Server Troubleshooting Guide

Transcription

1 IBM Tioli Identity Manager Serer Troubleshooting Guide Version 4.5 SC

2

3 IBM Tioli Identity Manager Serer Troubleshooting Guide Version 4.5 SC

4 Note: Before using this information and the product it supports, read the information in Notices, on page 57. Second Edition (September 2003) This edition applies to ersion of Tioli Identity Manager (product number 5724-C34) and to all subsequent releases and modifications until otherwise indicated in new editions. Copyright International Business Machines Corporation All rights resered. US Goernment Users Restricted Rights Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

5 Contents Preface Who Should Read This Book Publications Tioli Identity Manager Serer Library.... Prerequisite Product Publications......i Related Publications i Accessing Publications Online ii Accessibility ii Contacting Software Support ii Conentions Used in This Book iii Chapter 1. Troubleshooting Using Information in Eent Log Files Installation Log Audit trail in Web User Interface Tioli Identity Manager Serer Log Application Serer Log Web Serer Access Log Directory and Database Serer Log Common Problems Installation and Start-up Problems Logon Failures Web Browser Problems Internal Serer Errors WebLogic-specific Problems Data Input Problems Remote Communication Problems Problems Miscellaneous Problems Chapter 2. Tioli Identity Manager LDAP Schema Tioli Identity Manager LDAP Directory Tree...24 General Tioli Identity Manager Classes erbppersonitem erbporg erbporgitem erdictionary erdictionaryitem erformtemplate eridentityexclusion erlocationitem ermanageditem erorganizationitem erorgunititem erpersonitem errole ersecuritydomainitem SecurityDomain ertenant erworkflowdefinition Serice Classes eraccountitem erattributeconstraint erchallenges erdsmlinfoserice erdsml2serice erdynamicrole erhostedaccountitem erhostedserice erhostselectionpolicy eritimserice erjoindirectie erobjectcategory erobjectprofile erremotesericeitem ersericeitem ersericeprofile ersystemitem ersystemrole ersystemuser Policy Classes eridentitypolicy erpasswordpolicy erpolicybase erpolicyitembase erproisioningpolicy Chapter 3. Database Tables Workflow Tables PROCESS Table PROCESSLOG Table PROCESSDATA Table ACTIVITY Table WORKITEM Table PASSWORD_TRANSACTION Table NEXTVALUE Table PENDING Table Serices Tables RESOURCE_PROVIDERS Table REMOTE_SERVICES_REQUESTS Table REMOTE_RESOURCES_RECONS Table REMOTE_RESOURCES_RECON_QUERIES Table 53 SCHEDULED_MESSAGE Table LISTDATA Table Appendix. Notices Trademarks Glossary Index Copyright IBM Corp iii

6 i IBM Tioli Identity Manager: Serer Troubleshooting Guide

7 Preface Who Should Read This Book Publications The IBM Tioli Identity Manager Troubleshooting Guide helps administrators to troubleshoot problems. This guide enables adminstrators to quickly look up Tioli Identity Manager schema and IBM DB2 table information related to the Tioli Identity Manager Serer. This manual is intended for system and security administrators who install, maintain, or administer software on their site s computer systems. Readers are expected to understand system and security administration concepts. Additionally, the reader should understand administration concepts for the following: Directory serer Database serer WebSphere embedded messaging support WebSphere Application Serer or WebLogic IBM HTTP Serers Read the descriptions of the Tioli Identity Manager library, the prerequisite publications, and the related publications to determine which publications you might find helpful. After you determine the publications you need, refer to the instructions for accessing publications online. Tioli Identity Manager Serer Library The publications in the Tioli Identity Manager Serer library are: Online user assistance for Tioli Identity Manager Proides integrated online help topics for all Tioli Identity Manager administratie tasks. Separate ersions of Tioli Identity Manager Serer Installation Guide on either UNIX or Windows, using either WebSphere or WebLogic. Use the ersion appropriate for your site. Proides installation information for Tioli Identity Manager. Tioli Identity Manager Policy and Organization Administration Guide Proides topics for Tioli Identity Manager administratie tasks. Tioli Identity Manager Serer Configuration Guide Proides configuration information for single-serer and cluster Tioli Identity Manager configurations. Tioli Identity Manager End User Guide Proides beginning user information for Tioli Identity Manager. Tioli Identity Manager Release Notes Proides software and hardware requirements for Tioli Identity Manager, and additional fix, patch, and other support information. Tioli Identity Manager Troubleshooting Guide Copyright IBM Corp. 2003

8 Proides additional problem soling information for the Tioli Identity Manager product. Prerequisite Product Publications To use the information in this book effectiely, you must hae knowledge of the products that are prerequisites for Tioli Identity Manager. Publications are aailable from the following locations: WebSphere Application Serer Note: The following brief list of Redbooks describes installing and configuring WebSphere Application Serer and proiding additional security. Although the list was current when this publication went to production, publications may become obsolete. Contact your customer representatie for a recommended list of resource information. IBM WebSphere Application Serer V5.0 System Management and Configuration, an IBM Redbook IBM WebSphere Application Serer V5.0 Security, an IBM Redbook WebLogic Application Serer Database serers IBM DB2 Oracle Microsoft SQL Serer Directory serer applications IBM Directory Serer Sun ONE Directory Serer WebSphere embedded messaging support (or IBM MQSeries) Web Proxy Serer IBM HTTP Serer Microsoft IIS HTTP Serer Apache HTTP Serer Related Publications Information related to Tioli Identity Manager Serer is aailable in the following publications: i IBM Tioli Identity Manager: Serer Troubleshooting Guide

9 Accessibility The Tioli Software Library proides a ariety of Tioli publications such as white papers, datasheets, demonstrations, redbooks, and announcement letters. The Tioli Software Library is aailable on the Web at: The Tioli Software Glossary includes definitions for many of the technical terms related to Tioli software. The Tioli Software Glossary is aailable, in English only from the Glossary link on the left side of the Tioli Software Library Web page: Accessing Publications Online The IBM publications for this product are aailable online in Portable Document Format (PDF) or Hypertext Markup Language (HTML) format, or both at the Tioli Software Library: Contacting Software Support To locate product publications in the library, click the Product manuals link on the left side of the Library page. Then, locate and click the name of the product on the Tioli Software Information Center page. Product publications include release notes, installation guides, user s guides, administrator s guides, and deeloper s references. Note: To ensure proper printing of PDF publications, select the Fit to page check box in the Adobe Acrobat Print window (which is aailable when you click File Print). The product documentation includes the following features to aid accessibility: Documentation is aailable in both HTML and PDF formats to gie the maximum opportunity for users to apply screen-reader software. All images in the documentation are proided with alternatie text so that users with ision impairments can understand the contents of the images. Before contacting IBM Tioli Software support with a problem, refer to the IBM Tioli Software support Web site at: If you need additional help, contact software support using the methods described in the IBM Software Support Guide at the following Web site: This guide proides the following information: Registration and eligibility requirements for receiing support Telephone numbers, depending on the country in which you are located A list of information you should gather before contacting customer support Preface ii

10 Conentions Used in This Book This reference uses seeral conentions for special terms and actions and for operating system-dependent commands and paths. The following typeface conentions are used in this book: Bold Monospace italic Bold text indicates selectable window buttons, field entries, and commands appearing in this manual except from within examples or the contents of files. Text in monospace type indicates the contents of files, file names or the output from commands. Italic text indicates context-specific alues such as: path names file names user names group names system parameters enironment ariables % The percent sign (%) indicates the C shell screen prompt as part of examples included in this manual. Your system s C shell screen prompt may be different. # The pound sign (#) represents the screen prompt shown to users logged in as superusers (root access). iii IBM Tioli Identity Manager: Serer Troubleshooting Guide

11 Chapter 1. Troubleshooting Tioli Identity Manager allows you to use a logging feature to help identify where failures occur within the system. This chapter describes the different types of eent log files and lists a set of common problems and solutions. Topic index: Using Information in Eent Log Files on page 1 Common Problems on page 4 Using Information in Eent Log Files Tioli Identity Manager has logging features that log the eents during specific transactions. This facilitates isolating and debugging the problem. There are seeral types of logging aailable with the use of the runconfig utility: Installation log Audit trail in the Web user interface Tioli Identity Manager Serer log Application serer log Web serer access log Directory and database serer logs Standard Tioli Identity Manager logging properties are located in the enrolelogging.properties file. Tioli Identity Manager uses the Log4J libraries and has expanded logging capabilities. For more information about the features using the Log4J libraries, refer to and follow the link to the Log4J project. For more information about the Tioli Identity Manager logging properties, refer to the Tioli Identity Manager Serer Configuration Guide. Installation Log Verbose logging to the console can be enabled to the installer and configuration programs (DBConfig, LdapConfig, and RunConfig) during installation. To enable logging during installation, type the following at the prompt: UNIX (AIX and Solaris): # LAX_DEBUG=true # export LAX_DEBUG Windows: MSDOS> set LAX_DEBUG = true Note: These commands should be run using the administrator account. The administrator account should use a Bourne shell or Windows command prompt. Installation log files are stored at <ITIM_HOME>/install_logs directory. Audit trail in Web User Interface The audit trail in the web user interface can be helpful in tracking down problems with agent communication, policy enforcement, and request approal. This logging Copyright IBM Corp

12 option is accessible from the Tioli Identity Manager user interface. Refer to the Tioli Identity Manager Policy and Organization Administration Guide for more information on setting the audit log option. For example, if you request a new account for a serice where a Tioli Identity Manager Agent is currently not running, a message is displayed in the web user interface indicating that the connection was refused. Tioli Identity Manager Serer Log The Tioli Identity Manager Serer logs requests to the command line and can log requests made directly to the console. This can detect problems such as the JAVA_HOME ariable being set incorrectly and other enironment problems. The serer log file is located at: WebSphere: <WAS_HOME>/logs/itim.log WebLogic: <BEA_HOME>/user_projects/itim/logs Refer to the Tioli Identity Manager Serer Configuration Guide for more information on configuring the Tioli Identity Manager Serer log. Application Serer Log The log files of the application serer used by Tioli Identity Manager (WebSphere Application Serer or WebLogic Application Serer) can proide useful troubleshooting information. The serer log files are located at: WebSphere: <WAS_HOME>/logs WebLogic: <BEA_HOME>/user_projects/itim/logs Refer to the IBM Tioli Identity Manager Serer Configuration Guide for more information on configuring the Tioli Identity Manager Serer log. Web Serer Access Log The HTTP proxy serer tracks all HTTP and HTTPS requests made from clients. For the IBM HTTP Serer refer to the IBM HTTP Serer documentation for more information. Go to the following Web site: For the Microsoft Internet Information Serices (IIS) HTTP Serer, refer to the Microsoft IIS documentation for more information. Go to the following Web site: 2 IBM Tioli Identity Manager: Serer Troubleshooting Guide

13 For the Apache HTTP Serer, refer to the Apache HTTP Serer documentation for more information. Go to the following Web site: Directory and Database Serer Log The directory serer (IBM Directory Serer or Sun ONE Directory Serer) logs directory requests into separate log files. The location of these files are specified when you install the directory serer. The database serer (IBM DB2 UDB, Oracle 8i Database, or Microsoft SQLSerer) logs database requests into their own log files. The location of these files are specified when you install the database serer. Chapter 1. Troubleshooting 3

14 Common Problems There are seeral classes of frequently encountered system problems that may arise when setting up and operating Tioli Identity Manager: Installation and Start-up Problems on page 5 Logon Failures on page 8 Web Browser Problems on page 12 Internal Serer Errors on page 13 WebLogic-specific Problems on page 14 Data Input Problems on page 15 Remote Communication Problems on page 16 Problems on page 18 Miscellaneous Problems on page 19 The following sections describe the issues that can occur and how to deal with them. 4 IBM Tioli Identity Manager: Serer Troubleshooting Guide

15 Installation and Start-up Problems This section describes commonly encountered installation and start-up problems. The following is a list of common installation and start-up problems: Problem: Cannot Install the Serer on page 5 Problem: Database or LDAP Configuration Program Appears to stop on page 5 Problem: Missing E-fix PQ76707 on page 5 Problem: Installation Fails to Install enrole.ear File on page 5 Problem: Cannot Start the Serer on page 6 Problem: Serer Appears to Start but Cannot Log In To Serer on page 6 Problem: Datasource Connection Error on page 7 Problem: Cannot Install the Serer If you cannot install the Tioli Identity Manager Serer, enable installation logging and check the log. Check the following: $DISPLAY ariables Authorization to the X serer File permissions Disk capacity A common mistake is to log into the desktop, switch to another user, and try to install the Tioli Identity Manager Serer without enabling X serer permission and setting the $DISPLAY ariable. The <JAVA_HOME> directory could be incorrectly set or be using the wrong ersion of the JDK. Verify that the <JAVA_HOME> directory is correct and that the JDK is ersion Problem: Database or LDAP Configuration Program Appears to stop If the database or LDAP configuration program appears to stop, try to minimize the configuration UI windows and other windows. Configuration may hae been completed and the secondary pop-up window may be hiding behind other windows. Problem: Missing E-fix PQ76707 Show to support only: DeTrack # During installation, an installation dialog reports that the system does not hae WebSphere Application Serer e-fix PQ76707 installed. The dialog incorrectly lists e-fix PQ The correct e-fix to apply is PQ Problem: Installation Fails to Install enrole.ear File Configuration: Tioli Identity Manager with WebSphere Application Serer base If the enrole.ear file fails to install during installation, a popup window will appear informing you of the failure and the installation will continue. Howeer, the application will not start and you will not be able to log on to Tioli Identity Manager because the application failed to install properly. To correct the problem, complete the following procedures: 1. Open a command prompt window on the system that failed to install the enrole.ear file. 2. Change to the <ITIM_HOME>/bin directory. Chapter 1. Troubleshooting 5

16 3. Execute the SetupEnrole application with the install parameter. The following line is an example of the command to execute: <ITIM_HOME>/bin> SetupEnrole install This will install the enrole.ear file in the proper directory. 4. Log on to the WebSphere Application Serer Network Deployment Manager and open the admin console. 5. Verify that the changes are seen by the Network Deployment Manager by selecting Enironment->Update Web Serer Plugin. 6. Sae and synchronize the changes with all nodes. 7. Start the Tioli Identity Manager Serer by selecting Enrole under Enterprise Applications in the admin console and click Start. Problem: Cannot Start the Serer If you cannot start the Tioli Identity Manager Serer, enable logging to the console. Use the following command to check whether there any of the processes started: ps -ef grep jaa If none of the processes hae started, check the enironment ariables, including the <JAVA_HOME> directory, and <ITIM_HOME> directory in the startserer file. Also, erify that the log is owned by the Tioli Identity Manager user account and not the root account. If the log is owned by the root account, the system will not be able to start from the Tioli Identity Manager user account. If the Tioli Identity Manager Serer did start, check the serer log for errors and check file permissions. If the serer does not hae permission to read library files, the serer will fail. If the serer is started with a user other than root, it will not be able to listen for connection requests on ports 80 and 443. Problem: Serer Appears to Start but Cannot Log In To Serer If you receie the following error message when starting an Tioli Identity Manager Serer, you may not hae the correct system configuration or you may hae a corrupt file....configurationwarning: No serer target found for application, enrole... To resole this exception, complete the following procedures. Be sure to stop and start the Tioli Identity Manager Serer after each procedure to test whether the problem has been fixed. 1. Source the db2profile file. If the node agents in the cluster are started before the db2profile is sourced, the WebSphere-based applications cannot connect to the data source and throw an Unsatisfied Link exception. To source the db2profile, complete the following procedures: a. Logon to the machine with the IBM DB2 Serer. b. Type the following command in a command prompt window: #. /db2instancehome/sqllib/db2profile c. Verify that the profile was sourced by typing the following command in the command prompt window: # set grep -i db2 If the db2profile file was sourced successfully, you will see a display similar to the following: 6 IBM Tioli Identity Manager: Serer Troubleshooting Guide

17 CLASSPATH=/home/db2inst1... DB2DIR=/usr/lpp/db2_07_01 DB2INSTANCE=db2inst1 2. Update the httpd.conf file to pick up the plugin-cfg.xml file from the Network Deployment Manager. To update the httpd.conf file, complete the following procedures: a. Back up the httpd.conf file. The httpd.conf file is located in the http_serer/conf directory. b. Open the httpd.conf file in a text editor. c. Add the following lines to the end of the file: #WebSphere plugin settings LoadModule ibm_app_serer_http_module <WAS_HOME>/bin/mod_ibm_app_serer_http.so WebSpherePluginConfig <WAS_NDM_HOME>/config/cells/plugin-cfg.xml d. Sae and close the file. 3. Uninstall and re-install the enrole.ear file on the WebSphere Administration Console. Refer to the WebSphere documentation for detailed information on using the WebSphere Administration Console. 4. Edit the serer.xml file in the <WAS_HOME>/DeploymentManager/config/cells/<Network_Name>/nodes directory to correctly refer to the cluster names. The serer.xml file may be corrupt and incorrectly refer to the cluster names. To correct this issue, complete the following procedures: a. Back up the serer.xml file. b. Open the serer.xml file in a text editor. c. Find the line that begins with xmi:id="serer_1" in the process:serer tag. For example: xmi:id="serer_1" name="serer1" clustername="mycluster" d. Modify the clustername alue to match the name of your cluster. If clustername is not an existing attribute, add the clustername attribute and its corresponding alue to the end of the line. e. Sae and close the file. Problem: Datasource Connection Error Configuration: Tioli Identity Manager using WebSphere Application Serer After installing Tioli Identity Manager, it is recommended that you test the JDBC drier connections using the WebSphere Administration Console. While checking the datasource connections, if the connection fails, you will see the following error if the ariables.xml file is missing: jaa.io.filenotfoundexception:<websphere_home>/config/cells/itimmix45cell/nodes/ <serername>/serers/<serername>/ariables.xml If you encounter this error, you will need to create a ariables.xml file for the node that returns the error. Complete the following procedures to create this file: 1. Log on to the WebSphere Application Serer Network Deployment Manager and open the admin console, if it is not already open. 2. Go to the Enironment -> Manage WebSphere Variables menu. 3. Select the node and serer scope for the serer with the connection problem. 4. Create a new dummy ariable. Creating a dummy ariable creates a ariables.xml file for the selected serer. Chapter 1. Troubleshooting 7

18 Logon Failures You may not be able to log on to Tioli Identity Manager for a ariety of reasons. For example, you may be using a non-supported web browser. For a list of supported browsers, refer to the Tioli Identity Manager Release Notes. A number of other processes may also impact your access to Tioli Identity Manager. The following is a list of commonly encountered problems that can cause logging on to Tioli Identity Manager to fail: Problem: Required Processes Are Not Running on page 8 Problem: Initial Logon and Change Password Fails on page 10 Problem: Required Processes Are Not Running To determine if required, WebSphere-related processes are running, check the following: Is the HTTP serer running? on page 8 Is WebSphere Application Serer (serer1) Running? on page 8 Is WebSphere Embedded Messaging Support Running? on page 8 Is the Directory Serer Running? on page 9 Is the HTTP serer running?: # ps -ef grep httpd Is the HTTP serer running? Type the following: You should obsere that approximately a half dozen HTTP processes are running. To start the HTTP serer, type the following: AIX: /usr/ibmhttpserer/bin/apachectl start Solaris: /opt/ibmhttpserer/bin/apachectl start Is WebSphere Application Serer (serer1) Running?: Application Serer running? Type the following: <WAS_INSTALLDIR>/sererStatus.sh -all Is the serer1 WebSphere You should obsere a serer1 jaa process running. If not found, start the process by typing: <WAS_INSTALLDIR>/bin/startSerer.sh serer1 Additionally, examine the <WAS_INSTALLDIR>/logs/serer1 and <WAS_INSTALLDIR>/logs/itim.log files for entries that indicate the startup status of serer1. Is WebSphere Embedded Messaging Support Running?: WebSphere embedded messaging support must be running. The following WebSphere MQ commands are useful to determine problems with the WebSphere embedded messaging support used in cluster configurations. For additional information, refer to the WebSphere MQ administration information proided by the WebSphere Application Serer. dspmq Displays the queue manager for WebSphere Application Serer. For example: QMNAME(WAS_hostname_serer1) STATUS(Running) runmqsc qmgrname Starts the IBM MQSeries script tool. Within this enironment, you can issue subcommands such as DISPLAY QMGR. 8 IBM Tioli Identity Manager: Serer Troubleshooting Guide

19 Use DISPLAY QUEUE(*) for queue details. Use CURDEPTH to display the number of messages in the queue. Compare the alue of CURDEPTH and MAXDEPTH to determine if the queue is full, which indicates the messages in the queue are not being processed. Is the Directory Serer Running?: This section describes how to determine whether or not the installed directory serer for Tioli Identity Manager is running. IBM Directory Serer (WebSphere only) Sun ONE Directory Serer IBM Directory Serer (WebSphere only): Determine if an IBM Directory Serer process is running by typing the following on the computer on which the directory serer is installed: # ps -ef grep slapd If IBM Directory Serer is running, a process ID (PID) number is returned. If a PID number is not returned, start the process by typing: AIX: /usr/bin/slapd Solaris: /opt/bin/slapd where slapd is one of the following: IBM Directory Serer ersion 4.1: slapd IBM Directory Serer ersion 5.1: ibmslapd Type the following again: ps -ef grep slapd. You should obsere a process ID for IBM Directory Serer. Sun ONE Directory Serer: Line (Unix): Starting and Stopping the Serer From the Command If your directory serer is stopped and the Directory Serer console is not running, you must start the serer from the command line. If you do not wish to use the Directory Serer console, you may also stop the serer from the command line. With root priileges, run one of the following commands: Solaris Packages: # /usr/sbin/directoryserer start # /usr/sbin/directoryserer stop Other installations: # <sererroot>/slapd-<sererid>/start-slapd # <sererroot>/slapd-<sererid>/stop-slapd where sererid is the identifier you specified for the serer during installation. On UNIX, both of these scripts must run with the same UID and GID as the Directory Serer. For example, if the Directory Serer runs as nobody, you must run the start-slapd and stop-slapd utilities as nobody. Note that referral mode is no longer aailable. Starting and Stopping the Serer From the Control Panel (Windows): Chapter 1. Troubleshooting 9

20 If you are using a Windows system, perform the following steps from the Serices Control Panel: 1. From the desktop, select: Start > Settings > Control Panel 2. Double-click the Serices icon. 3. Scroll through the list of serices and select the Sun ONE Directory Serer. The serice name is Sun ONE Directory Serer 5.2 (sererid), where sererid is the identifier you specified during serer installation or configuration. 4. Click the Start or Stop button to perform the desired action. When stopping the Directory Serer, you will be asked to confirm that you want to stop the serice. Starting and Stopping the Serer From the Console (All Platforms): When the Directory Serer console is running, you may start, stop, and restart your directory serer through its graphical interface. On the top-leel Tasks tab of the Directory Serer console, click the button beside Start Directory Serer, Stop Directory Serer, or Restart Directory Serer, as appropriate. When you successfully start or stop your Directory Serer from the Directory Serer console, the console displays a message dialog stating that the serer has been either started or shut down. In case of an error, the console will show all messages pertaining to the error. Problem: Initial Logon and Change Password Fails Configuration: Tioli Identity Manager with WebSphere Application Serer base in a functional cluster In some cases, you can log on to Tioli Identity Manager and the system appears to work correctly. Howeer, when you attempt to change the password, you receie a CORBA Exception on the screen. In addition, when you check the logs on the arious nodes in the cluster, there are numerous IBM MQSeries errors. The first error listed is: <FATAL:com.ibm.itim.messaging.MessageManagerListener>JMSException on queue queue:///wq_itim_wf?persistence=2 jaax.jms.inaliddestinationexception: MQJMS2008: failed to open MQ queue... Note: Not all nodes in the cluster will hae this error. You must identify the node or nodes that hae this error listed in the log files. If you encounter this problem, complete the following procedures on the node with the error message to erify that the Tioli Identity Manager queues are installed in IBM MQSeries properly: 1. Log on to the IBM MQSeries queue manager. 2. Execute the following command: dspmq This command should be run from a command line prompt and displays the status of the jmsserer queue manager. The status for the queue manager should be Running. Note: Make note of the jmsserer queue manager name. Typically, the name is in the following format:was_<nodename>jmsserer. 10 IBM Tioli Identity Manager: Serer Troubleshooting Guide

21 3. Execute the following command: runmqsc <queue_manager> <queue_manager> should match the name of the jmsserer queue manager found in the preious procedures. This command starts the queue manager s command line processor. 4. Execute the following command: display ql(*) This command displays all of the local queues created on the queue manager. If the Tioli Identity Manager queues are missing, there is a problem with the setup. Continue with the following procedures if the Tioli Identity Manager queues are not listed. 5. Log on to the WebSphere Application Serer Network Deployment Manager and open the admin console. 6. Click Resources ->WebSphere JMS Proider in the admin console. 7. Select the node and serer scope and click Apply. 8. Click WebSphere Queue Connection Factories. 9. Delete the queue connection factory named ITIM Queue Connection Factory and sae the configuration. 10. Select Synchronize with nodes. 11. Click WebSphere Queue Destinations under the WebSphere JMS Proider node. 12. Delete all of the Tioli Identity Manager queue destinations and sae the configuration. 13. Click Serers->JMS Serers. 14. Click JMS Serer for the node that has the problem and delete the queue names defined on that JMS Serer. 15. Sae the configuration. 16. Log on to the Tioli Identity Manager node with the problem. 17. Run the system configuration tool with the install option by executing the following command in a command line window: runconfig install The system configuration tool opens. 18. Verify that the information on all tabs is correct. The alues listed should match the alues initially input during the installation process. 19. Sae the configuration by clicking OK. 20. Restart the Tioli Identity Manager Serer. If you hae additional questions regarding this problem, please contact IBM Customer Support. Chapter 1. Troubleshooting 11

22 Web Browser Problems This section describes commonly encountered web browser problems. The following is a list of common web browser problems: Problem: Web Browser Cannot See Any Web Pages on page 12 Problem: Error - Current workflow design is used by others on page 12 Problem: WebSphere Application Serer does not bring up Tioli Identity Manager Serer on page 12 Problem: Web Browser Cannot See Any Web Pages If the web browser cannot see any of the Tioli Identity Manager Serer web pages, check the access log. All the requests made to the WebSphere Application Serer are logged in the access log. If the request is not listed in the access log, check the port number used to log into the WebSphere Application Serer. If the port number is correct, there may be a problem with the network address translation. Problem: Error - Current workflow design is used by others If the following error appears when trying to access a workflow and no other users are modifying the workflow, the Jar Cache may still hae a copy of the workflow. Current workflow design is used by others. Please try again later Clear the Jar Cache by going into the Jaa Plugin Control panel, selecting the cache tab and clicking Clear Jar Cache. Close the browser window and open a new window. Use the new window to access the Tioli Identity Manager system and modify the workflow, as desired. Problem: WebSphere Application Serer does not bring up Tioli Identity Manager Serer If WebSphere Application Serer does not bring up the Tioli Identity Manager Serer, increase the alue of the enrole.startup.delay ariable in the enrole.startup.properties file located in <install_directory>/data. The default setting is milliseconds. 12 IBM Tioli Identity Manager: Serer Troubleshooting Guide

23 Internal Serer Errors This section describes commonly encountered internal serer problems. The following is a list of commonly encountered internal serer problems: Problem: Internal Serer Error Message on page 13 Problem: All Requests are Locked in Running State on page 13 Problem: Internal Serer Error Message If you encounter an internal serer error, check the serer log and the WebSphere Application Serer console. Verify that the serlets and Enterprise Jaa Beans hae deployed using the WebSphere Application Serer console. The WebSphere Application Serer console can be used to check the status of the Enterprise Jaa Beans deployment, database connection pool, and message queues. The WebSphere Application Serer console can also be used to check additional configuration properties and queues. Access the WebSphere Application Serer console at the following address: Problem: All Requests are Locked in Running State If all requests in the system seem to be stuck in the running state, the connection between the Tioli Identity Manager Serer and the LDAP Directory Serer may hae been lost or become corrupt. Check the serer logs and look for any errors. In particular, look for the SERVER_NOT_AVAILABLE error. Restart the LDAP Directory Serer and then the Tioli Identity Manager Serer. Chapter 1. Troubleshooting 13

24 WebLogic-specific Problems This section describes commonly encountered problems related to WebLogic. The following is a list of these problems: Problem: WebLogic fails to start; no information in serer log on page 14 Problem: Tioli Identity Manager Windows 2000 Serice Fails to Start on page 14 Problem: WebLogic fails to start; no information in serer log The information may hae been sent to the console. Perform the following steps to display the output to the console: UNIX: 1. Locate the startup script: <ITIM_HOME>/itim.sh 2. There two lines in itim.sh that contain nohup and > /de/null &. Edit the first line to remoe these commands if your installation is a single serer. Edit the second line to remoe these commands if your installation is a cluster. 3. Start the serer again: # sh itim.sh start Windows 2000: 1. Stop the Tioli Identity Manager serice. 2. Start the serer interactiely: <ITIM_HOME>/bin/itim.cmd Problem: Tioli Identity Manager Windows 2000 Serice Fails to Start If the Tioli Identity Manager Windows 2000 serice fails to start or does not start properly, try to uninstall and reinstall the serice: 1. Uninstall the serice: <ITIM_HOME>/bin/uninstallItimSerice.cmd 2. Reinstall the serice: <ITIM_HOME>/bin/installItimSerice.cmd 14 IBM Tioli Identity Manager: Serer Troubleshooting Guide

25 Data Input Problems Data input problems typically occur when users define custom data structures in the directory structure or when users recently installed new Tioli Identity Manager Agents. If you cannot input data for a custom class, check the Tioli Identity Manager serer log and the directory log. LDAP messages such as object error 32 are typical and indicate missing data for required fields or schema problems. Chapter 1. Troubleshooting 15

26 Remote Communication Problems This section describes commonly encountered remote communication problems. The following is a list of these problems: Problem: Tioli Identity Manager Serer Cannot Connnect to IBM DB2 on page 16 Problem: Cannot Communicate with an Agent on page 17 Problem: Agent Cannot Communicate with the Tioli Identity Manager Serer on page 17 Problem: Missing CA Certificate on page 17 Problem: Tioli Identity Manager Serer Cannot Connnect to IBM DB2 Configuration: Tioli Identity Manager with WebSphere Application Serer base with IBM DB2 on AIX While running arious processes and requests in Tioli Identity Manager, it is possible that the Tioli Identity Manager will not be able to connect with IBM DB2. This problem occurs when IBM DB2 runs out of shared memory segments aailable for connections. By default, AIX does not permit 32-bit applications to attach more than 11 shared memory segments per process, of which a maximum of 10 memory segments can be used for local IBM DB2 connections. If this problem occurs, the following error is seen in the Tioli Identity Manager log file: [IBM][CLI Drier]SQL1224N A database agent could not be started to serice a request, or was terminated as a result of a database system shutdown or a force command. SQLSTATE=55032 To resole this issue, the enironment ariable EXTSHM should be set to ON to increase the number of shared memory segments to which a single process can be attached. After EXTSHM is set to ON, it must be exported in the shell where the client application is started and the db2start is run. The following procedures describe how to set the EXTSHM enironment ariable. On the AIX system with the client application installed, type the following command in a command prompt window: # export EXTSHM=ON On the AIX system where the IBM DB2 Serer is installed, type the following commands: # export EXTSHM=ON # db2set DB2ENVLIST=EXTSHM # db2set -all Add the following lines to the db2profile file on the system where the IBM DB2 Serer is installed and source the file: EXTSHM=ON export EXTSHM The db2profile file is located in <db2instance_dir>/sqllib/db2profile. If you hae IBM DB2 in a clustered configuration, db2profile must be modified on each member of the cluster. 16 IBM Tioli Identity Manager: Serer Troubleshooting Guide

27 Problem: Cannot Communicate with an Agent If you encounter communication problems between the Tioli Identity Manager Serer and a Tioli Identity Manager Agent, erify that the Tioli Identity Manager Serer has the correct agent information by naigating to the agent s detailed information page under Serice Management and clicking the Test button. A message is displayed indicating successful communication with the agent or failed communication with an explanation of the failure. Common problems are mistyped CA Certificate Store, incorrect user IDs or passwords, or incorrect URLs. Problem: Agent Cannot Communicate with the Tioli Identity Manager Serer This problem is only encountered during asynchronous notification and asynchronous response. If a Tioli Identity Manager Agent cannot communicate with the Tioli Identity Manager Serer, check the access log. Error Message Possible Causes 404 response containing notification Agent is connecting to serer but looking for an incorrect URL. 500 response (internal serer error) Agent is using an incorrect URL that does not connect to serer or is connecting to the serer using the wrong port. Problem: Missing CA Certificate If the CA certificate store path is incorrectly specified on a serice form, the following error will occur when testing the connection to a serice: Communications error: no alid CA certificates found in /.../.../... Correct the path in the serice s form. The CA certificate store path is typically <ITIM_HOME>/cert. Chapter 1. Troubleshooting 17

28 Problems This section describes commonly encountered problems. The following is a list of these types of problems: Problem: Cannot Send to Users on page 18 Problem: Cannot Send Mail to External Mail Addresses on page 18 Problem: UnsatisfiedLinkError Exception when Serer-agent Communication is Tested on page 18 Problem: Cannot Send to Users If you encounter problems sending mail from the Tioli Identity Manager Serer to a user, check the mail serer properties. Refer to the Tioli Identity Manager Serer Configuration Guide for more information about mail serer properties. Verify that the mailing protocol and host are correct. SMTP is the most commonly used protocol. Check the serer log for mail related messages. Check the host using nslookup: % nslookup > set type=mx > domain-name where domain-name is the Internet domain name of your organization s addresses. This command lists the mail serer for the domain name that you typed. Problem: Cannot Send Mail to External Mail Addresses In some cases, you may be able to send mail to internal mail addresses but not to external Internet mail addresses. This problem may be caused by the relay permission on your mail serer. Your mail serer must be set up to allow relaying from the machine that runs the Tioli Identity Manager Serer. Problem: UnsatisfiedLinkError Exception when Serer-agent Communication is Tested It is possible in a WebSphere enironment to get an UnsatisfiedLinkError exception when you test (by clicking the Test button on the Serice form) the serer-agent communication for an FTP protocol based agent, such as RACF. The problem is caused by not adding the Tioli Identity Manager natie library files to the library path of the serer. Refer to the Release Note for details. 18 IBM Tioli Identity Manager: Serer Troubleshooting Guide

29 Miscellaneous Problems This section describes arious problems that may be encountered when administering the Tioli Identity Manager Serer. The following is a list of these problems: Problem: New Attributes Do Not Display on Form on page 19 Problem: Tioli Identity Manager Accounts are Suspended or De-Proisioned on page 19 Problem: Cannot Delete an OU on page 19 Problem: Things are Stuck in Workflow on page 20 Problem: Workflow Designer Classes Not Loading Correctly on page 20 Problem: Adding an Account Fails with a NullPointerException on page 20 Problem: NotLockedException thrown on page 21 Problem: Uncommited Messages Count Error on page 21 Problem: New Attributes Do Not Display on Form If new attributes are added to a form and the attributes are not displayed on the form, these attributes may be listed in the enrolehiddenattributes.properties file. Attributes listed in this file are not displayed on the forms. To display these attributes on the form, the lines for these attributes must be commented out in the enrolehiddentattributes.properties file. This file is located in the following directory: <ITIM_HOME>/data If the attributes are not marked as hidden in the enrolehiddenattributes.properties file, the problem may be a cache issue. This is usually the case if a new attribute was just added to an objectclass. To sole this issue, re-start the serer. Problem: Tioli Identity Manager Accounts are Suspended or De-Proisioned If all Tioli Identity Manager accounts are suspended or de-proisioned, including the system administrator account, the system administrator account can be restored through the directory serer. All accounts, except the built-in System Administrator account, can be deproisioned by incorrectly modifying a proisioning policy. To re-actiate the system administrator account, access the directory serer administration console and naigate through to the following location: ou=systemusers,ou=tioli Identity Manager,o=<orgname>,dc=com where orgname is the name of the parent organization. Modify the Tioli Identity Manager manager account by changing the eraccountstatus alue from 1 to 0. This restores the Tioli Identity Manager manager account. Other accounts can now be restored using the Tioli Identity Manager manager account. Problem: Cannot Delete an OU When deleting an OU (any unit within the organization), all dependent units must be deleted before the OU can be deleted. Sometimes, howeer, dependent units may still exist een though they do not appear in the organizational tree. If this occurs, an error message will appear in a pop-up window with the following message: Dependent Unit(s) exists. Remoe all dependent Unit(s) first, then Delete. Chapter 1. Troubleshooting 19

30 Check the Directory Serer for possible dependencies to the selected OU by performing a search in the Directory Serer. The search is performed on the following: erparent=<oudn> where oudn is the distinguished name (DN) of the OU. If any dependencies are found, remoe the dependency and delete the OU using the Tioli Identity Manager user interface. Problem: Things are Stuck in Workflow In a cluster enironment, if things are stuck in workflow, for example, marked as Not Started in the Pending Requests, the reason could be that QM_ENROLE queue manager was not running before Tioli Identity Manager was started. Start QM_ENROLE queue manager before starting the Tioli Identity Manager Serer group in WebSphere Application Serer. Problem: Workflow Designer Classes Not Loading Correctly If you encounter errors with the loading of Workflow Designer classes, the reason could be that the WebSphere Application Serer fix packs were not installed correctly. WebSphere Application Serer fix packs should be loaded only after the http serer serice is stopped. In addition, in a cluster enironment, ensure that you hae applied the fix packs to the WebSphere Application Serer Network Deployment system. Problem: Adding an Account Fails with a NullPointerException Configuration: Tioli Identity Manager with WebSphere Application Serer base cluster using IBM DB2 If a request to add an account to a user fails with a NullPointerException, the queues in IBM MQSeries may need to be cleared and the database tables on the Network Deployment Manager may need to be re-created before the account can be added. First, attempt to clear the queues for the cluster by deleting the following four files on each member node machine: XAresource1 XAresource2 tranlog1 tranlog2 The files are located in the following directory: <WebSphere Application Serer Home Directory>/tranlog/<Node_Name> If deleting the preiously stated files does not resole the problem, complete the following procedures to completely clear the queues on the member nodes. 1. Stop the Tioli Identity Manager cluster. This can be accomplished by stopping the enrole application in the Network Deployment Manager Admin Console. 2. Log onto one of the member nodes and determine the queue names. This can be accomplished by using the dspmq command from the command prompt window. 20 IBM Tioli Identity Manager: Serer Troubleshooting Guide

31 3. Issue the following commands for each queue with jmsserer in the queue name: runmqsc <queue_name> clear qlocal ('WQ_itim_ms') runmqsc <queue_name> clear qlocal ('WQ_itim_rs') runmqsc <queue_name> clear qlocal ('WQ_itim_wf') runmqsc <queue_name> clear qlocal ('WQ_itim_wf_pending') 4. Repeat the preious two procedures for each member node. 5. Restart the cluster and re-run the request. If clearing the queues does not resole the issue, drop the IBM DB2 tables on the Network Deployment Manager machine. To accomplish this task, complete the following procedures: 1. Stop the Tioli Identity Manager cluster. 2. Drop the database tables by executing the database configuration tool program. Issue the following command on the Tioli Identity Manager Serer from a command prompt window: UNIX-based Tioli Identity Manager Serer: <ITIM_HOME>/bin/dbconfig Windows-based Tioli Identity Manager Serer: <ITIM_HOME>\bin\dbconfig 3. Stop and start the IBM DB2 Serer. This clears out any work items. 4. Restart the cluster and re-run the request. Problem: NotLockedException thrown Show to support only DeTrack # A NotLockedException can be thrown when a transaction has been rolled back by the application container. A rollback can be intiated by database access failure. In some cases, this is triggered by the database running out of tablespace. This situation causes aftercompletion() to be inoked and unlock entities in the LockManager. When the workflow thread proceeds to process the newly unlocked entities, it encounters an UnLockedException. This exception causes the message to rollback, thereby maintaining system integrity until more tablespace can be added to the database. Workflow has a retry mechanism to reprocess the original message, ensuring the rollback will not cause any data integrity issues. Problem: Uncommited Messages Count Error Show to support only DeTrack # During a large load of policy change, MQ might run out of uncommited messages count resulting in an exception being thrown. To correct this problem, the MAXUMSGS attribute of the Queue Manager should be increased to a alue that will support the load. For example, a policy change affecting 20,000 users would dicate that this attribute be set to a alue greater than The attribute can be changed using the runmqsc utility. Problem: No Local Copy of JVM on WebSphere Application Serer Network Deployment System Show to support only DeTrack # You may encounter exceptions, hang on executing runconfig/dbconfig/ldapconfig, or hang when you run the Tioli Identity Manager uninstall program if you hae a Network Deployment Manager system that does not hae a local copy of JVM 1.3 or a local installation of WebSphere Application Serer base resident on the system. This situation can be resoled by either loading a copy of JVM 1.3 on the system, or by updating the JVM definition for the following LAX files in order to run the corresponding Tioli Identity Manager commands successfully: For Windows: Chapter 1. Troubleshooting 21

32 <ITIM_HOME>\bin\runConfig.lax <ITIM_HOME>\bin\dbConfig.lax <ITIM_HOME>\bin\ldapConfig.lax <ITIM_HOME>\itimUninstallerData\Uninstall ITIM.lax For Unix: <ITIM_HOME>/bin/runConfig.lax <ITIM_HOME>/bin/dbConfig.lax <ITIM_HOME>/bin/ldapConfig.lax <ITIM_HOME>/itimUninstallerData/Uninstall_ITIM.lax Within these files, change the following line: For Windows: lax.nl.current.m = \jaa\bin\jaaw.exe to lax.nl.current.m = <was_ndm_home>\jaa\bin\jaaw.exe For Unix: lax.nl.current.m = /jaa/bin/jaa to lax.nl.current.m = <was_ndm_home>/jaa/bin/jaa 22 IBM Tioli Identity Manager: Serer Troubleshooting Guide

33 Chapter 2. Tioli Identity Manager LDAP Schema This chapter proides descriptions about the Tioli Identity Manager Directory Information Tree and the classes used by Tioli Identity Manager in the LDAP directory. Topic index: Tioli Identity Manager LDAP Directory Tree on page 24 General Tioli Identity Manager Classes on page 27 Serice Classes on page 35 Policy Classes on page 43 Copyright IBM Corp

34 Tioli Identity Manager LDAP Directory Tree Tioli Identity Manager creates its own directory tree to store information. The following is a diagram of a basic Tioli Identity Manager directory tree: IBM Tioli Identity Manager Root Node ou=itim (application information) ou=companyname ou=excludeaccounts o= OrganizationName (organization information) ou=itim (serice information) ou=constraints ou=orgchart ou=policies ou=formtemplates erdictionaryname= password ou=workflow ou=sysroles ou=objectprofile ou=serices ou=orphans ou=recyclebin ou=accounts ou=roles ou=sericeprofile ou=0 ou=people ou=systemuser ou=n ou=joindirecties ou=0 cn=challenges ou=n ou=operations ou=category Figure 1. Basic directory tree 24 IBM Tioli Identity Manager: Serer Troubleshooting Guide

35 The following table includes brief descriptions of each container. Container Root Node ou=itim ou=constraints erdictionaryname=password ou=companyname o=organizationname ou=orgchart ou=workflow ou=serices ou=accounts ou=policies ou=sysroles ou=orphans ou=roles ou=people ou=itim ou=formtemplates ou=objectprofile ou=recyclebin Description Root node where the Tioli Identity Manager Serer is installed. This container stores all pertinent information for the Tioli Identity Manager application. This container stores membership restrictions for arious roles and serices. This container stores inalid password entries for use with password policies. Name of the company. This container is the parent container for all information pertaining to the company within the Tioli Identity Manager system. Name of the organization as it appears in the Organization Tree. This container stores the definition of the organizations and organizational units within Tioli Identity Manager. This container stores all the workflows designed for use within the Tioli Identity Manager system for the company. This container stores information pertaining to the serices installed for use with the Tioli Identity Manager system. This container stores all accounts in the Tioli Identity Manager system. This container stores all the defined policies. This container stores all information pertaining to the Tioli Identity Manager Groups defined within Tioli Identity Manager. This container stores all orphan accounts retrieed during a reconciliation. This container stores all information for all organizational roles defined within Tioli Identity Manager. This container stores all information about Persons within Tioli Identity Manager. This container is the parent container for system specific information. This container stores information about the arious forms and the form templates used within the system. This container stores the object profiles required for the system to recognize a managed resource as an entity (person, organizational unit, location, and so forth) This container stores entities deleted from the system using the graphical user interface. Chapter 2. Tioli Identity Manager LDAP Schema 25

36 Container ou=sericeprofile ou=systemuser ou=joindirecties cn=challenges ou=operations ou=category Description This container stores the serice profiles required for the system to recognize a managed resource as a serice. This container stores information about system users. This contain stores all the information about the Proisioning Policy Join Directies. This container stores all information pertaining to the Password Challenge/Response feature. This container stores information on workflow operations (such as add, modify, delete, suspend, and transfer) with Tioli Identity Manager. This container stores life cycle management operations for an entity type. Only Person and Account are supported. Global represents the system s operation. 26 IBM Tioli Identity Manager: Serer Troubleshooting Guide

37 General Tioli Identity Manager Classes The Tioli Identity Manager system uses the Directory Serer s default schema as well as an Tioli Identity Manager specific schema. The Tioli Identity Manager specific schema consists of a collection of auxiliary classes that proide the interface necessary to execute the Tioli Identity Manager system s business logic. These auxiliary classes can be used with custom defined classes to complete the schema used by the Tioli Identity Manager system. The classes listed below are default structural classes. An additional term to note is: domain entry An entry in the directory that corresponds to a business entity managed by the Tioli Identity Manager system. erbppersonitem The erbppersonitem class is an auxiliary class that identifies attributes for a business partner person. This is a domain entry. The parent class is top. Attribute name Description Type mail address. cn Common Name for person. erpersonstatus Status of person. integer ersponsor DN of this person s sponsor. distinguished name erroles DN of roles for person. distinguished name eraliases Aliases for person. ersharedsecret Value used by the user for password pickup. ercustomdisplay erlocale User selected attribute to display in BP Person list. User s locale preference. Default is the system s locale. erbporg The erbporg class is a structural class that stores business partner organization information. This is a domain entry. The parent class is top. ou Attribute name Description Type Organizational unit. Required description Description of the business partner organization. erbporgitem The erbporgitem class is an auxiliary class that stores business partner (BP) organization information. This is a domain entry. The parent class is top. Chapter 2. Tioli Identity Manager LDAP Schema 27

38 Attribute name Description Type ou Organizational unit name. erbporgstatus Status of the BP organization. integer ersponsor DN of organizational unit s superisor. distinguished name erdictionary The erdictionary class stores words that are not allowed to be used as passwords. This is a domain entry. The parent class is top. Attribute name Description Type erdictionaryname The name of the dictionary. Required description Description of the dictionary. erdictionaryitem The erdictionaryitem class stores an indiidual word that is not allowed to be used as a password. These classes are then linked together with the erdictionary class. This is a domain entry. The parent class is top. erword Attribute name Description Type The word that is excluded from being used as a password. description Required Description of the word and why it is not allowed to be used as a password. erformtemplate The erformtemplate class stores form template information. This is a domain entry. The parent class is top. erformname Attribute name Description Type The name of the form. Required ercustomclass Name of the entity s class. erxml The actual XML code for the form. binary eridentityexclusion The eridentityexclusion class stores the names of the accounts that are not retrieed during a reconciliation. This is a domain entry. The parent class is top. cn Attribute name Description Type Common name. Required 28 IBM Tioli Identity Manager: Serer Troubleshooting Guide

39 Attribute name Description Type erobjectprofilename Serice profile name. eraccountid Account ID to exclude from the reconciliation.. erlocationitem The erlocationitem class is an auxiliary class that stores attributes of a location within the system. The location name attibute must be defined. The erlocationitem class is a domain entry and includes the ermanageditem class. The parent class is top. l Attribute name Description Type Location name. Required ersuperisor DN of location s superisor. distinguished name ermanageditem The ermanageditem class is an auxiliary class that is added to all domain entries (organizations, organizational units, people, and roles) that require access control. The ermanageditem class defines a unique ID, a parent entry (if present), and an access control list. The parent class is top. erglobalid Attribute name Description Type erlastmodifiedtime Unique, random ID assigned to all entries in a directory. Used as the regional DN for each entry. Entry s remoal date and time (GMT format). eracl Access Control List. binary numeric string erauthorizationowner Owner of Access Control. distinguished name erparent Entry s organizational unit DN. distinguished name erisdeleted True if in recycle bin. erorganizationitem The erorganizationitem class is an auxiliary class that is added to organizations. The erorganizationitem class is a domain entry and includes the ermanageditem class. It defines the organization s name and status. The parent class is top. Attribute name Description Type o Organization name. erorgstatus Organization status. integer Chapter 2. Tioli Identity Manager LDAP Schema 29

40 erorgunititem The erorgunititem class is an auxiliary class that stores information about an organizational unit. It contains information on the ou name and, optionally the superisor (ersuperisor) for an orgnizational unit. The erorgunititem is a domain entry. The parent class is top. Attribute name Description Type ou Organizational unit. ersuperisor DN of organizational unit s superisor. distinguished name erpersonitem The erpersonitem class is an auxiliary class that identifies attributes for a person. The erpersonitem is a domain entry. The parent class is top. Attribute name Description Type mail address. cn Common name for person. erpersonstatus Status of person. integer erroles DN of person s roles. distinguished name eraliases Aliases for person. ersuperisor DN of the person s superisor. distinguished name ersharedsecret ercustomdisplay erlocale Value used by the user for password pickup. User selected attribute to display in Person lists. User s locale preference. Default is the system s locale. errole The errole class stores the name and description for an organizational role. Howeer, it does not store membership information. Role membership is stored in erpersonitem.erroles. This is a domain entry. The parent class is top. errolename Attribute name Description Type Name of the organizational role. Required description Description of the role. ersecuritydomainitem The ersecuritydomainitem class is an auxiliary class for an admin domain. The parent class is top. Attribute name Description Type ou Organizational unit. eradministrator DN of the administrator of an Admin Domain. distinguished name 30 IBM Tioli Identity Manager: Serer Troubleshooting Guide

41 SecurityDomain The SecurityDomain class stores admin domain information. This is a domain entry. The parent class is top. ou Attribute name Description Type Organizational unit. Required description Description of the admin domain. ertenant The ertenant class is a class that defines properties based on a tenant, such as the ou, if password edits are allowed, or if mailing of lost passwords is allowed. The parent class is top. ou Attribute name Description Type Organization unit that contains this tenant. erisactie Required Indicates if this tenant is actie. Boolean Required description Description of tenant. erpswdeditallowed Indicates if passwords may be set (true) or generated (false). Boolean erlostpswdbymail erbucketcount erlastmodifiedtime erpswdexpirationperiod Required Indicates if passwords can be mailed to a user for this tenant. Required Hash bucket number. Required Time the tenant was last modified (attributes). Number of days after which the ITIM password gets expired. When the user tries to login to the system after the password expires, the user is forced to change the password. If this alue is set to 0, the password will neer expire. Boolean integer generalized time integer Chapter 2. Tioli Identity Manager LDAP Schema 31

42 Attribute name Description Type erpswdtransactionexpperiod Number of hours after which the transaction to retriee an account password expires. The password is typically retrieed using the URL link proided in an from the system. integer erlogoncount erresponseenable erresponsedescription erresponse If this alue is set to 0, the URL link will neer expire. Number of inalid login attempts the user can hae before the user s account is suspended. If this alue is set to 0, the user can try to access the system as many attempts as the user likes and the system will not suspend the account. Attribute for enabling or disabling the Password Challenge/Response feature. If this attribute is set to TRUE, the user can use the Forgot Your Password link to enter the system by proiding correct answers to the Password Challenge/Response questions. Message displayed on the login page if the user s account is suspended after the user tries to log into the system too many times and fails to respond correctly to the Password Challenge/Response questions. Message ed to the administrator responsible for user accounts suspended when the user fails to access the system in the defined number of tries. integer Boolean 32 IBM Tioli Identity Manager: Serer Troubleshooting Guide

43 Attribute name Description Type erchallengemode errequiredchallenges errandomchallenges Password Challenge Response mode. There are three different modes aailable: PRE-DEFINED: If this mode is selected, the user must correctly answer all of the challenge questions pre-defined by the system administrator to access the system. USER-SELECTED: If this mode is selected, the user must correctly answer the challenge questions preiously selected when configuring the challenge/response feature for the account. The challenge questions are selected from a pre-defined list. RANDOM-SELECTED: If this mode is selected, the user must correctly answer the challenge questions selected by the system. The challenge questions are selected from a pre-defined list. Number of challenges the user must respond to correctly to access the system if the user forgot his password. Number of challenges aailable for the system to select from when presenting Password Challenge/Response questions to users who forgot their passwords. integer integer erhashedenabled Not used. Boolean erresplastchange erchallengedefmode erpswdsyncallowed Timestamp of when the administrator last changed the Password Challenge/Response configuration. Definition mode for lost password challenge response. Possible alues are Admin Defined (0) and User Defined (1). generalized time integer Boolean erworkflowdefinition The erworkflowdefinition class stores workflow information. This is a domain entry. The parent class is top. Attribute name Description Type erprocessname The name of the workflow. Required erobjectprofilename Serice profile name. Chapter 2. Tioli Identity Manager LDAP Schema 33

44 Attribute name Description Type erxml Definition of workflow. binary ercategory Type of entity to manage, such as Person, BPPerson, or Account. 34 IBM Tioli Identity Manager: Serer Troubleshooting Guide

45 Serice Classes Serices may be hosted or owned. A hosted serice is a serice that is shared by multiple organizations (such as in an ASP enironment). An owned serice is not shared. Each type of serice has its own, different representation within the system. eraccountitem The eraccountitem class is an auxiliary class that defines required attributes for a user account. The parent class is top. Attribute name Description Type eruid Account login ID. owner DN of the account owner. distinguished name eraccountstatus Account status. integer eraccountcompliance Compliancy of the account. Possible alues are Uncheck account (0), Compliant account (1), Unauthorized account (2), Constraints iolated account (3). integer erpassword Account login password. binary erhistoricalpassword Preious account login password. binary erserice DN of the account serice. distinguished name erlastaccessdate Last login date. generalized time erattributeconstraint The erattributeconstraint class proides the Tioli Identity Manager structure for an attribute constraint. The parent class is top. eroid Attribute name Description Type Attribute s Object Identification Number (Oid). cn Required Name of the constraint on the attribute. ertype Attribute type. erisreadonly True if this is a read-only attribute. Boolean erdefaultvalue Attribute s default alues. ercustomconstraint Attribute s definition constraints. erchallenges The erchallenges class proides the structure for questions of password challenge and response. The parent class is top. Chapter 2. Tioli Identity Manager LDAP Schema 35

46 cn Attribute name Description Type Name of challenge and response entry. erlastmodifiedtime erlostpasswordquestion Required Last time the user s challenge/response list was updated. User s password challenge question/response list. binary erdsmlinfoserice Attribute name Description Type ersericename The display name for serice instances. erdsmlfilename eruseworkflow eruid erpassword erplacementrule erproperties erprotocolmappings ersericeproiderfactory erxforms Required The name of a DSML file stored on disk. A Boolean flag used on a DSMLInfoSerice to indicate that people should be processed using the workflow engine. An identifier used to uniquely identify a user of a serice. A password used to authenticate a user. A script fragment defining the location of the user within the organization chart. Defines protocol and behaior properties for serice profiles. Specifies the serice attributes that should be used in messages sent to managed resources. Defines the name of the Jaa class for creating the SericeProider used to communicate with the managed resource. Defines transforms for Tioli Identity Manager agents. Boolean binary binary binary erdsml2serice The erdsml2serice class proides the Directory Serice Markup Language Version 2 (DSML2) class to import data into Tioli Identity Manager. The parent class is top. 36 IBM Tioli Identity Manager: Serer Troubleshooting Guide

47 Attribute name Description Type ercategory Type of entity to manage. ersericename erurl erpassword erplacementrule eruid eruseworkflow ernamingattribute namingcontexts Required Name to display on the user interface. Required URL of the data source. Supported protocols include: file, http, and https. Required Key to authenticate DSML2 clients when using the JNDI client. Placement rule defining a script to place entries within the organization chart. Name of the principal to authenticate DSML2 clients when using the JNDI client. Boolean flag to indicate whether to use workflow when managing data. A alue of true will ealuate proisioning policies and place an entry in the audit trail. The naming attribute on a serice used to define the distinguished names of entries in eent notification. Identifies the serice. Required when Tioli Identity Manager is acting as a DSML2 serice. Boolean distinguished name erdynamicrole The erdynamicrole class proides the structure for a dynamic role. The parent class is errole. erjaascript erscope Attribute name Description Type Role s ealuation definition. This definition is used to ealuate members of a role. Scope of role ealuation: single or subtree scope. binary integer erhostedaccountitem The erhostedaccountitem class is an auxiliary class that is added to account entries for hosted serices (that is, represented by erhostedserice entries). The erhost Chapter 2. Tioli Identity Manager LDAP Schema 37

48 attribute holds a reference to the owned serice entry and proides a more efficient search when trying to identify the owned serice. The parent is eraccountitem. Attribute name Description Type erhost DN of owned serice entry. distinguished name erhostedserice The erhostedserice class describes a hosted serice. The erhostedserice class is a domain entry. The parent class is top. Attribute name Description Type ersericename Name of the serice. erserice erobjectprofilename Required DN of the target serice to be managed. Required Serice profile name for target serice. Required distinguished name erhostselectionpolicy The erhostselectionpolicy class proides the structure for a host selection policy. The parent class is erpolicyitembase. erjaascript Attribute name Description Type Contains a scriptlet used at runtime to return a serice instance. binary erobjectprofilename eruserclass Required Name corresponding to the serice type. Required Name of a user class, such as Person or BPPerson. Required eritimserice The eritimserice class proides the Tioli Identity Manager structure for Tioli Identity Manager serice. The parent class is top. Attribute name Description Type ersericename Tioli Identity Manager serice name. Required owner Serice s owner (person). distinguished name 38 IBM Tioli Identity Manager: Serer Troubleshooting Guide

49 erjoindirectie The erjoindirectie class proides the structure for a join directie used in merging proisioning parameters. The parent class is top. Attribute name Description Type erattributename Name of serice attribute. erdirectietype description ercustomdata erprecedencesequence Required Type of join directie to be used. Required Description of how the directie is used. Contains any parameters to be passed to the class implementing the JoinDirectie interface. Sequence of allowed alues for a single alued attribute with the most preferable alues listed first. erobjectcategory The erobjectcategory class proides the structure for an entity type. The parent class is top. ertype Attribute name Description Type Name of the entity s category. erxml Required Object Operation definition for life cycle management. binary erobjectprofile The erobjectprofile class proides the Tioli Identity Manager structure for an object profile. The parent class is top. Attribute name Description Type erobjectprofilename ercategory ercustomclass Profile name. Required Entity category such as Person, Role, SystemUser, or other category. Name of the class used to create an entity. errdnattr Name attribute. ersearchattr Search attribute. Chapter 2. Tioli Identity Manager LDAP Schema 39

50 erattrmap erxml Attribute name Description Type Map of the logical attribute name and physical attribute name. Key: logical attriobute name. ObjectOperation data structure life cycle management. binary erremotesericeitem The erremotesericeitem class is an auxiliary class that describes an ersericeitem. The parent class is ersericeitem. Attribute name Description Type eruid User s log in ID for the serice. erpassword User s password binary ercheckpolicy erdisallowedaction erconstraintviolationaction eridentitylookupmethod Flag to determine whether or not to check the user against the defined policies. The action to be taken during reconciliation if an account is not permitted by a proisioning policy. Possible alues are: Log Only Suspend Delete The action to be taken during reconciliation if an account is permitted by a proisioning policy but the account alues are not compliant. Possible alues are Log Only, Oerwrite Local Values, and Oerwrite Remote Values. The method used during reconciliation to look up the identity of the account owner. The only possible alue is Alias. Boolean ersericeitem The ersericeitem class is an auxiliary class that describes an owned serice. This is a domain entry. The parent class is top. Attribute name Description Type ersericename Name of the serice. owner DN of the serice owner. distinguished name erprerequisite Required prerequisite for the account. distinguished name 40 IBM Tioli Identity Manager: Serer Troubleshooting Guide

51 Attribute name Description Type ernoncomplianceaction Compliant action for accounts of the serice. Possible alues are Mark NonCompliant (0), Suspend NonCompliant (1), Correct NonCompliant (2). integer ersericeprofile The ersericeprofile class proides the Tioli Identity Manager structure for a serice profile. The parent class is erobjectprofile. Attribute name Description Type eraccountclass eraccountname erproperties Name of a custom class used to create an account. Name of profile associated with the account. Serice attributes used in messages sent to managed resources. erprotocolmappings ersericeproiderfactory erxforms Required Serice attributes used in messages sent to managed resources. Name of the Jaa class to create the SericeProider used to communicate with the managed resource. Required Defines transforms for Tioli Identity Manager agents. binary ersystemitem The ersystemitem class proides the Tioli Identity Manager auxiliary class for the Tioli Identity Manager system. The parent class is top. ersystemrole The ersystemrole class represents a system role, howeer, it does not include membership information. Members are defined in ersystemuser.erroles. This is a domain entry. The parent class is top. errolename Attribute name Description Type The system role name. Required description Description of the role. ersystemrolecategory Leel of access - End User, Superisor, System Administrator. integer Chapter 2. Tioli Identity Manager LDAP Schema 41

52 ersystemuser The ersystemuser class stores Tioli Identity Manager system accounts such as the pre-defined Tioli Identity Manager system account. The eraccountitem is also added to each ersystemuser entry since it is an account managed by the system. This is a domain entry. The parent class is top. eruid Attribute name Description Type Account login ID. Required erlostpasswordquestion Account s lost password question. erlostpasswordanswer Account s lost password answer. binary erisdelegated Flag determining if the account s workflow can be sent to delegates. Boolean erdelegate User s delegate. erworkflow Filter for iewing pending requests and completed requests. erroles Roles associated with the account. distinguished name erhomepage Login home page. erpswdlastchanged ernumlogonattempt erchangepswdrequired erresplastchange Date and time password was last changed. Number of times user attempted to log on. Flag indicating whether or not the user is required to change the password the next time the user logs into the system. Date and time challenge response was last changed. generalized time integer Boolean generalized time 42 IBM Tioli Identity Manager: Serer Troubleshooting Guide

53 Policy Classes There are three types of policies: password, identity and proisioning. These all share some general attributes. These attributes are represented within the erpolicybase and erpolicyitembase classes. The erpolicybase class inherits from the erpolicyitembase class. All policies are domain entries. eridentitypolicy The eridentitypolicy class stores identity policy-specific attributes. The parent class is erpolicybase. erjaascript Attribute name Description Type Script that is ealuated to create the user ID. binary eruserclass User s class home. erpasswordpolicy The erpasswordpolicy class stores password policy-specific attributes. The parent class is erpolicybase. erxml Attribute name Description Type XML file name. Required binary erpolicybase The erpolicybase class stores commonly used functional attributes such as state information and the target of the policy. The parent class is erpolicyitembase. Attribute name Description Type erpolicytarget Serice(s) or serice instances targeted by the policy. If a serice instance is targeted, the alue is the string representing the serice instance s DN. Format: 1;<alue> If a serice profile is targeted, the alue is the name of the serice profile. Format: 0;<alue> If all serices are targeted, the alue is *. Format: 2;<*> erreqpolicytarget If a serice selection policy is targeted, the alue is the name of the serice profile affected by the serice selection policy. Format: 3;<alue> Lists required policy targets (serice instance or serice profile). Chapter 2. Tioli Identity Manager LDAP Schema 43

54 erpolicyitembase The erpolicyitembase class stores general bookkeeping attributes for policies, such as name and description. The parent class is top. Attribute name Description Type erpolicyitemname The policy name. Required erlabel The label name for the policy. erkeywords A list of key words. description A description of the policy. erenabled Flag indicating whether or not the policy participates in the proisioning process. If the flag is enabled, the policy participates in the proisioning process. Boolean erscope If the flag is disabled, the policy does not participate in the proisioning process. Determines which serice instances are goerned by this policy. Single leel scope limits the policy to affect only those serice instances at the same leel as the policy. Subtree scope allows a policy to affect serice instances at the same leel as the policy and serice instances in leels below that of the policy. integer erproisioningpolicy The erproisioningpolicy class stores proisioning policy-specific attributes. The parent class is erpolicybase. Attribute name Description Type erentitlements Policy access definitions. binary erpriority erpolicymembership Required The priority leel for this policy. Required Policy principals. Identifies users who are goerned by this policy. Required integer 44 IBM Tioli Identity Manager: Serer Troubleshooting Guide

55 Chapter 3. Database Tables Tioli Identity Manager loads tables into the selected database during installation. These tables are used for fie features in Tioli Identity Manager: Topic index: Workflow Tables on page 46 Serices Tables on page 51 SCHEDULED_MESSAGE Table on page 54 LISTDATA Table on page 55 Copyright IBM Corp

56 Workflow Tables Tioli Identity Manager stores workflow specific information in the following database tables: PROCESS Table on page 46 PROCESSLOG Table on page 47 PROCESSDATA Table on page 47 ACTIVITY Table on page 48 WORKITEM Table on page 49 PASSWORD_TRANSACTION Table on page 49 NEXTVALUE Table on page 49 PENDING Table on page 50 The workflow engine accesses these tables to retriee information that is used during the workflow process. PROCESS Table The PROCESS table stores all the pending, running, and historical requests submitted to the Tioli Identity Manager workflow. Each request is represented as a process. The following table includes descriptions of each column name: Column Name Description Data Type ID Process ID number. numeric PARENT_ID Parent process ID number, if any. numeric PARENT_ACTIVITY_ID Parent actiity ID number. numeric NAME Process name. character TYPE Process type code. character DEFINITION_ID Process definition Identifier. character REQUESTER_TYPE Requester type. character REQUESTER DN of the requester. character REQUESTER_NAME Requester s name. character DESCRIPTION Description of the process. character PRIORITY Priority of the process. numeric SCHEDULED Scheduled start time for the process. character STARTED Time the process is started. character COMPLETED Time the process is completed. character LASTMODIFIED Time the process was last modified. character SUBMITTED Time the process was submitted. character STATE Current state of the process. character NOTIFY Specifies who is notified when a process is completed. There are four possible choices: NOTIFY_NONE (0) NOTIFY_REQUESTOR (1) NOTIFY_REQUESTEDFOR (2) NOTIFY_BOTH (3) numeric 46 IBM Tioli Identity Manager: Serer Troubleshooting Guide

57 Column Name Description Data Type REQUESTEE DN of the requestee. character SUBJECT Process s subject. character COMMENTS Comments for the process. character RESULT_SUMMARY Process s result summary code. character RESULT_DETAIL Detailed information on the process s result. long character TENANT DN of the requester s tenant. character REQUESTEE_NAME Requestee s name. character PROCESSLOG Table The PROCESSLOG table maintains a record of audit eents associated with a process. The following table includes descriptions of each column name: Column Name Description Data Type ID Log ID number. numeric PROCESS_ID ACTIVITY_ID ID of the process associated with the log. ID of the actiity associated with the log. numeric numeric CREATED Time the log was created. character EVENTTYPE Log s eent type code. character OLD_PARTICIPANT_TYPE OLD_PARTICIPANT_ID NEW_PARTICIPANT_TYPE NEW_PARTICIPANT_ID REQUESTOR_TYPE REQUESTOR Old participant type for the assignment change eent. Old participant ID for the assignment change eent. New participant type for the assignment change eent. New participant ID for the assignment change eent. Requester type for any user related eent. Requester ID for any user related eent. character character character character character character OLD_STATE Old state for a state change eent. character NEW_STATE New state for a state change eent. character DATA_ID Data ID for a data change eent. character NEW_DATA Data alue for a data change eent. long character PROCESSDATA Table The PROCESSDATA table stores the runtime process data of a process. After the process is completed, the record is remoed. The following table includes descriptions of each column name: Column Name Description Data Type PROCESS_ID Proccess ID associated with the data. numeric Chapter 3. Database Tables 47

58 DEF_ID Column Name Description Data Type Definition ID for the coresponding releant data in the process definition. character NAME Data name. character CONTEXT Context of data. The following are possible alues: REQUESTEE SUBJECT BOTH character DESCRIPTION Data description. character TYPE Data type. character COLLECTION_TYPE Element data type for sets of data. character VALUE Data alue. long character ACTIVITY Table The ACTIVITY table contains records of each workflow process s execution flow. The following table includes descriptions of each column name: Column Name Description Data Type ID Actiity ID number. numeric PROCESS_ID Actiity s process ID number. numeric DEFINITION_ID Actiity s definition Identifier. character ACTIVITY_INDEX LOOP_COUNT Actiity index (only if the actiity is inside of a loop). Specific to loop actiity. numeric numeric LOOP_RUNCOUNT Number of iterations that hae occurred in the loop. Specific to asynchronous loop actiity. numeric RETRY_COUNT LOCK_COUNT SUBPROCESS_ID Number of remaining iterations left in the loop. Number of attempts to complete the actiity. Number of tasks pending on the actiity. ID of the subprocess associated with the actiity. numeric numeric numeric NAME Actiity s name. character DESCRIPTION Description of the actiity. character TYPE Actiity type. character SUBTYPE Actiity subtype. character PRIORITY Priority of the actiity (NOT SUPPORTED). numeric STARTED Time the actiity is started. character COMPLETED Time the actiity is completed. character 48 IBM Tioli Identity Manager: Serer Troubleshooting Guide

59 Column Name Description Data Type LASTMODIFIED Time the actiity was last modified. character STATE Current state of the actiity. character RESULT_SUMMARY Actiity s result summary code. character RESULT_DETAIL Detailed results information for the actiity. long character WORKITEM Table The WORKITEM table maintains a record of workitems associated with manual workflow actiies for running processes. The records associated with the process are remoed after the process is completed. The following table includes descriptions of each column name: Column Name Description Data Type ID Process data ID. numeric PROCESS_ID Proccess ID associated with the data. numeric ACTIVITY_ID Actiity ID associated with the data, if any. numeric PARTICIPANT_TYPE Work item participant type. character PARTICIPANT Work item participant identity. character CREATED Time the work item was created. character INPUT_PARAMETERS Work item specific parameters. long character PASSWORD_TRANSACTION Table The PASSWORD_TRANSACTION table is used during secure password deliery to store information. After the password is retrieed, the record is deleted from the table. If the password is neer picked up, this record is deleted upon password pickup expiration. The following table includes descriptions of each column. Column Name Description Data Type TRANSACTION_ID Transaction ID used to retriee the password. numeric ACCOUNT_DN Account DN for the password. character CREATION_DATE Password creation date. character PROCESS_ID ACTIVITY_ID ID of the workflow that started the password transaction process. ID of the actiity that started the password transaction process. numeric numeric PASSWORD Encrypted password alue. character NEXTVALUE Table Note: This table is not in use after release 4.4. The NEXTVALUE table is used to create unique IDs for workflow tables. The NEXTVALUE table is not directly used in a workflow. The following table includes descriptions of each column name: Chapter 3. Database Tables 49

60 Column Name Description Data Type ID Process data ID. numeric NEXT_ID Primary key ID to be used in a process. numeric PENDING Table The PENDING table stores all the proisioning requests that are being processed, but not completed yet. The following table includes descriptions of each column name: Column Name Description Data Type PROCESS_ID Process ID number. numeric PERSON_DN SERVICE_DN Name of the person for which the request was submitted. Name of the resource to which to add the account. character character 50 IBM Tioli Identity Manager: Serer Troubleshooting Guide

61 Serices Tables Tioli Identity Manager creates and uses the following database tables to store information related to managed resources: RESOURCE_PROVIDERS Table on page 51 REMOTE_SERVICES_REQUESTS Table on page 52 REMOTE_RESOURCES_RECONS Table on page 52 REMOTE_RESOURCES_RECON_QUERIES Table on page 53 RESOURCE_PROVIDERS Table The RESOURCE_PROVIDERS table stores cross references between resource proider IDs and stores reconciliation data for each resource proider. The resource proider IDs are used as the primary keys for resource proider entity beans. The following table includes descriptions of each column name: Column Name Description Data Type PROVIDER_ID RESOURCE_DN RECON_STATUS LAST_RECON_TIME MAX_RECON_DURATION LOCK_SERVICE Unique ID used as the primary key for the resource proider entity beans. There is a one-to-one relationship between a proider_id and a resource_dn. DN for the managed resource the proider is responsible for. Indicates whether a reconciliation is currently running. 0 - no reconciliation is running for this serice. 1 - reconciliation is currently running on this serice. If the serer is shut down abruptly during a reconciliation, this flag may need to be reset to 0 before other reconciliation requests can be processed for the specified serice. The length of time the last reconcilation took to complete. Timeout alue, in minutes, for reconciliations. If a reconciliation request runs beyond the amount of time specified in this field, the request is terminated. Indicates whether or not to lock the serice during a reconciliation: 1 - lock the serice during a reconciliation. 0 - do not lock the serice during a reconciliation. character character numeric numeric numeric REQUEST_ID Tracks the process locking the serice. character Chapter 3. Database Tables 51

62 REMOTE_SERVICES_REQUESTS Table The REMOTE_SERVICES_REQUESTS table stores asynchronous requests or requests that are made while a reconciliation is in progress. The following table includes descriptions of each column name: Column Name Description Data Type PROVIDER_ID Unique ID used as the primary key for the resource proider entity beans. character REQUEST_ID ID of the request made. character TYPE Request type: 0 - generic requests 1 - asynchronous requests numeric OPERATION 2 - instra-reconciliation requests Type of operation being performed: 0 - no operation 1 - Add request 2 - Modify request 3 - Delete request 4 - Suspend request 5 - Restore request numeric 6 - Change password request REQUEST_TIME Time the request was made. date EXPIRATION_TIME TARGET SERVICE_DN DATA CONNECTION_POINT Time the request expires. If null, the request neer expires. The owner of the account for an add request or the account dc for other types of operations. The distinguished name of the serice instance in the directory. The data for the request (attribute alues for Add and Modify requests). This information is a serialized Jaa Collection. The callback to complete the workflow process. This information is a serialized Jaa object. date character character long character long binary REMOTE_RESOURCES_RECONS Table The REMOTE_RESOURCES_RECONS table stores the reconciliation units associated with a gien resource proider. The following table includes descriptions of each column name: 52 IBM Tioli Identity Manager: Serer Troubleshooting Guide

63 Column Name Description Data Type PROVIDER_ID Unique ID used as the primary key for the resource proider entity beans. character RECON_ID Unique ID for each reconcilation unit. numeric DAY_OF_MONTH MONTH_NUM DAY_OF_WEEK HOUR_NUM MINUTE_NUM MAX_DURATION LOCK_SERVICE Day of month the reconciliation is scheduled to run. Month the reconciliation is scheduled to run. Day of week the reconciliation is scheduled to run. Hour of day the reconciliation is scheduled to run. Minute of hour the reconciliation is scheduled to run. This alue oerrides the MAX_DURATION alue in the RESOURCE_PROVIDERS table. Indicates whether or not to lock the serice during a reconciliation. 1 - lock the serice during a reconciliation 0 - do not lock the serice during a reconciliation. numeric numeric numeric numeric numeric numeric numeric REMOTE_RESOURCES_RECON_QUERIES Table The REMOTE_RESOURCES_RECON_QUERIES table stores reconciliation queries associated with a gien reconciliation unit. The following table includes descriptions of each column name: Column Name Description Data Type PROVIDER_ID RECON_ID QUERY_ID RECON_FILTER RECON_BASE Unique ID used as the primary key for the resource proider entity beans. Unique ID for each reconciliation unit. Unique ID for each reconciliation query. Filter associated with the reconciliation query. Search base associated with the reconciliation query. character numeric numeric character character MAX_DURATION Not used. numeric MAX_ENTRIES Not used. numeric ATTRIBUTES Attributes returned during a reconciliation request. character Chapter 3. Database Tables 53

64 SCHEDULED_MESSAGE Table The SCHEDULED_MESSAGE table stores information associated with a scheduled eent that is proided by the scheduler. The scheduler is a component of Tioli Identity Manager that stores one-time or regularly scheduled eents. These eents are typically user requests (ia the workflow engine) or recurring reconciliation eents. The following table includes descriptions of each column name: Column Name Description Data Type SCHEDULED_TIME The long integer that represents the time of the scheduled eent, which is the number of milliseconds since January 1, 1970, 00:00:00 GMT. numeric SCHEDULED_MESSAGE_ID Unique ID for each scheduled eent. numeric MESSAGE SERVER CHECKPOINT_TIME REFERENCE_ID A serialized object that represents the detail information of the scheduled eent. The serer that picks up the scheduled eent most recently. The long integer that represents the last pick up time of the scheduled eent, which is the number of milliseconds since January 1, 1970, 00:00:00 GMT. Used only used for scheduled workflow eents, it is the workflow process ID that the scheduled eent is coming from. long character character numeric numeric 54 IBM Tioli Identity Manager: Serer Troubleshooting Guide

65 LISTDATA Table The LISTDATA table is used to optimize memory utilization and improe performance for Tioli Identity Manager. This table is used to store large data lists. Instead of loading all data into memory, data will be stored in this table and referenced by index in memory. The following table includes descriptions of each column name: Column Name Description Data Type DATA_ID Unique identifier for the data. numeric INDEX_ID List element s index. numeric VALUE The serialized list element. long character Chapter 3. Database Tables 55

66 56 IBM Tioli Identity Manager: Serer Troubleshooting Guide

67 Appendix. Notices This information was deeloped for products and serices offered in the U.S.A. IBM may not offer the products, serices, or features discussed in this document in other countries. Consult your local IBM representatie for information on the products and serices currently aailable in your area. Any reference to an IBM product, program, or serice is not intended to state or imply that only that IBM product, program, or serice may be used. Any functionally equialent product, program, or serice that does not infringe any IBM intellectual property right may be used instead. Howeer, it is the user s responsibility to ealuate and erify the operation of any non-ibm product, program, or serice. IBM may hae patents or pending patent applications coering subject matter described in this document. The furnishing of this document does not gie you any license to these patents. You can send license inquiries, in writing, to: IBM Director of Licensing IBM Corporation North Castle Drie Armonk, NY U.S.A. For license inquiries regarding double-byte (DBCS) information, contact the IBM Intellectual Property Department in your country or send inquiries, in writing, to: IBM World Trade Asia Corporation Licensing 2-31 Roppongi 3-chome, Minato-ku Tokyo , Japan The following paragraph does not apply to the United Kingdom or any other country where such proisions are inconsistent with local law: INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION AS IS WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Some states do not allow disclaimer of express or implied warranties in certain transactions, therefore, this statement may not apply to you. This information could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein; these changes will be incorporated in new editions of the publication. IBM may make improements and/or changes in the product(s) and/or the program(s) described in this publication at any time without notice. Any references in this information to non-ibm Web sites are proided for conenience only and do not in any manner sere as an endorsement of those Web sites. The materials at those Web sites are not part of the materials for this IBM product and use of those Web sites is at your own risk. IBM may use or distribute any of the information you supply in any way it beliees appropriate without incurring any obligation to you. Copyright IBM Corp

68 Licensees of this program who wish to hae information about it for the purpose of enabling: (i) the exchange of information between independently created programs and other programs (including this one) and (ii) the mutual use of the information which has been exchanged should contact: IBM Corporation 2ZA4/ Burnet Road Austin, TX U.S.A. Such information may be aailable, subject to appropriate terms and conditions, including in some cases, payment of a fee. The licensed program described in this information and all licensed material aailable for it are proided by IBM under terms of the IBM Customer Agreement, IBM International Program License Agreement, or any equialent agreement between us. Any performance data contained herein was determined in a controlled enironment. Therefore, the results obtained in other operating enironments may ary significantly. Some measurements may hae been made on deelopment-leel systems and there is no guarantee that these measurements will be the same on generally aailable systems. Furthermore, some measurements may hae been estimated through extrapolation. Actual results may ary. Users of this document should erify the applicable data for their specific enironment. Information concerning non-ibm products was obtained from the suppliers of those products, their published announcements or other publicly aailable sources. IBM has not tested those products and cannot confirm the accuracy of performance, compatibility or any other claims related to non-ibm products. Questions on the capabilities of non-ibm products should be addressed to the suppliers of those products. Trademarks The following terms are trademarks or registered trademarks of International Business Machines Corporation in the United States, other countries, or both: AIX DB2 IBM IBM logo SecureWay Tioli Tioli logo Uniersal Database WebSphere Lotus is a registered trademark of Lotus Deelopment Corporation and/or IBM Corporation. Domino is a trademark of International Business Machines Corporation and Lotus Deelopment Corporation in the United States, other countries, or both. Microsoft, Windows, Windows NT, and the Windows logo are trademarks of Microsoft Corporation in the United States, other countries, or both. 58 IBM Tioli Identity Manager: Serer Troubleshooting Guide

69 UNIX is a registered trademark of The Open Group in the United States and other countries. Jaa and all Jaa-based trademarks and logos are trademarks or registered trademarks of Sun Microsystems, Inc. in the United States and other countries. Other company, product, and serice names may be trademarks or serice marks of others. Appendix. Notices 59