 built by svbld)
ui.jar        : 6 2009Q1_SP1 (ISW build id:2010.116.1643 built by svbld)
watchdog.jar  : 6 2009Q1_SP1 (ISW build id:2010.116.1643 built by svbld)
manager.jar   : 6 2009Q1_SP1 (ISW build id:2010.116.1643 built by svbld)

7 Installing From Scratch on Solaris

This chapter provides instructions for installing Identity Synchronization for Windows 6.0 Service Pack 1 in a greenfield environment, an environment where no instance of Identity Synchronization for Windows already exists. This chapter contains the following sections:

- Creating Required Data Stores in Directory Server

- Obtaining the Identity Synchronization for Windows Software

- Preparing for Identity Synchronization for Windows Installation

- Installing the Software

- Checking the Software Version

7.1 Creating Required Data Stores in Directory Server

The LDAP directory used to store the Identity Synchronization for Windows configuration and synchronization data must be created and configured manually before you run the Identity Synchronization for Windows installer.

When creating this type of Directory Server instance, observe the following recommendations:

- Do not use an existing 5.2x Directory Server o=NetscapeRoot for the Identity Synchronization for Windows configuration data store. Create a new Directory Server that includes an instance of Identity Synchronization for Windows and is dedicated to Identity Synchronization for Windows configuration (o=NetscapeRoot ) and synchronization ( ou=isw_config) data stores.
For example, create a new ou=isw_config suffix, and then allow the Identity Synchronization for Windows administration console to create its own o=NetscapeRoot suffix on the same server during installation. Be sure to create a Top Entry when you create the new ou=isw_config suffix. When creating the ou=isw_config suffix using DSCC, on the "Step5 : Choose Data Options" page, choose "Create Top Entry for the suffix. "

There should be no exisisting o=NetscapeRoot suffix when installing the Identity Synchronization for Windows Java console.

- Configure the configuration data store so that the o=NetscapeRoot suffix that Identity Synchronization for Windows uses is not replicated with configuration changes from multiple management domains.

- The Identity Synchronization for Windows configuration suffix should not reside in a replicated suffix.  Use something like ou=isw_config as a root suffix.

- Avoid using anything other than o or ou notation for the Identity Synchronization for Windows configuration suffix. Using dc suffix notation can cause install to fail.

- The o=NetscapeRoot suffix must not be a parent of the ou=isw_config suffix.

- Use a non-standard root level suffix so it is not a part of user LDAP space.

For detailed steps, see "Creating Directory Sources" in "Chapter 4, Configuring Core Resources" of the Oracle Identity Synchronization for Windows 6.0 Installation and Configuration Guide.

7.2 Obtaining the Identity Synchronization for Windows Software

See Section 1.4, "Obtaining the Software as Part of Directory Server Enterprise Edition."

7.3 Preparing for Identity Synchronization for Windows Installation

1. Review the following sections of this document:

- Section 1.5, "Completing Pre-Installation Tasks"

- Section 3.3, "Known Issues in Identity Synchronization for Windows 6.0 Service Pack 1"

2. After you unzip the distribution file, the directory should contain the following components:

- HotFix-6.0SP1_COMBO_5_20110722 directory

- The Identity Synchronization for Windows 6.0 Service Pack 1 patch

- JDK 5.0_u29

- Message Queue 4.3

3. Install the Network Security Services/Netscape Portable Runtime (NSS/NSPR) shared components.
You must install the NSS/NSPR packages and patch them to the appropriate level before you install Identity Synchronization for Windows.

On Solaris 10 you will install either the 119* or the 1253* patches, based on the version of the NSS and TLS packages already installed. For more information, see http://docs.oracle.com/cd/E19261-01/820-2761/upgrade-shared-comps/index.html in the Sun Java System Directory Server Enterprise Edition 6.3 Installation Guide .

On Solaris 9 systems, for each of the packages SUNWjss, SUNWpr, SUNWprd, SUNWtls, and SUNWtlsu type the following command:

# pkgparam -v pkgname VERSION PATCHLIST

If pkgname is not installed, obtain it as follows:

# pkgadd -d pkglocation pkgname

If PATCHLIST does not return the expected patch level, install the patch as follows:

# cd patchlocation
# patchadd patch-id

Note:

To determine the appropriate pkglocation and patchlocation for your platform, see Table 1-3, "Minimum Patch Level Requirements" .

4. Install JDK 5.0_u29.
Install the packages available under the appropriate jdk directory, for example, install-root/ODSEE_Identity_Synchronization_for_Windows/jdk.

Use the pkgadd command. For example:

# pkgadd -d . SUNWj5rt SUNWj5rtx SUNWj5man SUNWj5jmp SUNWj5dvx SUNWj5dmx SUNWj5dmo SUNWj5dev SUNWj5cfg

This will set the default JDK while keeping all other installed JDK versions available on the system.

See the /usr/jdk path for the paths and symbolic linking representing the current state of default JDK.

5. Install Message Queue 4.3.
See Section 2.2, "Installing or Upgrading Sun Java System Message Queue." for detailed information.

6. Unpack the Identity Synchronization for Windows 6.0 Service Pack 1 binaries.
Change to the patch-id directory that corresponds to your platform and unzip the Identity Synchronization for Windows zip file.

For example:

$ cd 144589-01
$ unzip isw.6.0.sp1.solaris.sparc.zip

7.4 Installing the Software

1. Set the DISPLAY environment variable to host:display.0
The graphic installer must not be run on a sub-display other than 0.

2. Install the Identity Synchronization for Windows 6.0 Service Pack 1 Core. When installation is complete, do not start the console.
For more information, see Chapter 3, Installing Core, in Oracle Identity Synchronization for Windows 6.0 Installation and Configuration Guide.

3. Install the HotFix-6.0SP1_COMBO_5_20110722 patch included within the 11.1.1.7.0 ODSEE release. Follow the instructions of the README file within the hotfix path. For example on Solaris:

# unzip -q isw-generic.zip
# ./Install /opt/SUNWisw /var/mps/serverroot

4. Configure the Identity Synchronization for Windows 6.0 Service Pack 1 Core.
For more information, see Chapter 4, Configuring Core Resources, in Oracle Identity Synchronization for Windows 6.0 Installation and Configuration Guide.

Tip:

If the console fails to start on Solaris 9, then set the following environment variable :

# export LD_LIBRARY_PATH=/usr/lib/mps/secv1:$LD_LIBRARY_PATH

5. Install the connectors.
For more information see "Chapter 5, Installing Connectors," in the Oracle Identity Synchronization for Windows 6.0 Installation and Configuration Guide.

6. Start the Identity Synchronization for Windows services.

# /etc/init.d/imq start
# /etc/init.d/isw start

7. Synchronize existing users and user groups.
See "Synchronizing Existing Users and User Groups" in the Oracle Identity Synchronization for Windows 6.0 Installation and Configuration Guide .

8. Start synchronization.
See Section 1.6.2, "Starting and Stopping Synchronization."

7.5 Checking the Software Version

To confirm that the Identity Synchronization for Windows 6.0 Service Pack 1 installation has been successful, run the following command:

$ /opt/SUNWisw/bin/idsync -V

The output should be the same as the following:

common.jar    : 6 2009Q1_SP1 (ISW build id:2010.116.1139 built by svbld)
connector.jar : 6.0SP1_COMBO_5_20110722 (ISW build id:2011.203.1459 built by pduc)
install.jar   : 6.0SP1_COMBO_5_20110722 (ISW build id:2011.203.1459 built by pduc)
registry.jar  : 6.0SP1_COMBO_5_20110722 (ISW build id:2011.203.1459 built by pduc)
ui.jar        : 6.0SP1_COMBO_5_20110722 (ISW build id:2011.203.1459 built by pduc)
watchdog.jar  : 6 2009Q1_SP1 (ISW build id:2010.116.1139 built by svbld)
manager.jar   : 6.0SP1_COMBO_5_20110722 (ISW build id:2011.203.1459 built by pduc)

Part IV

Linux Upgrade & Migration, and New Installation

Part I V contains the following chapters:

- Chapter 8, "Migrating from Identity Synchronization for Windows 6.0 on Linux"

- Chapter 9, "Installing From Scratch on Linux"

8 Migrating from Identity Synchronization for Windows 6.0 on Linux

When you migrate from Identity Synchronization for Windows 6.0, you first export the existing configuration and uninstall Identity Synchronization for Windows 6.0. Then you install Identity Synchronization for Windows 6.0 Service Pack 1 , and apply the configuration exported from Identity Synchronization for Windows 6.0. This chapter contains the following sections:

- Obtaining the Latest Identity Synchronization for Windows Release

- Preparing for Migration

- Uninstalling Identity Synchronization for Windows 6.0 Components

- Installing Identity Synchronization for Windows 6.0 Service Pack 1

- Confirming the Installation

8.1 Obtaining the Latest Identity Synchronization for Windows Release

See Section 1.4, "Obtaining the Software as Part of Directory Server Enterprise Edition."

8.2 Preparing for Migration

The following is a checklist of required tasks you must complete before you can successfully migrate Identity Synchronization for Windows 6.0 Service Pack 1 .

- Schedule an appropriate time for migration

- Disable the group synchronization and account lockout

- Unpack the Identity Synchronization for Windows 6.0 Service Pack 1 patch content

- Export the current Identity Synchronization for Windows 6.0 Service Pack 1 configuration setting to an XML file

- Add a clear text password to the exported configuration file

- Stop synchronization

- Verify that your system is in a quiescent state

- Exit the Console

- Stop the Identity Synchronization for Windows Daemons

- Save the connector states

8.2.1 Schedule an appropriate time for migration

Schedule an appropriate time for migration.

Migration typically requires four to eight hours, depending on your system's performance and the configuration of Identity Synchronization for Windows 6.0 Service Pack 1 .

8.2.2 Disable the group synchronization and account lockout

You can use either the administration console or the command-line interface to complete these tasks.

8.2.2.1 Using the Administration Console

1. Open the administration console.
# /var/Sun/mps/startconsole -x nologo

2. Open the Identity Synchronization for Windows administration window.

1. Open the appropriate server group.

2. Select the "Identity Synchronization for Windows" server.

3. Click on the Open button at the upper right.

3. Go to Configuration > Groups, and deselect the Enable Group Synchronization checkbox.

4. Go to Configuration > Account Lockout, and deselect the Enable Account Lockout Synchronization checkbox.

5. Click Save.

8.2.2.2 Using the Command-Line Interface

Use the idsync command in the following directory:

/opt/sun/isw/bin/

To disable group synchronization:

# idsync groupsync -d -D  Directory-Manager-DN -w bind-password [-h Configuration-Directory-hostname] [-p Configuration-Directory-port-number] -s rootsuffix [-Z] -q configuration-password -t AD-group-type

To disable account lockout:

# idsync accountlockout -d -D  Directory-Manager_DN -w  bind-password -h Configuration Directory-hostname -p Configuration-Directory-port-number -s rootsuffix [-Z] [-P cert-db-path [-m secmod db path] -q configuration-password -t max-lockout-attempts

8.2.3 Unpack the Identity Synchronization for Windows 6.0 Service Pack 1 patch content

Unpack the Identity Synchronization for Windows 6.0 Service Pack 1 patch content.

# unzip zipped_patch_file

To identify the zipped_patch_file for your installation, see Section 1.4.2, "Minimum Patch Level Requirements.".

After the patch files are unzipped, the migration subdirectory contains the migration tools:

- export11cnf.jar

- checktopics.jar

8.2.4 Export the current Identity Synchronization for Windows 6.0 Service Pack 1 configuration setting to an XML file

Change the current directory to migration and run the export11cnf.jar file with the following usage:

# java -jar export11cnf.jar -D bind_DN -w bind_password | -
[-h configuration_directory_hostname] [-p configuration_directory_port_number]
-s root_suffix [-Z] -q configuration_password | -
-f xml_configuration_filename_to_export

where root_suffix is the suffix where the Identity Synchronization for Windows configuration is stored.

The following example shows a typical use:

# java -jar export11cnf.jar -D "cn=directory manager"
-w - -h "test.example.com" -p 389 -s "ou=isw_config" -q - -f export.cfg

8.2.5 Add a clear text password to the exported configuration file

Add clear text passwords to the exported configuration file.

Edit the exported configuration file, and enter a password between the double quotation marks for each of six cleartextPassword fields. You must provide three passwords for the Directory Server user, and three passwords for the Active Directory user.

8.2.6 Stop synchronization

You can either use the administration console, or run the idsync stopsync command. See Section 1.6.2, "Starting and Stopping Synchronization."

8.2.7 Verify that your system is in a quiescent state

Make sure that the current directory is migration, and run the checktopics.jar file with the following usage:

java -jar checktopics.jar -D bind_DN -w bind_password | -
[-h configuration_directory_hostname] [-p configuration_directory_port_number]
-s root_suffix [-Z] -q configuration_password | -

The following example shows a typical use:

java -jar checktopics.jar -D "cn=directory manager"
-w - -h "test.example.com" -p 389 -s "ou=isw_config" -q -

If the system is in a quiescent state, checktopics.jar displays the following message:

There are no synchronization messages currently in the Message Queue

If checktopics.jar does not display this message, follow these steps:

1. Restart synchronization. See Section 1.6.2, "Starting and Stopping Synchronization.".

2. Wait until the synchronization messages are applied to the destination connector.

3. Stop synchronization again. See Section 1.6.2, "Starting and Stopping Synchronization."

4. Run the checktopics.jar file again.

8.2.8 Exit the Console

Be sure that the graphical administration console is not running.

8.2.9 Stop the Identity Synchronization for Windows Daemons

To stop the Identity Synchronization for Windows and Message Queue, run the following commands:

# /etc/init.d/isw stop
# /etc/init.d/imq stop

8.2.10 Save the connector states

Save the connector states by backing up the persist and etc directories from the existing 6.0 installation tree. For example:

# cd /var/opt/sun/isw
# tar cf /var/tmp/connector-state.tar persist etc

8.3 Uninstalling Identity Synchronization for Windows 6.0 Components

Complete the following procedures:

- Uninstall Identity Synchronization for Windows and Connectors

- Unconfigure the Administration Server

- Remove the Administration Server

- Remove Message Queue

- Edit the productregistry File

- Delete the Identity Synchronization for Windows Data from the Configuration Server

8.3.1 Uninstall Identity Synchronization for Windows and Connectors

Repeat the following procedure for each of the Identity Synchronization for Windows components installed on your system in this order: First uninstall Active Directory Connectors, then uninstall Directory Server Connectors and Plug-ins, and finally uninstall the Identity Synchronization for Windows Core.

1. Set the JAVA_HOME and LD_LIBRARY_PATH environment variables to use the Java release and shared libraries that come with Identity Synchronization for Windows:

# export JAVA_HOME=/usr/jdk/entsys-j2se/jre/
# export LD_LIBRARY_PATH=/opt/sun/private/lib/:/opt/sun/isw/lib/:$LD_LIBRARY_PATH

2. Run the uninstaller. For example:

# cd /opt/sun/isw
# ./uninstaller.sh

3. In the Welcome page, click Next.

4. In the "Uninstall: Configuration Location" page, choose "The configuration no longer exists or is corrupt," and then click Next.

5. In the "Uninstall: Component Selection" page, choose "Remove all local components," and then click Next.

6. Click Yes when the following Warning is displayed:
"Selecting this option will make Identity Synchronization for Windows unusable. If the Core install is local to this machine, you will have to manually uninstall any remote components and remove any remaining configuration artifacts from the configuration directory. Do you want to continue?"

7. Review the "Uninstall: Summary," and then click Close.

You can verify that all Identity Synchronization for Windows were removed by running the following command:

# rpm -qa | grep ^sun_isw

When all packaged have been removed, the command returns no results.

8.3.2 Unconfigure the Administration Server

Run the unconfigure command. For example:

# cd /var/Sun/mps/sbin
# ./mpsadmserver unconfigure

Provide information as prompted.

8.3.3 Remove the Administration Server

Run the following command:

# rpm -e sun-admin-server-5.2-18 sun-admin-server-man-5.2-8 sun-server-console-5.2-18

You can verify that the administration server packages are removed by running the following command :

# rpm -qa | grep sun.*server

When all packaged have been removed, the command returns no results.

8.3.4 Remove Message Queue

Run the following command:

# cd /var/sadm/prod/entsys
# ./uninstall

Provide information as prompted, choosing Sun Message Queue as the component to removed.

You can verify that all Identity Synchronization for Windows were removed by running the following command:

# rpm -qa | grep ^sun-mq

When all packaged have been removed, the command returns no results.

8.3.5 Edit the productregistry File

This step is a safeguard in case the uninstallation was unable to completely update the registry.

Inspect the /var/opt/sun/install/productregistry file. If any references to the following products exist, then remove the references:

- Identity Synchronization for Windows

- Message Queue

- Administration Server

8.3.6 Delete the Identity Synchronization for Windows Data from the Configuration Server

This step ensures that the configuration suffix no longer contains Identity Synchronization for Windows data. Use one of the following methods:

- If the configuration suffix contains only data related to Identity Synchronization for Windows, then recreate the suffix. For example, if the configuration data is stored under ou=isw_config:

# dsconf delete-suffix ou=isw_config
# dsconf create-suffix ou=isw_config

- If the configuration suffix contains data other than Identity Synchronization for Windows data, then first use the ldapsearch command to find Identity Synchronization for windows entiries in the suffix. Then use the ldapdelete command to delete the Identity Synchronization for Windows data.

8.4 Installing Identity Synchronization for Windows 6.0 Service Pack 1

1. Patch Identity Synchronization for Windows components. For example:

# cd ISW-6.0-SP-1-content/packages/RHELxxx/
# rpm -Uvh *

2. Upgrade to JDK 5.0_u29. For example:

# cd ISW-6.0-SP-1-content/jdk/
# rpm -Uvh jdk-1.5.0_29-fcs.i586.rpm

3. Install Message Queue 4.3. For example:

# export JAVA_HOME=/usr/java/jdk1.5.0_29/
# cd ISW-6.0-SP-1-content/mq4_3-installer/
# ./installer

4. Install Identity Synchronization for Windows core software. For example:

# cd ISW-6.0-SP-1-content/144591-01/installer
# ./installer.sh

Do not start the console once the installation is completed.

5. In the file /opt/sun/isw/bin/start_watchdog.sh, change the LD_LIBRARY_PATH. For example:

LD_LIBRARY_PATH=/opt/sun/private/lib:/opt/sun/isw/lib:$INSTALL_DIR/
lib:/usr/lib:$JAVA_HOME/jre/lib/i386/native_threads:$LD_LIBRARY_PATH

6. Unzip the isw-generic.zip file.

# unzip -q isw-generic.zip

7. Install the HotFix-6.0SP1_COMBO_5_20110722 patch included within the 11.1.1.7.0 ODSEE release. Follow the instructions contained in the README file within the hotfix path. For example:

# /etc/init.d/isw stop
# /var/Sun/mps/stop-admin
# ./Install /opt/sun/isw /var/Sun/mps/

8. Import the Identity Synchronization for Windows 6.0 configuration XML file. For example:

# cd /opt/sun/isw/bin
# ./idsync importcnf -w admin_password -q configuration_password -f xml_configuration_filename_to_import

The file xml_configuration_filename_to_import here is the file that was created when you ran the command java -jar export11cnf.jar. You can ignore any warnings or Java exceptions that are displayed.

9. Install the Directory Server Enterprise Edition connector. For example:

# cd ISW-6.0-SP-1-content/144591-01/installer
# ./installer.sh

10. Run the installer a second time, and install the Active Directory connector.

11. The data Directory Server must be restarted to enable the plugins.

12. Stop Identity Synchronization for Windows service daemons. For example:

# /etc/init.d/isw stop

13. Delete the Identity Synchronization for Windows 6.0 Service Pack 1 persist and etc directories.

# cd /var/opt/sun/isw/
# rm -rf etc/ persist/

14. Restore persist and etc backup directories. For example:

# tar xf /var/tmp/connector-state.tar

15. Start the Identity Synchronization for Windows 6.0 Service Pack 1 services. For example:

#  /etc/init.d/isw start

16. Start synchronization.
See Section 1.6.2, "Starting and Stopping Synchronization."

Note:

If the console fails with a Java exception and is unable to open the Identity Synchronization for Windows console, then set LD_LIBRARY_PATH first before starting the console. For example:

export LD_LIBRARY_PATH=/opt/sun/private/lib/:/opt/sun/isw/lib/

8.5 Confirming the Installation

To confirm that the Identity Synchronization for Windows 6.0 Service Pack 1 installation has been successful, run the following command:

$/opt/sun/isw/bin/idsync -V

The output should be the same as the following:

common.jar    : 6 2009Q1_SP1 (ISW build id:2010.116.1139 built by svbld)
connector.jar : 6.0SP1_COMBO_5_20110722 (ISW build id:2011.203.1459 built by pduc)
install.jar   : 6.0SP1_COMBO_5_20110722 (ISW build id:2011.203.1459 built by pduc)
registry.jar  : 6.0SP1_COMBO_5_20110722 (ISW build id:2011.203.1459 built by pduc)
ui.jar        : 6.0SP1_COMBO_5_20110722 (ISW build id:2011.203.1459 built by pduc)
watchdog.jar  : 6 2009Q1_SP1 (ISW build id:2010.116.1139 built by svbld)
manager.jar   : 6.0SP1_COMBO_5_20110722 (ISW build id:2011.203.1459 built by pduc)

9 Installing From Scratch on Linux

This chapter provides instructions for installing Identity Synchronization for Windows 6.0 Service Pack 1 in a greenfield environment, an environment where no instance of Identity Synchronization for Windows already exists. This chapter contains the following sections:

- Creating Required Data Stores in Directory Server

- Obtaining the Identity Synchronization for Windows Software

- Preparing for Identity Synchronization for Windows Installation

- Installing the Software

- Checking the Software Version

9.1 Creating Required Data Stores in Directory Server

The LDAP directory used to store the Identity Synchronization for Windows configuration and synchronization data must be created and configured manually before you run the Identity Synchronization for Windows installer.

When creating this type of Directory Server instance, observe the following recommendations:

- Do not use an existing 5.2x Directory Server o=NetscapeRoot for the Identity Synchronization for Windows configuration data store. Create a new Directory Server that includes an instance of Identity Synchronization for Windows and is dedicated to Identity Synchronization for Windows configuration (o=NetscapeRoot ) and synchronization (ou=isw_config) data stores.
For example, create a new ou=isw_config suffix, and then allow the Identity Synchronization for Windows administration console to create its own o=NetscapeRoot suffix on the same server during installation. Be sure to create a Top Entry when you create the new ou=isw_config suffix. When creating the ou=isw_config suffix using DSCC, on the "Step5 : Choose Data Options" page, choose "Create Top Entry for the suffix. "

There should be no exisisting o=NetscapeRoot suffix when installing the Identity Synchronization for Windows Java console.

- Configure the configuration data store so that the o=NetscapeRoot suffix that Identity Synchronization for Windows uses is not replicated with configuration changes from multiple management domains.

- The Identity Synchronization for Windows configuration suffix should not reside in a replicated suffix.  Use something like ou=isw_config as a root suffix.

- Avoid using anything other than o or ou notation for the Identity Synchronization for Windows configuration suffix. Using dc suffix notation can cause install to fail.

- The o=NetscapeRoot suffix must not be a parent of the ou=isw_config suffix.

- Use a non-standard root level suffix so it is not a part of user LDAP space.

For detailed steps, see "Creating Directory Sources" in "Chapter 4, Configuring Core Resources" of the Oracle Identity Synchronization for Windows 6.0 Installation and Configuration Guide.

9.2 Obtaining the Identity Synchronization for Windows Software

See Section 1.4, "Obtaining the Software as Part of Directory Server Enterprise Edition."

9.3 Preparing for Identity Synchronization for Windows Installation

1. Review the following sections of this document:

- Section 1.5, "Completing Pre-Installation Tasks"

- Section 3.3, "Known Issues in Identity Synchronization for Windows 6.0 Service Pack 1"

2. After you unzip the distribution file, the directory should contain the following components:

- HotFix-6.0SP1_COMBO_5_20110722

- The Identity Synchronization for Windows 6.0 Service Pack 1 patch

- JDK 5.0_u29

- Message Queue 4.3

3. Install JDK 5.0_u29.
Install the packages available under the appropriate jdk directory:

# cd ISW-6.0-SP-1-content/jdk/
# rpm -Uvh jdk-1.5.0_29-fcs.i586.rpm

4. Install or update Identity Synchronization for Windows components.

# cd ISW-6.0-SP-1-content/packages/RHELxxx/
# rpm -Uvh *

5. Install Message Queue 4.3.

# export JAVA_HOME=/usr/java/jdk1.5.0_29/
# cd ISW-6.0-SP-1-content/mq4_3-installer/
# ./installer

6. Unpack the Identity Synchronization for Windows 6.0 Service Pack 1 binaries.
Change to the patch-id directory that corresponds to your platform and unzip the Identity Synchronization for Windows zip file.

For example,

$ cd 144591-01
$ unzip -q isw.6.0.sp1.linux.zip

9.4 Installing the Software

1. Update Java and install JSS.

1. Run the installpatch command from the 121656-26 directory (Red Hat 4.0).

2. Depending upon your platform, run rpm -Uvh sun-jss-4.3.2-4.i386.rpm or rpm -Uvh sun-jss-4.3.2-4.x86_64.rpm.

2. Set the DISPLAY environment variable to host:display.0
The graphic installer must not be run on a sub-display other than 0.

3. Set the JAVA_HOME environment variable to Java 1.5.0_29 at minimum.

4. Set the following environment variable:

export LD_LIBRARY_PATH=/opt/sun/private/lib:$LD_LIBRARY_PATH

5. Install the Identity Synchronization for Windows 6.0 Service Pack 1 Core.

# cd ISW-6.0-SP-1-content/144591-01/installer
# ./installer.sh

Follow the instructions in Chapter 3, Installing Core, in Oracle Identity Synchronization for Windows 6.0 Installation and Configuration Guide.

Note:

When installation is finished, do not start the console .

6. Unzip the isw-generic.zip file.

# unzip -q isw-generic.zip

7. Install the HotFix-6.0SP1_COMBO_5_20110722 patch included within the 11.1.1.7.0 ODSEE release. For example:
# ./Install /opt/sun/isw /var/Sun/mps/

8. Configure the Identity Synchronization for Windows 6.0 Service Pack 1 Core.

Note:

At the end of the installation, be sure to start the console with the -x nologo option. For example:

# /var/Sun/mps/startconsole -x nologo

Otherwise, the console might freeze at the splash screen.

For more information, see Chapter 4, Configuring Core Resources, in Oracle Identity Synchronization for Windows 6.0 Installation and Configuration Guide.

9. Start the Identity Synchronization for Windows services. For example:

# /etc/init.d/imq start
# /etc/init.d/isw start

10. Start synchronization.
See Section 1.6.2, "Starting and Stopping Synchronization."

9.5 Checking the Software Version

To confirm that the Identity Synchronization for Windows 6.0 Service Pack 1 installation has been successful, run the following command:

$/opt/sun/isw/bin/idsync -V

The output should be the same as the following:

mcommon.jar   : 6 2009Q1_SP1 (ISW build id:2010.116.1139 built by svbld)
connector.jar : 6.0SP1_COMBO_5_20110722 (ISW build id:2011.203.1459 built by pduc)
install.jar   : 6.0SP1_COMBO_5_20110722 (ISW build id:2011.203.1459 built by pduc)
registry.jar  : 6.0SP1_COMBO_5_20110722 (ISW build id:2011.203.1459 built by pduc)
ui.jar        : 6.0SP1_COMBO_5_20110722 (ISW build id:2011.203.1459 built by pduc)
watchdog.jar  : 6 2009Q1_SP1 (ISW build id:2010.116.1139 built by svbld)
manager.jar   : 6.0SP1_COMBO_5_20110722 (ISW build id:2011.203.1459 built by pduc)

Index

A  C  D  E  I  L  M  R  S

A

arguments

stopsync, 1.6.2.2.2

C

central log directories, Preface

certificate database

default path, Preface

consoles

starting/stopping synchronization, 1.6.2.1

D

daemons

starting/stopping, 1.6.3

E

examples

idsync startsync command, 1.6.2.2.1

idsync stopsync command, 1.6.2.2.2

I

idsync startsync

arguments, 1.6.2.2

description, 1.6.2.2

syntax, 1.6.2.2

idsync stopsync

arguments, 1.6.2.2.2

description, 1.6.2.2.2

syntax, 1.6.2.2.2

install-path, Preface instance-path, Preface isw- hostname directory, Preface

L

local log directory, Preface

M

Message Queue, Preface

R

restarting

synchronization, 1.6.2

S

serverroot directory, Preface

services

starting/stopping, 1.6.2.1, 1.6.3

synchronization, 1.6.2.1

starting

daemons, 1.6.3

services, 1.6.3

synchronization, 1.6.3

startsync subcommand

arguments, 1.6.2.2

description, 1.6.2.2

syntax, 1.6.2.2

stopping

daemons, 1.6.3

services, 1.6.3

synchronization, 1.6.2.2.2, 1.6.3

stopsync subcommand

arguments, 1.6.2.2.2, 1.6.2.2.2

syntax, 1.6.2.2.2

subcommands

startsync, 1.6.2.2

stopsync, 1.6.2.2.2

synchronization

restarting, 1.6.2

starting/stopping, 1.6.2, 1.6.2.1, 1.6.2.1, 1.6.3

stopping, 1.6.2.2.2

syntax

idsync startsync command, 1.6.2.2.1

idsync stopsync command, 1.6.2.2.2

Copyright © 2001, 2013, Oracle and/or its affiliates. All rights reserved.