Tivoli Identity Manager

Transcription

1 Tivoli Identity Manager Version 4.6 Directory Integrator-Based PeopleTools Adapter Installation and Configuration Guide SC

2

3 Tivoli Identity Manager Version 4.6 Directory Integrator-Based PeopleTools Adapter Installation and Configuration Guide SC

4 Note: Before using this information and the product it supports, read the information in Appendix C, Notices, on page 41. First Edition (August 2006) This edition applies to version 4, release 6, modification 0 of this adapter and to all subsequent releases and modifications until otherwise indicated in new editions. Copyright International Business Machines Corporation All rights reserved. US Government Users Restricted Rights Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

5 Contents Preface v Who should read this book v Publications and related information......v Tivoli Identity Manager library v Prerequisite product publications vii Related publications viii Accessing publications online viii Accessibility viii Support information viii Conventions used in this book ix Typeface conventions ix Operating system differences ix Definitions for HOME and other directory variables ix Chapter 1. Overview of the PeopleTools adapter Features of the PeopleTools adapter Architecture of the adapter Supported configurations Chapter 2. Installing the PeopleTools adapter Prerequisites Installing the PeopleTools adapter Installing the adapter Installing on other operating systems Configuring the PeopleTools Servlet on IBM Tivoli Identity Manager Creating an adapter user account Importing the adapter profile into the Tivoli Identity Manager server Creating a service Starting and stopping the adapter service Chapter 3. Configuring the PeopleTools adapter Configuring the PeopleSoft resource for PeopleTools v Setting the ClassPath environment variable...9 PeopleTools version 8.45 patch requirements...9 Modifying the PRG_USR_PROFILE Record Setting the environment variable for the PeopleTools adapter Loading the PeopleTools Project for Tivoli Identity Manager Loading the Component Interfaces Setting the Component Interface Security...11 PeopleSoft resource-specific jar files Generating the CompIntfc.jar file psjoa.jar file JDBC type 4 driver JAR file Configuration properties of the adapter Changing the port number for the RMI Dispatcher 15 Configuring logging for the adapter Naming the log file Sizing the log file Configuring logging levels Displaying logs in the user interface Appending information to an existing log file..16 Chapter 4. Configuring SSL authentication between Tivoli Identity Manager server and IBM Tivoli Directory Integrator Overview of SSL and digital certificates Private keys, public keys, and digital certificates 18 Self-signed certificates The use of SSL authentication Configuring certificates for SSL authentication...20 Configuring certificates for one-way SSL authentication Configuring certificates for two-way SSL authentication Chapter 5. Verifying the PeopleTools adapter profile installation Chapter 6. Troubleshooting the PeopleTools adapter Warning and error messages Logging information format Chapter 7. Uninstalling the PeopleTools adapter Appendix A. Adapter attributes Attribute descriptions Attributes by PeopleTools adapter actions System Login Add System Login Change System Login Delete System Login Suspend System Login Restore System Change Password Test Reconciliation Appendix B. Support information Searching knowledge bases Search the information center on your local system or network Search the Internet Contacting IBM Software Support Determine the business impact of your problem 38 Describe your problem and gather background information Copyright IBM Corp iii

6 Submit your problem to IBM Software Support 39 Appendix C. Notices Trademarks Index iv IBM Tivoli Identity Manager: Directory Integrator-Based PeopleTools Adapter Installation and Configuration Guide

7 Preface Who should read this book This installation guide provides the basic information that you need to install and configure the IBM Tivoli Identity Manager PeopleTools adapter (PeopleTools adapter). The PeopleTools adapter enables connectivity between the IBM Tivoli Identity Manager server and a managed resource. The Tivoli Identity Manager server is the server for your Tivoli Identity Manager product. This book is intended for operating system security administrators responsible for installing software on their site s computer systems. Readers are expected to understand operating system concepts. The person completing the PeopleTools adapter installation procedure must also be familiar with their site s system standards. Readers should be able to perform routine security administration tasks. Publications and related information Read the descriptions of the IBM Tivoli Identity Manager library. To determine which additional publications you might find helpful, read the Prerequisite product publications on page vii and the Related publications on page viii. After you determine the publications you need, refer to the instructions in Accessing publications online on page viii. Tivoli Identity Manager library The publications in the technical documentation library for your product are organized into the following categories: v Release information v Online user assistance v Server installation and configuration v Problem determination v Technical supplements v Adapter installation and configuration Release Information: v Release Notes Provides software and hardware requirements for the product, and additional fix, patch, and other support information. v Read This First card Lists the publications for the product. Online user assistance: Provides online help topics and an information center for administrative tasks. Server installation and configuration: Provides installation and configuration information for the product server. Problem determination: Copyright IBM Corp v

8 Provides problem determination, logging, and message information for the product. Technical supplements: The following technical supplements are provided by developers or by other groups who are interested in this product: v Performance and tuning information v Provides information needed to tune your production environment, available on the Web at: Click the I character in the A-Z product list to locate IBM Tivoli Identity Manager products. Click the link for your product, and then browse the information center for the Technical Supplements section. Redbooks and white papers are available on the Web at: IBMTivoliIdentityManager.html Browse to the Self Help section, in the Learn category, and click the Redbooks link. v Technotes are available on the Web at: v Field guides are available on the Web at: v For an extended list of other Tivoli Identity Manager resources, search the following IBM developerworks Web address: Adapter installation and configuration: The technical documentation library also includes a set of platform-specific installation documents for the adapter components of the product. Adapter information is available on the Web at: Passport_Advantage_Home Click Support & downloads. Browse to the Downloads and drivers. Click the link for the adapter. Skills and training: The following additional skills and technical training information were available at the time that this manual was published: v Virtual Skills Center for Tivoli Software on the Web at: v Tivoli Education Software Training Roadmaps on the Web at: v Tivoli Technical Exchange on the Web at: supp_tech_exch.html vi IBM Tivoli Identity Manager: Directory Integrator-Based PeopleTools Adapter Installation and Configuration Guide

9 Prerequisite product publications To use the information in this book effectively, you must have knowledge of the products that are prerequisites for your product. Publications are available from the following locations: v Operating systems IBM AIX Solaris Red Hat Linux Microsoft Windows Server v Database servers IBM DB2 Universal Database - Support: - Information center: index.jsp - Documentation: winos2unix/support/v8pubs.d2w/en_main - DB2 product family: - Fix packs: downloadv8.html - System requirements: sysreqs.html Oracle Microsoft SQL Server v Directory server applications IBM Directory Server en_us/html/ldapinst.htm Sun ONE Directory Server v WebSphere Application Server Additional information is available in the product directory or Web sites. v WebSphere embedded messaging v IBM HTTP Server Preface vii

10 Related Accessibility publications Information that is related to your product is available in the following publications: v The Tivoli Software Library provides a variety of Tivoli publications such as white papers, datasheets, demonstrations, Redbooks, and announcement letters. The Tivoli Software Library is available on the Web at: v The Tivoli Software Glossary includes definitions for many of the technical terms related to Tivoli software. The Tivoli Software Glossary is available from the Glossary link of the Tivoli Software Library Web page at: Accessing publications online IBM posts publications for this and all other Tivoli products, as they become available and whenever they are updated, to the Tivoli software information center Web site. Access the Tivoli software information center at the following Web address: Click the I character in the A-Z list, and then click the link for your product to access the product library. Note: If you print PDF documents on other than letter-sized paper, set the option in the File Print window that allows Adobe Reader to print letter-sized pages on your paper. The product documentation includes the following features to aid accessibility: v Documentation is available in convertible PDF format to give the maximum opportunity for users to apply screen-reader software. v All images in the documentation are provided with alternative text so that users with vision impairments can understand the contents of the images. Support information If you have a problem with your IBM software, you want to resolve it quickly. IBM provides the following ways for you to obtain the support you need: v Searching knowledge bases: You can search across a large collection of known problems and workarounds, Technotes, and other information. v Contacting IBM Software Support: If you still cannot solve your problem, and you need to work with someone from IBM, you can use a variety of ways to contact IBM Software Support. For more information about these ways to resolve problems, see Appendix B, Support information, on page 37. viii IBM Tivoli Identity Manager: Directory Integrator-Based PeopleTools Adapter Installation and Configuration Guide

11 Conventions used in this book Typeface This reference uses several conventions for special terms and actions and for operating system-dependent commands and paths. conventions This guide uses the following typeface conventions: Bold Italic v Lowercase commands and mixed case commands that are otherwise difficult to distinguish from surrounding text v Interface controls (check boxes, push buttons, radio buttons, spin buttons, fields, folders, icons, list boxes, items inside list boxes, multicolumn lists, containers, menu choices, menu names, tabs, property sheets), labels (such as Tip:, and Operating system considerations:) v Keywords and parameters in text v Words defined in text v Emphasis of words (words as words) v New terms in text (except in a definition list) v Variables and values you must provide Monospace v Examples and code examples v File names, programming keywords, and other elements that are difficult to distinguish from surrounding text v Message text and prompts addressed to the user v Text that the user must type v Values for arguments or command options Operating system differences This guide uses thewindows convention for specifying environment variables and for directory notation. When using the UNIX command line, replace %variable% with $variable for environment variables and replace each backslash (\) with a forward slash (/) in directory paths. The names of environment variables are not always the same in Windows and UNIX. For example, %TEMP% in the Windows operating system is equivalent to $tmp in a UNIX operating system. Note: If you are using the bash shell on a Windows system, you can use the UNIX conventions. Definitions for HOME and other directory variables The following table contains the default definitions that are used in this guide to represent the HOME directory level for various product installation paths. You can customize the installation directory and HOME directory for your specific implementation. If this is the case, you need to make the appropriate substitution for the definition of each variable represented in this table. The value of path varies for these operating systems: v Windows: drive:\program Files Preface ix

12 v AIX: /usr v Other UNIX: /opt Path Variable Default Definition Description DB_INSTANCE_HOME Windows: path\ibm\sqllib UNIX: The directory that contains the database for your Tivoli Identity v AIX, Linux : /home/dbinstancename Manager product. v Solaris: /export/home/dbinstancename LDAP_HOME v For IBM Directory Server Version 5.2 The directory that contains the Windows: directory server path\ibm\ldap code. UNIX: path/ibm/ldap AIX, Linux: path/ldap Solaris: path/ibmldaps v For IBM Directory Server Version 6.0 Windows: path\ibm\ldap UNIX: /opt/ibm/ldap/ AIX, Solaris: /opt/ibm/ldap/ Linux: /opt/ibm/ldap/ v For Sun ONE Directory Server Windows: path\sun\mps UNIX: /var/sun/mps IDS_instance_HOME For IBM Directory Server Version 6.0 Windows: drive\ idsslapd-instance_owner_name The directory that contains the IBM Directory Server Version 6.0 instance. The value of drive might be C:\. An example of instance_owner_name might be ldapdb2. For example, the log file might be C:\idsslapd-ldapdb2\logs\ ibmslapd.log. UNIX: INSTANCE_HOME/idsslapd-instance_name On Linux and AIX systems, the default home directory is the /home/instance_name/idsslapdinstance_name directory. On Solaris systems, for example, the directory is the /export/home/ldapdb2/idsslapdldapdb2. directory. x IBM Tivoli Identity Manager: Directory Integrator-Based PeopleTools Adapter Installation and Configuration Guide

13 Path Variable Default Definition Description HTTP_HOME ITIM_HOME WAS_HOME WAS_MQ_HOME WAS_NDM_HOME ITDI_HOME Windows: path\ibmhttpserver UNIX: path/ibmhttpserver Windows: path\ibm\itim UNIX: path/ibm/itim Windows: path\websphere\appserver UNIX: path/websphere/appserver Windows: path\ibm\websphere MQ UNIX: path/mqm Windows: path\websphere\deploymentmanager UNIX: path/websphere/deploymentmanager Windows: C:\Program Files\IBM\itim\itdi\home UNIX: path/ibm/itim/itdi/home The directory that contains the IBM HTTP Server code. The base directory that contains the Tivoli Identity Manager code, configuration, and documentation. The WebSphere Application Server home directory The directory that contains the WebSphere MQ code. The home directory on the Deployment Manager The directory where Tivoli Directory Integrator is installed. Tivoli_Common_Directory The ITDI_HOME directory contains the jars/connectors subdirectory that contains files for the adapters. For example, the jars/connectors subdirectory contains the files for the UNIX adapter. Note: If Tivoli Directory Integrator is not automatically installed with your Tivoli Identity Manager product, the default directory path for Tivoli Directory Integrator might be as follows: path/ibm/ibmdirectoryintegrator Windows: path\ibm\tivoli\common\ UNIX: path/ibm/tivoli/common/ The central location for all serviceability-related files, such as logs and first-failure data capture Preface xi

14 xii IBM Tivoli Identity Manager: Directory Integrator-Based PeopleTools Adapter Installation and Configuration Guide

15 Chapter 1. Overview of the PeopleTools adapter An adapter is a program that provides an interface between a managed resource and thetivoli Identity Manager server. Adapters can reside on the managed resource or elsewhere. The Tivoli Identity Manager server manages access to the resource by using your security system. Adapters function as trusted virtual administrators on the target platform, performing such tasks as creating login IDs, suspending IDs, and other functions that administrators perform manually. The adapter runs as a service, independent of whether a user is logged on to the Tivoli Identity Manager server. The PeopleTools adapter enables communication between the Tivoli Identity Manager server and the PeopleSoft server. The adapter runs on a machine on which Tivoli Directory Integrator has been installed. The adapter also needs the ITIM-RMI Dispatcher installed on the same machine as the Tivoli Directory Integrator instance. IBM Tivoli Identity Manager communicates with the dispatcher using Remote Method Invocation (RMI) calls. The dispatcher uses the installed Tivoli Directory Integrator to run the adapter. Note: PeopleTools is a supporting layer for all PeopleSoft Applications. Features of the PeopleTools adapter Architecture of the adapter You can use the PeopleTools adapter to automate the following administrative tasks: v Adding new users on the resource. v Modifying existing users attributes. v Changing the user account password. v Suspending, restoring, and deleting existing users. v Reconciling user and other support data such as languages, currency code, roles, and permissions. v Checking the connection between the PeopleSoft Application Server and IBM Tivoli Identity Manager. See Chapter 3, Configuring the PeopleTools adapter, on page 9 for more information on the supported functionality and configuration of the PeopleTools adapter. IBM Tivoli Identity Manager communicates with the PeopleTools adapter to administer users on the PeopleSoft resource. The adapter consists of a set of AssemblyLines. When the first request from the Tivoli Identity Manager server is initiated to the adapter, the corresponding AssemblyLine is loaded into the Tivoli Directory Integrator server. The AssemblyLines utilize the Tivoli Directory Integrator PeopleSoft Connector to perform user management related tasks on the PeopleSoft resource, using the login user ID and password of a user that has administrator privileges.. Copyright IBM Corp

16 Figure 1 shows the various components that work together to complete user management tasks in a IBM Tivoli Directory Integrator environment. Figure 1. The architecture of the PeopleTools adapter Supported configurations The PeopleTools adapter supports different configurations. The fundamental components in each environment are a Tivoli Identity Manager server, a Tivoli Directory Integrator server, a PeopleSoft Application Server and the PeopleTools adapter. In each configuration, the PeopleTools adapter must reside directly on the server running the Tivoli Directory Integrator server. For a single server configuration, you must install the IBM Tivoli Identity Manager server, the IBM Tivoli Directory Integrator Server, and the PeopleTools adapter on one server. The server communicates with a PeopleSoft Application Server, which is installed on a different server. See Figure 2. Tivoli Identity Manager Server Tivoli Directory Integrator Server Managed resource Adapter Figure 2. Example of a single server configuration 2 IBM Tivoli Identity Manager: Directory Integrator-Based PeopleTools Adapter Installation and Configuration Guide

17 Chapter 2. Installing the PeopleTools adapter Some adapters might be installed automatically with your IBM Tivoli Identity Manager product. If your adapter is automatically installed with the product, you do not need to install the adapter. The following sections provide information for installing and configuring the adapter. Before installing the PeopleTools adapter ensure that the following prerequisites are installed. Prerequisites This table lists the software requirements that are required by the PeopleTools adapter. Table 1. Software prerequisites for the PeopleTools adapter Software Version IBM Tivoli Directory Integrator 6.0 Fix Pack 3.0 or higher fix pack levels IBM Tivoli Identity Manager Enterprise server or IBM Tivoli Identity Manager Express server 4.6 PeopleSoft Enterprise 8.4 PeopleTools Software 8.45, 8.46 You can install PeopleTools adapters on all platforms that are supported by IBM Tivoli Directory Integrator 6.0. The PeopleTools adapter must be installed on the same system where the Tivoli Directory Integrator server is installed.. For information on the prerequisites and supported operating systems for the IBM Tivoli Directory Integrator, see the IBM Tivoli Directory Integrator 6.0: Administrator Guide. Installing the PeopleTools adapter If the PeopleTools adapter is not automatically installed with your IBM Tivoli Identity Manager product, use the adapter installer to manually install the adapter. The PeopleTools adapter has several different types of installer binaries. Select the one appropriate for your operating system: v For AIX operating systems - PeopleToolsAdapterInstall_aix.bin v For HPUX operating systems - PeopleToolsAdapterInstall_hpux11i.bin v For Linux operating systems - PeopleToolsAdapterInstall_linux.bin v For Solaris operating systems - PeopleToolsAdapterInstall_solaris_sparc.bin v For Windows operating systems - PeopleToolsAdapterInstall_win.exe v For other operating systems - PeopleToolsAdapterInstall.jar Installing the adapter To manually install the adapter, first ensure that the installer is run on the same system where the Tivoli Directory Integrator is installed. Then complete these steps. Copyright IBM Corp

18 Note: All directory paths apply to Windows operating systems. Change the directory paths as needed for UNIX operating systems. 1. Download the PeopleTools adapter compressed file from the IBM Web site. Contact your IBM account representative for the Web address and download instructions. 2. Extract the contents of the compressed file into a temporary directory and navigate to that directory. 3. Start the installation program using the PeopleToolsAdapterInstall file in the temporary directory. For example, select Run... from the Start menu and type C:\Temp\PeopleToolsAdapterInstall_win.exe in the Open field. 4. On the Welcome window, click Next. 5. On the License Agreement window, review the license agreement and decide if you accept the terms of the license. If you do, click Accept, and then click Next. 6. On the Tivoli Directory Integrator Based PeopleSoft Adapter window, specify the location where IBM Tivoli Directory Integrator is installed. You can accept the default location or click Browse to specify a different directory. Then, click Next. 7. On the Installation Summary window, review the installation settings. Click Back to change any of these settings. Otherwise, click Next. 8. On the confirmation window that displays the components to be installed and the upgrades to be completed, click Next to begin the installation. Otherwise, click Back to make changes. 9. On the Installation Completed window, click Finish to exit the program. The log file is generated in the same directory where the PeopleTools adapter installer was invoked. Installing on other operating systems The PeopleTools adapter provides an additional installation program that is a Java-based installer. If you are running the IBM Tivoli Directory Integrator on operating systems that do not provide installer binaries, use the Java-based installation to install the PeopleTools adapter. Note: The PeopleToolsAdapterInstall.jar is a Java-based installer. Ensure that Java is installed and correctly configured for your system. Run this installation program on the server in which Tivoli Directory Integrator is installed. Launch the installation with the following command: Java -jar PeopleToolsAdapterInstall.jar Configuring the PeopleTools Servlet on IBM Tivoli Identity Manager 4.6 The PeopleTools adapter requires that the PeopleTools Servlet be deployed onto IBM Tivoli Identity Manager 4.6. See the document file, PT84 AddServlet Deployment.doc, provided with the PeopleTools adapter software for the steps to deploy the PeopleTools Servlet for WebSphere and WebLogic. Note: These configuration settings are needed for IBM Tivoli Identity Manager 4.6 only. Other versions of IBM Tivoli Identity Manager do not require these steps. 4 IBM Tivoli Identity Manager: Directory Integrator-Based PeopleTools Adapter Installation and Configuration Guide

19 Creating an adapter user account You must create a user account for the PeopleTools adapter on the managed resource. Account information is provided when you create a service. In addition, the adapter requires an account on the underlying PeopleSoft RDBMS. The accounts must be able to remotely connect to the PeopleSoft server and the associated RDBMS and have sufficient privileges to administer PeopleSoft users. The account information must be supplied on the PeopleTools adapter service form. See Creating a service for information about creating a service. Importing the adapter profile into the Tivoli Identity Manager server Creating a service An adapter profile defines the types of resources that the Tivoli Identity Manager server can manage. The profile is used to create a service on the Tivoli Identity Manager server. You must import the PeopleTools adapter profile, PeopleToolsProfile.jar, into the Tivoli Identity Manager server before using the PeopleTools adapter. Before you import the adapter profile, verify that the following conditions are met: v The Tivoli Identity Manager server is installed and running. v You have root or Administrator authority on the Tivoli Identity Manager server. The adapter profile is included in the JAR file for the adapter. To import the adapter profile, complete these steps: 1. Log in to the Tivoli Identity Manager server using an account that has the authority to perform administrative tasks. 2. Import the adapter profile using the import feature for your IBM Tivoli Identity Manager product. Refer to the information center or the online help for specific instructions about importing the adapter profile. When you import the adapter profile, if you receive an error related to the schema, refer to the trace.log file for information about the error. The trace.log file location is specified using the handler.file.filedir property defined in the IBM Tivoli Identity Manager enrolelogging.properties file. The enrolelogging.properties file is installed in the IBM Tivoli Identity Manager \data directory. You must create a service for the PeopleTools adapter before the Tivoli Identity Manager Server can use the adapter to communicate with the managed resource. You must use the service profile for your operating system to create a service for that operating system. The PeopleTools adapter profile name is PeopleTools Profile. When adding a service, you must complete the Add New Service form. This form is accessed through the Tivoli Identity Manager server GUI. To add a service: 1. Log in to the Tivoli Identity Manager server using an account that has the authority to perform administrative tasks. 2. Create the service using the information for your Tivoli Identity Manager product. See the information center or the online help for specific instructions about creating a service. 3. On the Select Type of Service window, select the service type (PeopleTools Profile) from the Service Type drop-down menu. Chapter 2. Installing the PeopleTools adapter 5

20 To create or change a service, you must use the service form to provide information for the service. Service forms might vary depending on the adapter. The PeopleTools adapter service form contains the following fields: ITIM PeopleTools service Service name Specify a name that defines this service on the Tivoli Identity Manager Server. Description Optional: Specify a description for this service. Tivoli Directory Integrator location Optional: Specify the URL for the IBM Tivoli Directory Integrator instance. Valid syntax is rmi://ip-address:port/itdidispatcher, where ip-address is the Tivoli Directory Integrator host and port is the port number for the RMI Dispatcher. The default URL is rmi://localhost:16231/itdidispatcher. See Changing the port number for the RMI Dispatcher on page 15 for information about changing the port number. Owner Optional: Specify a IBM Tivoli Identity Manager user as a service owner. Service prerequisite Optional: Specify a IBM Tivoli Identity Manager service that is a prerequisite to this service. PS connection APP Server name Specify the name or IP address of the PeopleTools Application Server to be managed. APP Server port Specify the port number used to connect to the PeopleTools Application Server. This is the IP port number on which the PeopleTools Application Server listens for JOLT connections. This value is typically port APP ID password Specify the name of the PeopleTools account created for the PeopleTools adapter. Note: The following four connection parameters are used only if the total retrieved records are greater than 300. JDBC driver Specify the database type 4 JDBC driver. For example, the JDBC driver for IBM DB2 database connectivity is: com.ibm.db2.jcc.db2driver JDBC See JDBC type 4 driver JAR file on page 13 for more information. URL Specify the Web address that is used to connect to the PeopleSoft tables. For example, the connectivity JDBC URL for IBM DB2 database is: 6 IBM Tivoli Identity Manager: Directory Integrator-Based PeopleTools Adapter Installation and Configuration Guide

21 jdbc:db2:// :50000/ptdb jdbc:db2://ip address:port/database name See JDBC type 4 driver JAR file on page 13 for more information. Database user name Specify the administrator user name that is used to connect to the database. Database user password Specify the password for the database user. Starting and stopping the adapter service After the installation of the PeopleTools adapter, the adapter service is started automatically. If you later edit the properties file for the adapter, you must stop and restart the adapter service in order for the changes to take effect. The method used to stop and restart the adapter depends on the operating system: AIX The adapter installer creates a subsystem called ITIMAd when the adapter is first installed. ITIM_RMI.xml is the configuration file. Use these commands to start and stop the adapter service. startsrc s ITIMAd stopsrc c s ITIMAd The adapter service runs the ibmdisrv.bat command. The bat file starts a Java process that does not stop when the adapter service is stopped. To stop this process, obtain the process ID (PID) and then end the process. v To obtain the PID of the process, type this command: ps -ef grep ITDI_HOME_DIR/_jvm/jre/bin/, where ITDI_HOME_DIR is the directory where IBM Tivoli Directory Integrator is installed. v To end the process, type this command: kill -9 pid. HP-UX From the IBM Tivoli Directory Integrator Solution Directory, type these commands to start, stop, and restart the adapter service. ITIMAd start ITIMAd stop ITIMAd restart Linux or Solaris The adapter installer automatically copies the ITIMAd script file to the /etc/init.d/ directory when the adapter is installed. From the /etc/init.d/ directory, type these commands to start, stop, and restart the adapter service. ITIMAd start ITIMAd stop ITIMAd restart Windows From the Control Panel, select Administrative Tools > Services. From the Services menu, you can start and stop the adapter service. The service name is IBM Tivoli Directory IntegratorAdapter. Chapter 2. Installing the PeopleTools adapter 7

22 8 IBM Tivoli Identity Manager: Directory Integrator-Based PeopleTools Adapter Installation and Configuration Guide

23 Chapter 3. Configuring the PeopleTools adapter After the adapter is installed, you need to perform the following configuration task. Configuring the PeopleSoft resource for PeopleTools v8.45 The following resource configuration settings are required only if the PeopleTools Adapter is used with the PeopleTools version These configuration settings do not apply to other versions of PeopleTools. Before running the PeopleTools Adapter with PeopleTools version 8.45, ensure that following two configuration changes have been made: Setting the ClassPath environment variable For the example used in this task, the PeopleSoft installation directory PeopleSoft_Home is E:\PS\PT845. If you have not already done so, log onto the machine where the adapter and the Tivoli Directory Integrator are installed. 1. Locate the PSKeyStore.class file. It is located in the Web server installation directory. On a Windows installation it is in PeopleSoft_Home\webserv\ PIA_DOMAIN\applications\peoplesoft\PORTAL\WEB-INF\classes\psft\pt8\ pshttp directory. For example: E:\PS\PT845\webserv\peoplesoft_84512\ applications\peoplesoft\portal\web-inf\classes\psft\pt8\pshttp. 2. On the Machine where you are running the PeopleTools adapter, create a folder structure of psft/pt8. For example, E:\PS\psft\pt8. 3. Locate the pshttp folder (E:\PS\PT845\webserv\peoplesoft_84512\ applications\peoplesoft\portal\web-inf\classes\psft\pt8\pshttp) and copy that folder and its subfolders to the E:\PS\psft\pt8 folder structure you just created. The resulting folder structure is now E:\PS\psft\pt8\pshttp. 4. Add the directory path that contains the psft folder (E:\PS) to the CLASSPATH variable on the PeopleSoft Connector machine. PeopleTools version 8.45 patch requirements The PeopleSoft connector requires PeopleTools version Note: If you are already using the PeopleTools version , this task is not required. If you have not already done so, log onto the machine where the adapter and the Tivoli Directory Integrator are installed. The PeopleTools patches must be applied in two steps: 1. Upgrade the current PeopleTools installation. 2. Setup with the PeopleTools bundle. See your PeopleTools documentation for more information about applying patches. Copyright IBM Corp

24 Modifying the PRG_USR_PROFILE Record Modify the PRG_USER_PROFILE record using the PeopleSoft Application Designer. 1. Log into the PeopleTools Application Designer using the PeopleTools Adapter s PeopleTools account. 2. From the File menu, click Open. The Open Definition dialog window is displayed. 3. Select Record from the Definition drop-down listbox, enter PRG in the Name field and click Open. A list of matching records is displayed in the Definitions matching selection criteria pane. 4. Select PRG_USR_PROFILE and click the Open. The record is opened in the Application Designer. 5. From within the Record Fields tabbed pane, right-click the OPRID table entry and click View PeopleCode from the right-click menu. The PeopleCode window opens. 6. Select SaveEdit from the PeopleCode Event drop-down listbox. The following PeopleCode is displayed in the PeopleCode edit pane. If %OperatorId <> PRG_USR_PROFILE.OPRID Then If %Panel = Panel.PURGE_USR_PROFILE Then Warning MsgGet(48, 122, "Select OK to confirm deletion of User Profile or select Cancel.") End-If; Else Error MsgGet(48, 109, "Message not found."); End-If; 7. Replace the existing PeopleCode with the following: If %OperatorId <> PRG_USR_PROFILE.OPRID Then If %CompIntfcName <> "ENROLE_DELETE" Then If %Panel = Panel.PURGE_USR_PROFILE Then Warning MsgGet(48, 122, "Select OK to confirm deletion of User Profile or select Cancel.") End-If; End-If Else Error MsgGet(48, 109, "Message not found."); End-If; 8. From the File menu, click Save to save the record. Setting the environment variable for the PeopleTools adapter. The following environment settings are required for PeopleTools Adapter for PeopleTools v8.45 and v8.46: If you have not already done so, log onto the machine where the adapter and the Tivoli Directory Integrator are installed. 1. Create a system environment CLASSPATH variable with value PS_HOME\class\psjoa.jar (for example, D:\PT8.4x\class\psjoa.jar). 2. Add the path of the PeopleSoft APIs folder PS_HOME\bin\client\winx86 (for example, D:\PT8.4x\bin\client\winx86), to the System Environment PATH variable. 10 IBM Tivoli Identity Manager: Directory Integrator-Based PeopleTools Adapter Installation and Configuration Guide

25 Loading the PeopleTools Project for Tivoli Identity Manager The Project file PT84_COMPONENT.zip (for PeopleTools 8.45 and PeopleTools 8.46) is provided with the Tivoli Identity Manager PeopleTools Adapter software that contains component interfaces. These interfaces are located in the ENROLE_AGENT subdirectory. This subdirectory is imported into the PeopleTools Application Designer as a PeopleTools Project. Loading the Tivoli Identity Manager-specific PeopleTools project a two part procedure. 1. The project must be copied into the PeopleTools system. See Loading the Component Interfaces. 2. The project security must be set. The following two sections provide detailed procedures on how to load the PeopleTools project for Tivoli Identity Manager. See Setting the Component Interface Security. Loading the Component Interfaces To import the ENROLE_AGENT directory into the PeopleTools Application Designer as a PeopleTools Project: 1. Extract ENROLE_AGENT and its contents into a temporary directory on your file system. 2. Log into the PeopleTools Application Designer using the Adapter s PeopleTools account. 3. Copy the ENROLE_AGENT project: a. From the Tools menu, select Copy Project and then select From File from the submenu. The Copy Project from File dialog window is displayed. b. Browse to the directory where you extracted ENROLE_AGENT. ENROLE_AGENT is displayed in the Projects: list area. c. Ensure that ENROLE_AGENT is highlighted and click Open. The ENROLE_AGENT project is loaded. A second dialog window is displayed. d. Ensure that Component Interfaces is highlighted and click Copy. The component interfaces are loaded into PeopleTools 4. Exit the PeopleTools Application Designer. Setting the Component Interface Security To set security for the PeopleTools project: 1. Log into the PeopleSoft Web interface using the adapter s PeopleTools account. 2. From the PeopleSoft menu tree, navigate to PeopleTools Security Permissions & Roles Permission Lists. 3. Click the ALLPAGES permission list link. The Permission List component is displayed. 4. Click the Component Interface tab and add the following Component Interfaces to the list: ENROLE_CCODE ENROLE_DELETE ENROLE_LANGS ENROLE_PERM ENROLE_ROLES ENROLE_USERS 5. Set Full Access for each method of the component interfaces added in the previous step. 6. Save your changes. Chapter 3. Configuring the PeopleTools adapter 11

26 PeopleSoft resource-specific jar files The PeopleTools adapter uses Java APIs to communicate and performing the operations (add, delete, modify and search) on PeopleSoft resource. To utilize the functionality the PeopleTools Adapter requires following jars: CompIntfc.jar The Java API JAR file for the ENROLE_AGENT Component Interface project. psjoa.jar This file is created during the PeopleTools installation. The path to the psjoa.jar file must be set to the ITDI CLASSPATH variable. JDBC type 4 driver JAR file This JAR file is required to establish the connection with the database. Generating the CompIntfc.jar file This file is the PeopleSoft Component Interface JAR file. It must be generated from the respective PeopleSoft resource and then copied in the ITDI_HOME\jars directory on the machine where the adapter is installed. Perform the following the steps to create the CompIntfc.jar file from the Component interface JAVA files. psjoa.jar 1. Logon to PeopleSoft Application Designer in two tier mode. 2. Open the ENROLE_AGENT Component Interface project and open all the component interfaces by double clicking each component interface. 3. From the menu select Build PeopleSoft APIs. 4. In the JAVA Classes frame check Build and select the appropriate Component Interfaces from the drop down menu. Note: If you need to generate Component Interface Java files for the entire group of Component Interfaces click ALL. Specify the appropriate file path for the JAVA files; otherwise the JAVA files are generated in the default location, PEOPLESOFT_HOME\web\psjoa\ PeopleSoft\Generated\CompIntfc. The Component Interface JAVA files are generated to the specified location. For example, if you specified to generate the Component Interface JAVA files for the USER_PROFILE Component Interface, the files are generated at the default location. 5. Open the Command prompt and change directories to the folder where the generated JAVA files are located. 6. Compile the JAVA files by issuing the following commands: javac d classdir *.java cd classdir jar cvf CompIntfc.jar * where classdir is a temporary directory created for holding class files. Note: Ensure that you are using the JAVA version compiler. 7. Copy the generated CompIntfc.jar file to the ITDI_HOME\jars directory. file This file is created during the PeopleTools installation. Copy the psjoa.jar file from the PEOPLESOFT_HOME\web\psjoa location to the ITDI_HOME\jars directory on the machine where the adapter is installed. 12 IBM Tivoli Identity Manager: Directory Integrator-Based PeopleTools Adapter Installation and Configuration Guide

27 JDBC type 4 driver JAR file This file is needed because, by default, the find method of a PeopleSoft Component Interface gets a maximum of 300 entries from PeopleSoft. If more than three hundred entries need to be retrieved, the PeopleSoft Connector needs to invoke JDBC queries on PeopleSoft database tables. The path to the JDBC_driver.jar file for the database that is used by PeopleSoft, must be copied to the ITDI_HOME\jars directory. The PeopleTools adapter establishes the connection directly with the database if it finds more than 300 records to be retrieved. The PeopleTools adapter uses the JDBC Type 4 drivers to retrieve more than 300 records. To establish the connection to the database you need to specify the appropriate driver class and a URL of the correct format. For example: PeopleSoft configured with the DB2: JDBC Driver Drivers: db2jcc.jar db2jcc_javax.jar db2jcc_license_cu.jar Class com.ibm.db2.jcc.db2driver URL jdbc:db2://machine:50000/database PeopleSoft configured with the Microsoft SQL Server: JDBC Drivers: msbase.jar mssqlserver.jar msutil.jar Driver URL Configuration properties of the adapter Table 2. Configuration properties for the adapter Class com.microsoft.sqlserver.jdbc.sqlserverdriver jdbc:microsoft:sqlserver:// machine_name:port;selectmethod=cursor;datab asename=database The global.properties and the itim_listener.properties files contain the configuration properties for the adapters. To configure the properties for an adapter, you must change one of these files. Table 2 lists the properties contained in the properties files. Property Properties file Description ALShutdownTimeout itim_listener.properties Specifies the amount of time, in milliseconds, before the RMI Dispatcher should shutdown when a shutdown request is sent to the dispatcher. All assembly lines that are being maintained are terminated when the dispatcher shuts down. The default value is 300,000 (milliseconds), which is five minutes. Chapter 3. Configuring the PeopleTools adapter 13

28 Table 2. Configuration properties for the adapter (continued) Property Properties file Description com.ibm.di.dispatcher.bindname global.properties Specifies the RMI bind name to be used. The default value is ITDIDispatcher. com.ibm.di.dispatcher.disableconntectorcache global.properties Specifies whether or not the RMI Dispatcher should cache the connection to the managed resource so that no new connections are established upon subsequent calls. In this case, the same connection is used for all calls. The default value is true. com.ibm.di.dispatcher.registryport global.properties Specifies the port on which the RMI Dispatcher listens for provisioning requests from IBM Tivoli Identity Manager. The default value is ConnectorSleepTimeOut itim_listener.properties Specifies the amount of time, in milliseconds, to wait before deleting connectors that have not been used. The default value is 120,000 (milliseconds), which is two minutes. MaximumConnectorsPerResource itim_listener.properties Specifies the maximum number of connectors that exist for a particular resource. The default value is 10. ReaperThreadTimeOut itim_listener.properties Specifies the amount of time, in milliseconds, to wait between successive runs of the connector reaper thread. The default value is 300,000 (milliseconds), which is five minutes. SearchALUnusedTimeout itim_listener.properties Specifies the amount of time, in milliseconds, to wait before deleting assembly lines that have not been used. The default value is 600,000 (milliseconds), which is 10 minutes. SearchReaperThreadTimeOut itim_listener.properties Specifies the amount of time, in milliseconds, to release data from memory. This property is used during a reconciliation response. The default value is 300,000 (milliseconds), which is five minutes. SearchResultSetSize itim_listener.properties Specifies the number of records, per response, returned during a reconciliation between IBM Tivoli Identity Manager and the adapter. The default value is IBM Tivoli Identity Manager: Directory Integrator-Based PeopleTools Adapter Installation and Configuration Guide

29 Changing the port number for the RMI Dispatcher If the Remote Method Invocation (RMI) Dispatcher is run as a service, by default, the port number is The installer automatically sets this parameter in the global.properties file. If the IBM Tivoli Directory Integrator home directory is the same directory as the IBM Solutions directory, change the port number in the global.properties file. Otherwise, change the port number in the solutions.properties file in the IBM Solutions directory. To change the port number for the dispatcher, complete these steps. 1. Stop the service that is used to run the adapter. Refer to Starting and stopping the adapter service on page 7 for information about stopping and starting the PeopleTools adapter service. 2. Change the global.properties file or the solutions.properties file to use the correct port number. com.ibm.di.dispatcher.registryport= Start the service again. Configuring logging for the adapter Log files might provide information that is helpful for diagnosing and troubleshooting problems with the adapter. The type of information collected in the log file is determined by the settings in the log4j.properties file. To configure logging for the adapter, you must update this file. This file is located in the Tivoli Directory Integrator Solutions directory. When multiple adapters are running on the same server where IBM Tivoli Directory Integrator is installed, logging information for the adapters is stored in the same log file. The RMI Dispatcher logs are also stored in this log file. You cannot configure logging to store information about the different components in different log files. After you complete the changes to the log4j.properties file, you must stop and restart the service for the adapter to view the configuration changes. The following sections contain information about configuring logging for the adapter. Naming the log file The following entry in the log4j.properties file is used to configure the name of the log file: log4j.appender.default.file. To change the name of the log file, change the value of the following entry in the log4j.properties file: log4j.appender.default.file. In the example below, the log file generated is ibmdi.log. log4j.appender.default.file=ibmdi.log Sizing the log file The following entry in the log4j.properties file is used to configure the maximum size of the log file: log4j.appender.default.maxfilesize. For example, log4j.appender.default.maxfilesize=8mb Chapter 3. Configuring the PeopleTools adapter 15

30 The number of log files generated is determined by the log4j.appender.default.maxbackupindex entry. In the example below, the number of log files generated is 10. log4j.appender.default.maxbackupindex=10 Configuring logging levels The logging level is determined by the log4j.rootcategory attribute in the log file. The four levels for logging information are ERROR, WARN, INFO, and DEBUG. By default the logging level is set to INFO. ERROR The ERROR level logs only error conditions. The ERROR level provides the smallest amount of logging information. INFO The INFO level logs information about workflow. It generally explains how an operation occurs. WARN The WARNING level logs information when an operation completes successfully but there are issues with the operation. See Chapter 6, Troubleshooting the PeopleTools adapter, on page 27 for more information. DEBUG The DEBUG level logs all of the details related to a specific operation. This is the highest level of logging. If logging is set to DEBUG, all other levels of logging information are displayed in the log file. Displaying logs in the user interface If the RMI Dispatcher was started from the command prompt by calling ibmdisrv.bat (Windows only), the logs can be displayed in the user interface. To display the logs in the user interface, change the value of the following entry in the log4j.properties file: log4j.appender.default. For example, log4j.appender.default=org.apache.log4j.consoleappender Appending information to an existing log file By default, log file information is deleted and created again each time the RMI Dispatcher starts. To append information to an existing log file before or after the dispatcher starts, change the value of the following entry from false to true in the log4j.properties file: log4jappender.default.append. For example, log4j.appender.default.append=true 16 IBM Tivoli Identity Manager: Directory Integrator-Based PeopleTools Adapter Installation and Configuration Guide

31 Chapter 4. Configuring SSL authentication between Tivoli Identity Manager server and IBM Tivoli Directory Integrator In order to establish a secure connection between the adapter and the Tivoli Identity Manager server, you must configure the Tivoli Directory Integrator and the Tivoli Identity Manager server to use the Secure Sockets Layer (SSL) authentication. SSL authentication provides encryption of the data exchanged between two applications. Encryption makes data transmitted over the network intelligible only to the intended recipient. Note: If you are using a single server configuration, you do not need to use SSL authentication. For information about using a single server configuration, refer to Supported configurations on page 2. By configuring the Tivoli Directory Integrator for SSL, you ensure that the Tivoli Identity Manager server verifies the identity of the adapter before a secure connection is established. You can configure SSL authentication for connections that originate from the Tivoli Identity Manager server. The Tivoli Identity Manager server initiates a connection to the adapter in order to set or retrieve the value of a managed attribute on the adapter. In a production environment, you must enable SSL security; however, for testing purposes you might want to disable SSL. If an external application that communicates with the adapter (such as the Tivoli Identity Manager server) is set to use server authentication, you must enable SSL for the Tivoli Directory Integrator to verify the certificate that the application presents. This chapter contains an overview of SSL authentication, certificates, and how to enable SSL authentication using the ikeyman command. Overview of SSL and digital certificates When you deploy IBM Tivoli Identity Manager in an enterprise network, you must secure communication between the Tivoli Identity Manager server and the software products and components with which the server communicates. The industry-standard SSL protocol uses signed digital certificates from a certificate authority (CA) to secure communication in a IBM Tivoli Identity Manager deployment. A signed digital certificate is an industry-standard method of verifying the authenticity of an entity, such as a server, client, or application. Signed certificates are issued by a third-party certificate authority for a fee. Some utilities, such as the ikeyman utility, can also issue signed certificates. Signed digital certificates enable two applications connecting in a network to authenticate each other s identity. For example, an application acting as an SSL server presents its credentials in a signed digital certificate to verify to an SSL client that it is the entity it claims to be. An application acting as an SSL server can also be configured to require the application acting as an SSL client to present its credentials in a certificate, thereby completing a two-way exchange of certificates. Copyright IBM Corp

32 A CA certificate must be installed to verify the origin of a signed digital certificate. When an application receives another application s signed certificate, it uses a CA certificate to verify the originator of the certificate. Many applications, such as Web browsers, are configured with the CA certificates of well known certificate authorities to eliminate or reduce the task of distributing CA certificates throughout the security zones in a network. Private keys, public keys, and digital certificates Keys, digital certificates, and trusted certificate authorities are used to establish and verify the identities of applications. SSL uses public key encryption technology for authentication. Public key encryption requires that a public key and a private key be generated for an application. Data encrypted with the public key can only be decrypted using the corresponding private key. Data encrypted with the private key can only be decrypted using the corresponding public key. The private key is stored in a key database file that is password-protected. Only the owner of the private key can access the private key to decrypt messages that are encrypted using the corresponding public key. In order to ensure maximum security, a certificate is issued by a third-party certificate authority. A certificate contains the following information to verify the identity of an entity: Organizational information Public This section of the certificate contains information that uniquely identifies the owner of the certificate, such as organizational name and address. You supply this information when you generate a certificate using a certificate management utility. key The receiver of the certificate uses the public key to decipher encrypted text sent by the certificate owner to verify its identity. A public key has a corresponding private key that encrypts the text. Certificate authority s distinguished name The issuer of the certificate identifies itself with this information. Digital Self-signed signature The issuer of the certificate signs it with a digital signature to verify its authenticity. This signature is compared to the signature on the corresponding CA certificate to verify that the certificate originated from a trusted certificate authority. Web browsers, servers, and other SSL-enabled applications generally accept as genuine any digital certificate that is signed by a trusted certificate authority and is otherwise valid. For example, a digital certificate can be invalidated because it has expired or the CA certificate used to verify it has expired, or because the distinguished name in the digital certificate of the server does not match the distinguished name specified by the client. certificates You can use self-signed certificates to test an SSL configuration before you create and install a signed certificate issued by a certificate authority. A self-signed certificate contains a public key, information about the owner of the certificate, and the owner s signature. It has an associated private key, but it does not verify the origin of the certificate through a third-party certificate authority. Once you 18 IBM Tivoli Identity Manager: Directory Integrator-Based PeopleTools Adapter Installation and Configuration Guide

33 generate a self-signed certificate on an SSL server application, you must extract it and add it to the certificate registry of the SSL client application. This procedure is the equivalent of installing a CA certificate that corresponds to a server certificate. However, you do not include the private key in the file when you extract a self-signed certificate to use as the equivalent of a CA certificate. Use a key management utility, such as the ikeyman utility, to generate a self-signed certificate and a private key, to extract a self-signed certificate, and to add a self-signed certificate. Where and how you choose to use self-signed certificates depends on your security requirements. In order to achieve the highest level of authentication between critical software components, do not use self-signed certificates, or use them selectively. For example, you can choose to authenticate applications that protect server data with signed digital certificates, and use self-signed certificates to authenticate Web browsers or IBM Tivoli Identity Manager adapters. If you are using self-signed certificates, in the following procedures you can substitute a self-signed certificate for a certificate and CA certificate pair. The use of SSL authentication When a Tivoli Directory Integrator component is used as a server, SSL mandates that a keystore be defined for and used by the Tivoli Directory Integrator. When a Tivoli Directory Integrator component is used as a client, SSL mandates that a truststore be defined for and used by the Tivoli Directory Integrator. A keystore is a database of private keys and the associated certificates needed to authenticate the corresponding public keys. Digital certificates are stored in a keystore file. A keystore also manages certificates from trusted entities. A truststore is a database of public keys for target servers. A truststore file is a key database file that contains the public keys for target servers. The public key is stored as a signer certificate. If the target uses a self-signed certificate, you must extract the public certificate from the server keystore file. The global.properties file or the solutions.properties file specifies the properties for the Tivoli Directory Integrator server and the Tivoli Directory Integrator components running on the Tivoli Directory Integrator server. If the solutions directory does not exist, these properties are defined in the global.properties file. If the solutions directory exists, the properties are defined in the solutions.properties file in the Tivoli Directory Integrator Solutions directory. To use SSL authentication for the Tivoli Directory Integrator, complete these steps: 1. From the ITDI_HOME directory, edit the global.properties file. The example below includes the values that must be changed. Substitute the actual keystore for the keystore provided in the example. v javax.net.ssl.keystore= C:\itdicertkeys\idiserver.jks v v javax.net.ssl.keystorepassword=secret javax.net.ssl.keystoretype=jks v javax.net.ssl.truststore= C:\itdicertkeys\idiserver.jks v v javax.net.ssl.truststorepassword=secret javax.net.ssl.truststoretype=jks Chapter 4. Configuring SSL authentication between Tivoli Identity Manager server and IBM Tivoli Directory Integrator 19

34 v v api.remote.on=false javax.net.debug=ssl v com.ibm.di.dispatcher.ssl=true 2. From the ITDI_HOME\_jvm\jre\lib\security\ directory (for example, C:\Program Files\IBM\itim\itdi\home\_jvm\jre\lib\security\), make these changes to the java.security file: v v v v security.provider.1=com.ibm.jsse.ibmjsseprovider security.provider.2=com.ibm.crypto.provider.ibmjce security.provider.3=com.ibm.security.jgss.ibmjgssprovider security.provider.4=com.ibm.security.cert.ibmcertpath v ## SSLServerSocketFactory Provider v ssl.serversocketfactory.provider=com.ibm.jsse.jsseserversocketfactory 3. Restart the service you created for the adapter. In the imdi.log file, ensure that the value for ssl is true (for example, ssl=true), and the RMI Dispatcher is using the SecureRMIServerFactory. Configuring certificates for SSL authentication Use the following procedures to configure the Tivoli Directory Integrator for one-way or two-way SSL authentication using signed certificates. In order to perform these procedures, use a key management tool. Configuring certificates for one-way SSL authentication In this scenario, the Tivoli Identity Manager server and the Tivoli Directory Integrator are set to use SSL. Client authentication is not set on either application. The Tivoli Identity Manager server operates as the SSL client and initiates the connection. The Tivoli Directory Integrator operates as the SSL server and responds by sending its signed certificate to the Tivoli Identity Manager server. The Tivoli Identity Manager server uses the CA certificate that is installed to validate the certificate sent by the Tivoli Directory Integrator. In Figure 3, the first application operates as the Tivoli Identity Manager server, and the second application operates as the Tivoli Directory Integrator. Tivoli Identity Manager Server (SSL client) 1 Hello Tivoli Directory Integrator (SSL server) Keystore CA Certificate A Verify Send Certificate B Certificate A Figure 3. One-way SSL authentication (server authentication) In order to configure one-way SSL, complete these tasks for each application. The tasks use the ikeyman key management utility. Read the documentation for the ikeyman utility for additional information about using the utility. 20 IBM Tivoli Identity Manager: Directory Integrator-Based PeopleTools Adapter Installation and Configuration Guide