Siebel JDB Adapter Installation and Configuration Guide

Transcription

1 IBM Security Identity Manager Version 6.0 Siebel JDB Adapter Installation and Configuration Guide SC

2

3 IBM Security Identity Manager Version 6.0 Siebel JDB Adapter Installation and Configuration Guide SC

4 Note Before using this information and the product it supports, read the information in Notices on page 51. Edition notice Note: This edition applies to ersion 6.0 of IBM Security Identity Manager (product number 5724-C34) and to all subsequent releases and modifications until otherwise indicated in new editions. Copyright IBM Corporation 2012, US Goernment Users Restricted Rights Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

5 Contents Figures Tables ii Preface ix About this publication ix Access to publications and terminology..... ix Accessibility x Technical training x Support information x Statement of Good Security Practices x Chapter 1. Oeriew of the adapter... 1 Features of the adapter Architecture of the adapter Supported configurations Chapter 2. Preparation for the adapter installation Preinstallation roadmap Installation roadmap Prerequisites to install the adapter Prerequisites to use the adapter Installation worksheet for the adapter Software download for the Seibel JDB adapter... 5 Chapter 3. Adapter installation Dispatcher installation Installing the adapter Adapter components on IBM Tioli Directory Integrator Start, stop, and restart of the adapter serice for Siebel JDB Adapter Importing the adapter profile into the IBM Security Identity Manager serer Verification of the adapter profile installation Adapter user account Creating a serice Chapter 4. First steps after installation 17 Adapter configuration Customizing the adapter profile Configuration of iew mode of business components Remoing the Responsibilities in LDAP attribute from the account form for database authentication Configuration properties of the dispatcher Password management when restoring accounts.. 23 Language pack installation for the Siebel JDB adapter Verifying that the Siebel JDB adapter is working correctly Chapter 5. Troubleshooting of the adapter errors Techniques for troubleshooting problems Warning and error messages Chapter 6. Adapter upgrade Connector upgrade Dispatcher upgrade Upgrade of the existing adapter profile Chapter 7. Siebel JDB Adapter uninstallation Remoing the adapter from the IBM Tioli Directory Integrator serer Remoal of the adapter profile from the IBM Security Identity Manager serer Chapter 8. Adapter reinstallation Appendix A. Adapter attributes Appendix B. Custom XML details Supported attributes for the custom XML file Appendix C. Definitions for ITDI_HOME and ISIM_HOME directories Appendix D. Support information Searching knowledge bases Obtaining a product fix Contacting IBM Support Appendix E. Accessibility features for IBM Security Identity Manager Notices Index Copyright IBM Corp. 2012, 2014 iii

6 i IBM Security Identity Manager: Siebel JDB Adapter Installation and Configuration Guide

7 Figures 1. The architecture of the Siebel JDB Adapter 1 2. Example of a single serer configuration Example of a multiple serer configuration 2 Copyright IBM Corp. 2012, 2014

8 i IBM Security Identity Manager: Siebel JDB Adapter Installation and Configuration Guide

9 Tables 1. Preinstallation roadmap Installation roadmap Prerequisites to install the adapter Required information to install the adapter 5 5. Adapter components XML files used for user management and for arious support data attributes Values for business components in iewmode Messages and actions Attributes, descriptions, and corresponding Siebel attributes for ertdisbljdbaccount Attributes, descriptions, and corresponding Siebel attributes for ertdisblresponsibility Attributes, descriptions, and corresponding Siebel attributes for ertdisblposition Attribute, description, and corresponding Siebel attribute for ertdisbltzones Attribute, description, and corresponding Siebel attribute for ertdisbltitles Attribute, description, and corresponding Siebel attribute for ertdisblempnotify Attribute, description, and corresponding Siebel attribute for ertdisblempaail Attributes, descriptions, and corresponding Siebel attributes for ertdisblbu Attribute information for the custom XML file 41 Copyright IBM Corp. 2012, 2014 ii

10 iii IBM Security Identity Manager: Siebel JDB Adapter Installation and Configuration Guide

11 Preface About this publication The Siebel JDB Adapter Installation and Configuration Guide proides the basic information that you can use to install and configure the IBM Security Identity Manager Siebel Jaa Data Beans Adapter (Siebel JDB Adapter). The Siebel JDB Adapter enables connectiity between the IBM Security Identity Manager serer and a Siebel Serer. The IBM Security Identity Manager serer is the serer for your IBM Security Identity Manager product. Access to publications and terminology This section proides: A list of publications in the IBM Security Identity Manager library. Links to Online publications. A link to the IBM Terminology website. IBM Security Identity Manager library For a complete listing of the IBM Security Identity Manager and IBM Security Identity Manager Adapter documentation, see the online library ( Online publications IBM posts product publications when the product is released and when the publications are updated at the following locations: IBM Security Identity Manager library The product documentation site ( knowledgecenter/ssrmwj/welcome) displays the welcome page and naigation for the library. IBM Security Systems Documentation Central IBM Security Systems Documentation Central proides an alphabetical list of all IBM Security Systems product libraries and links to the online documentation for specific ersions of each product. IBM Publications Center The IBM Publications Center site ( linkweb/publications/serlet/pbi.wss) offers customized search functions to help you find all the IBM publications you need. IBM Terminology website The IBM Terminology website consolidates terminology for product libraries in one location. You can access the Terminology website at software/globalization/terminology. Copyright IBM Corp. 2012, 2014 ix

12 Accessibility Technical training Support information Accessibility features help users with a physical disability, such as restricted mobility or limited ision, to use software products successfully. With this product, you can use assistie technologies to hear and naigate the interface. You can also use the keyboard instead of the mouse to operate all features of the graphical user interface. For technical training information, see the following IBM Education website at IBM Support proides assistance with code-related problems and routine, short duration installation or usage questions. You can directly access the IBM Software Support site at Appendix D, Support information, on page 45 proides details about: What information to collect before contacting IBM Support. The arious methods for contacting IBM Support. How to use IBM Support Assistant. Instructions and problem-determination resources to isolate and fix the problem yourself. Note: The Community and Support tab on the product information center can proide additional support resources. Statement of Good Security Practices IT system security inoles protecting systems and information through preention, detection and response to improper access from within and outside your enterprise. Improper access can result in information being altered, destroyed, misappropriated or misused or can result in damage to or misuse of your systems, including for use in attacks on others. No IT system or product should be considered completely secure and no single product, serice or security measure can be completely effectie in preenting improper use or access. IBM systems, products and serices are designed to be part of a comprehensie security approach, which will necessarily inole additional operational procedures, and may require other systems, products or serices to be most effectie. IBM DOES NOT WARRANT THAT ANY SYSTEMS, PRODUCTS OR SERVICES ARE IMMUNE FROM, OR WILL MAKE YOUR ENTERPRISE IMMUNE FROM, THE MALICIOUS OR ILLEGAL CONDUCT OF ANY PARTY. x IBM Security Identity Manager: Siebel JDB Adapter Installation and Configuration Guide

13 Chapter 1. Oeriew of the adapter Features of the adapter Architecture of the adapter An adapter proides an interface between a managed resource and the IBM Security Identity Manager serer. Adapters might reside on the managed resource. The IBM Security Identity Manager serer manages access to the resource by using your security system. Adapters function as trusted irtual administrators on the target platform. They perform tasks, such as creating, suspending, and restoring user accounts, and other administratie functions that are performed manually. The adapter runs as a serice, independently of whether you are logged on to the IBM Security Identity Manager serer. The adapter automates user account management tasks. The adapter automates the following tasks: Reconciling user accounts and support data Adding, suspending, restoring, and deleting user accounts Modifying user account attributes You must install seeral components for the adapter to function correctly. The adapter requires the following components: The Dispatcher The IBM Tioli Directory Integrator connector The IBM Security Identity Manager adapter profile You need to install the Dispatcher and the adapter profile; howeer, the Tioli Directory Integrator connector might already be installed with the base Tioli Directory Integrator product. Figure 1 describes the components that work together to complete the user account management tasks in a Tioli Directory Integrator enironment. IBM Security Identity Manager Serer RMI calls Dispatcher Serice (an instance of the IBM Tioli Directory Integrator) Adapter resource Figure 1. The architecture of the Siebel JDB Adapter For more information about Tioli Directory Integrator, see the Quick Start Guide in the IBM Security Identity Manager product documentation. Copyright IBM Corp. 2012,

14 Supported configurations The adapter supports both single serer and multiple serer configurations. The fundamental components in each enironment are: The IBM Security Identity Manager serer The Tioli Directory Integrator The managed resource The adapter The adapter must reside directly on the serer running the Tioli Directory Integrator. Single serer configuration In a single serer configuration, install the IBM Security Identity Manager serer, the Tioli Directory Integrator, and the Siebel JDB Adapter on one serer to establish communication with the Siebel serer. The Siebel serer is installed on a different serer as described in Figure 2. IBM Security Identity Manager Serer Tioli Directory Integrator Serer Managed resource Adapter Figure 2. Example of a single serer configuration Multiple serer configuration In a multiple serer configuration, the Tioli Directory Integrator serer, the Tioli Directory Integrator, the Siebel JDB Adapter, and the Siebel serer are installed on different serers. Install the Tioli Directory Integrator and the Siebel JDB Adapter on the same serer as described in Figure 3. IBM Security Identity Manager serer Tioli Directory Integrator serer Managed resource Adapter Figure 3. Example of a multiple serer configuration 2 IBM Security Identity Manager: Siebel JDB Adapter Installation and Configuration Guide

15 Chapter 2. Preparation for the adapter installation Preinstallation roadmap Installing and configuring the adapter inoles seeral steps that you must complete in an appropriate sequence. Reiew the road maps before you begin the installation process. Before you install the adapter, you must prepare the enironment. Perform the tasks that are listed in Table 1. Table 1. Preinstallation roadmap Task Obtain the installation software. Verify that your enironment meets the software and hardware requirements for the adapter. Obtain the necessary information for the installation and configuration. For more information Download the software from Passport Adantage. See Software download for the Seibel JDB adapter on page 5. See Prerequisites to install the adapter and Prerequisites to use the adapter on page 4. See Installation worksheet for the adapter on page 5. Installation roadmap To install the adapter, you must complete the tasks in the roadmap. Table 2. Installation roadmap Task For more information Verify the Dispatcher installation. See Dispatcher installation on page 7. Install the adapter. See Installing the adapter on page 7. Verify the installation. See Adapter components on IBM Tioli Directory Integrator on page 8. Import the adapter profile. See Importing the adapter profile into the IBM Security Identity Manager serer on page 9. Verify the profile installation. See Verification of the adapter profile installation on page 10. Create an adapter user account. See Adapter user account on page 10. Create a serice. See Creating a serice on page 10. Configure the adapter. See Adapter configuration on page 17. Prerequisites to install the adapter Verify that your enironment meets all the prerequisites before installing the adapter. Copyright IBM Corp. 2012,

16 Ensure that you install the adapter on the same workstation as the Tioli Directory Integrator serer. Table 3 identifies the software and operating system prerequisites for the adapter installation. Table 3. Prerequisites to install the adapter Prerequisite IBM Tioli Directory Integrator Description Version 7.1 fix pack 5 or later Version IBM Security Identity Manager serer Version 6.0 Siebel serer 7.7, 7.8, 8.0 System Administrator Authority Tioli Directory Integrator adapters solution directory To complete the adapter installation procedure, you must hae system administrator authority. A Tioli Directory Integrator adapters solution directory is a Tioli Directory Integrator work directory for IBM Security Identity Manager adapters. See the Dispatcher Installation and Configuration Guide. You must install the adapter on those IBM Tioli Directory Integrator platforms that support the managed resource libraries or jars that the adapter uses. For information about the prerequisites and supported operating systems for IBM Security Identity Manager, see the IBM Tioli Directory Integrator 7.1: Administrator Guide. Prerequisites to use the adapter You must meet the following Jaa Data Beans requirement to run the Siebel JDB Adapter. The Siebel JDB connector communicates with the Siebel Enterprise serer by using the Jaa Data Beans (JDB). The Jaa Data Beans is an integration method exposed by Siebel to communicate with external Jaa applications. The Jaa Data Bean code in the Siebel JDB connector has dependency on the following JAR files on the managed resource: Siebel.jar SiebelJI_lang.jar. (where lang is the installed language pack; for example, SiebelJI_enu.jar for English or SiebelJI_jpn.jar for Japanese). These JAR files must be copied from SiebelInstall\siebsrr\CLASSES on the managed resource to the Tioli Directory Integrator workstation, so that the adapter can access them. Copy the JAR files to ITDI_HOME/jars/3rdparty/others directory. The JAR files corresponding to the JDBC drier that is used for communicating with the database must be copied to the ITDI_HOME/jars/3rdparty/others directory. For example, if you are using the Microsoft SQL Serer drier to connect to MS-SQL, copy the following drier JAR files: Msbase.jar 4 IBM Security Identity Manager: Siebel JDB Adapter Installation and Configuration Guide

17 Msutil.jar Mssqlserer.jar These JAR files are aailable as part of the Microsoft SQL Serer drier for JDBC. Installation worksheet for the adapter Table 4 identifies the information that you need before installing the adapter. Table 4. Required information to install the adapter Required information Description Value Tioli Directory Integrator Home Directory (ITDI_HOME) The ITDI_HOME directory contains the jars/connectors subdirectory that contains adapter jars. For example, the jars/connectors subdirectory contains the jar for the UNIX adapter. If Tioli Directory Integrator is automatically installed with your IBM Security Identity Manager product, the default directory path for Tioli Directory Integrator is as follows: Windows: for ersion 7.1: drie\program Files\IBM\TDI\V7.1 Solution Directory (ADAPTER_SOLDIR) When you install the dispatcher, the adapter prompts you to specify a file path for the solution directory. For more information about the solution directory, see the Dispatcher Installation and Configuration Guide. UNIX: for ersion 7.1: /opt/ibm/tdi/v7.1 The default solution directory is: Windows: for ersion 7.1 drie\program Files\IBM\TDI\V7.1\ timsol UNIX: for ersion 7.1: /opt/ibm/tdi/v7.1/ timsol Software download for the Seibel JDB adapter Download the software through your account at the IBM Passport Adantage website. Go to IBM Passport Adantage. See the IBM Security Identity Manager Download Document for instructions. Note: You can also obtain additional adapter information from IBM Support. Chapter 2. Preparation for the adapter installation 5

18 6 IBM Security Identity Manager: Siebel JDB Adapter Installation and Configuration Guide

19 Chapter 3. Adapter installation Dispatcher installation Installing the adapter All the Tioli Directory Integrator-based adapters require the Dispatcher for the adapters to function correctly. If the Dispatcher is installed from a preious installation, do not reinstall it unless there is an upgrade to the Dispatcher. See Dispatcher installation. After erifying the Dispatcher installation, you might need to install the Tioli Directory Integrator connector. Depending on your adapter, the connector might already be installed as part of the Tioli Directory Integrator product and no further action is required. If this installation is the first Tioli Directory Integrator-based adapter installation, you must install the Dispatcher before you install the adapter. You must install the Dispatcher on the same Tioli Directory Integrator serer where you want to install the adapter. Obtain the dispatcher installer from the IBM Passport Adantage website, For information about Dispatcher installation, see the Dispatcher Installation and Configuration Guide. You must complete seeral steps to install the adapter. Before you begin Do the following tasks: : Verify that your site meets all the prerequisite requirements. See Prerequisites to install the adapter on page 3. Obtain a copy of the installation software. See Software download for the Seibel JDB adapter on page 5. Obtain system administrator authority. See Prerequisites to install the adapter on page 3. About this task The adapter uses the IBM Tioli Directory Integrator Siebel JDB connector. This connector is not aailable with the base Tioli Directory Integrator product. The adapter installation inoles Tioli Directory Integrator Siebel JDB connector installation. Before you install the adapter, make sure that the Dispatcher is installed. See Dispatcher installation. Procedure To install the adapter, complete the following steps: Copyright IBM Corp. 2012,

20 1. Create a temporary directory on the workstation where you want to install the adapter. 2. Extract the contents of the compressed file in the temporary directory. 3. Copy the SiebelJDBConnector.jar file to the ITDI_HOME/jars/connectors directory. 4. Copy all XML files from resource directory in the installation package to the ADAPTER_SOLDIR/SiebelCustomXMLs directory. 5. Restart the IBM Security Identity Manager adapter (Dispatcher) serice. For guidance on starting and stopping the adapter serice, see the Dispatcher Installation and Configuration Guide. What to do next After you finish the adapter installation, do the following tasks: Verify that the installation completed successfully. See Adapter components on IBM Tioli Directory Integrator. Import the adapter profile. See Importing the adapter profile into the IBM Security Identity Manager serer on page 9. Create a user account for the adapter on IBM Security Identity Manager. See Adapter user account on page 10. Adapter components on IBM Tioli Directory Integrator When the adapter is installed correctly, you can find the adapter components on IBM Tioli Directory Integrator. Table 5. Adapter components Directory On the Windows operating system: ITDI_HOME\jars\connectors\ Adapter component SiebelJDBConnector.jar On the UNIX operating system: ITDI_HOME/jars/connectors/ On the Windows operating system: ADAPTER_SOLDIR\SiebelCustomXmls On the UNIX operating system: ADAPTER_SOLDIR/SiebelCustomXmls AailStatusTypes.xml Employee.xml NotificationTypes.xml Organization.xml PersonalTitle.xml Positions.xml Responsibility.xml TimeZone.xml UserList.xml Validator.dtd If this installation is to upgrade a connector, send a request from IBM Security Identity Manager and erify that the ersion number in the ibmdi.log matches the ersion of the connector. Start, stop, and restart of the adapter serice for Siebel JDB Adapter To start, stop, or restart the adapter, you must start, stop, or restart the Dispatcher. 8 IBM Security Identity Manager: Siebel JDB Adapter Installation and Configuration Guide

21 The adapter does not exist as an independent serice or a process. The adapter is added to the Dispatcher instance, which runs all the adapters that are installed on the same Tioli Directory Integrator instance. See the topic about starting stopping, and restarting the dispatcher serice in the Dispatcher Installation and Configuration Guide. Importing the adapter profile into the IBM Security Identity Manager serer Use the adapter profile to create an adapter serice on IBM Security Identity Manager serer and establish communication with the adapter. Before you begin An adapter profile defines the types of resources that the IBM Security Identity Manager serer can manage. Verify that the following conditions are met: The IBM Security Identity Manager serer is installed and running. You hae root or Administrator authority on IBM Security Identity Manager. About this task Before you can create an adapter serice, the IBM Security Identity Manager serer must hae an adapter profile to recognize the adapter. The files that are packaged with the adapter include the adapter profile JAR file. You can import the adapter profile as a serice profile on the serer with the Import feature of IBM Security Identity Manager. The SiebelJDBProfile.jar file includes all the files that are required to define the adapter schema, account form, serice form, and profile properties. You can extract the files from the JAR file to modify the necessary files and package the JAR file with the updated files. Procedure 1. Log on to the IBM Security Identity Manager serer by using an account that has the authority to perform administratie tasks. 2. In the My Work pane, expand Configure System and click Manage Serice Types. 3. On the Manage Serice Types page, click Import to display the Import Serice Types page. 4. Specify the location of the SiebelJDBProfile.jar file in the Serice Definition File field by taking one of the following actions: Type the complete location of where the file is stored. Use Browse to naigate to the file. 5. Click OK. Note: When you import the adapter profile and if you receie an error related to the schema, see the trace.log file for information about the error. The trace.log file location is specified by using the handler.file.filedir property defined in the IBM Security Identity Manager enrolelogging.properties file. The enrolelogging.properties file is installed in the ISIM_HOME\data directory. Chapter 3. Adapter installation 9

22 What to do next Restart IBM Security Identity Manager for the change to take effect. Verification of the adapter profile installation Adapter user account Creating a serice After you install the adapter profile, erify that the installation was successful. An unsuccessful installation: Might cause the adapter to function incorrectly. Preents you from creating a serice with the adapter profile. To erify that the adapter profile is successfully installed, create a serice with the adapter profile. For more information about creating a serice, see Creating a serice. If you are unable to create a serice using the adapter profile or open an account on the serice, the adapter profile is not installed correctly. You must import the adapter profile again. You must create a user account for the adapter on the managed resource. You must proide the account information when you create a serice. The accounts must be able to remotely connect to the Siebel Serer and the associated database or LDAP directory. The account must also hae sufficient priileges to administer Siebel users. For more information about creating a serice, see Creating a serice. After the adapter profile is imported on IBM Security Identity Manager, you must create a serice so that IBM Security Identity Manager can communicate with the adapter. About this task To create or change a serice, you must use the serice form to proide information for the serice. Serice forms might ary depending on the adapter. Note: If the following fields on the serice form are changed for an existing serice, the IBM Security Identity Manager Adapter serice on the Tioli Directory Integrator serer must be restarted. SIEBEL JDB CONNECTION tab: Administrator Password Language Authentication Type SIEBEL DATABASE CONNECTION tab: Database Type JDBC URL for the database JDBC Drier to be used 10 IBM Security Identity Manager: Siebel JDB Adapter Installation and Configuration Guide

23 Database Name Database User Name Database User Password SIEBEL LDAP CONNECTION tab: Directory Serer Location Administrator Name Administrator Password User Base DN Responsibilities Attribute Remoe LDAP User on Delete? DISPATCHER ATTRIBUTE tab: AL FileSystem Path Max Connection Count Procedure 1. Log on to the IBM Security Identity Manager serer with an account that has the authority to perform administratie tasks. 2. In the My Work pane, click Manage Serices and click Create. 3. On the Select the Type of Serice page, select Siebel JDB Profile. 4. Click Next to display the adapter serice form. 5. Complete the following fields on the serice form: ITIM Siebel JDB Serice Serice Name Specify a name that defines the adapter serice on the IBM Security Identity Manager serer. Note: Do not use forward (/) or backward slashes (\) in the serice name. Description Optional: Specify a description that identifies the serice for your enironment. IBM Tioli Directory Integrator location Optional: Specify the URL for the Tioli Directory Integrator instance. The alid syntax for the URL is rmi://ipaddress:port/itdidispatcher, where ip-address is the Tioli Directory Integrator host and port is the port number for the Dispatcher. The default URL is rmi://localhost:1099/itdidispatcher For information about changing the port number, see the Dispatcher Installation and Configuration Guide. Owner Optional: Specify a IBM Security Identity Manager user as a serice owner. Serice prerequisite Optional: Specify the IBM Security Identity Manager serice that is a prerequisite to this serice. Siebel JDB connection Chapter 3. Adapter installation 11

24 Connect string Specify the web address that contains the information to connect to any Siebel serer component. The generic form of the syntax for the connect string is: siebel[[.transport][.[encryption][.[compression]]]]: //host:port/enterpriseserer/appobjmgr transport Specify the network protocol used for communication between the Siebel JDB connector and the Siebel serer. Typical alues are TCP/IP or HTTP. encryption Specify the type of encryption used for communication between the Siebel JDB connector and the Siebel serer. Typical alues are none or mscrypto. compression Specify the type of data compression used for communication between the Siebel JDB connector and the Siebel serer. Typical alues are none or zlib. host The alue used for the host portion of the connect string depends on Siebel system configuration: If the Siebel system configuration contains only one Siebel serer, specify the host name or IP address of the computer where the Siebel serer is running. If the Siebel system configuration contains multiple Siebel serers and uses third-party load balancing, specify the irtual IP address of the third-party load balancer. If the Siebel system configuration contains multiple Siebel serers and uses Siebel natie load balancing, specify the host name or IP address of any computer where a Siebel serer is running. port The alue used for the port portion of the connect string depends on Siebel system configuration: If the Siebel system configuration contains only one Siebel serer, specify the port number for SCBroker on that serer. The default port for SCBroker is If the Siebel system configuration contains multiple Siebel serers and uses third-party load balancing, specify the irtual port number in the third-party load balancer that maps to the physical workstations running the Siebel serer. If the Siebel system configuration contains multiple Siebel serers and uses Siebel natie load balancing, specify the port number that SCBroker uses on the Siebel serer that you specified for the host portion of the connect string. EnterpriseSerer Specify the name of the Siebel enterprise. AppObjMgr Specify the Application Object Manager. 12 IBM Security Identity Manager: Siebel JDB Adapter Installation and Configuration Guide

25 Note: For Jaa Data Beans, the Siebel JDB Adapter must connect to the EAIObjMgr_<lang>. The specific connect string can be found in the file Siebel installation home\ SWEApp\BIN\eapps.cfg, under the heading [eai_lang]>], where lang is the language pack installed. Administrator name Specify the Siebel administrator. This user must hae sufficient permissions to perform User Proisioning operations on the managed resource. Administrator Password Specify the password of the Siebel administrator. Language Specify the installed language pack. Select the appropriate language from the drop-down menu of all languages supported by the Siebel serer. Authentication Type Siebel resource can be configured to use different authentication mechanisms at arious leels namely. Enterprise, Siebel serer, or components on the Siebel serer. Specify the Siebel authentication mechanism in use for the EAI Object Manager (EAIObjMgr) component. Depending on the choice gien here, either database connection related or LDAP connection-related parameters gien in the next two tabs are used. If authentication type is DB Authentication, then fill parameters on the Siebel database connection tab. If authentication type is LDAP Authentication, then fill parameters on the Siebel LDAP connection tab. Siebel database connection If authentication type is DB Authentication, then fill parameters on the Siebel database connection tab, otherwise you might ignore this tab. Database type Specify the type of database that the adapter uses. For example, MS-SQL or Oracle. JDBC URL For Database Specify the JDBC web address to connect to the database. JDBC drier to be used Specify the JDBC drier class name. Database name Specify the instance name of the database that Siebel uses. Database user name Specify the user name to connect to the database. The user must hae priileges to add, delete, and modify logins and users to the specified database instance. Database user password Specify the password for the database user. Siebel LDAP connection If authentication type is LDAP Authentication, then fill parameters on the Siebel LDAP connection tab, otherwise you might ignore this tab. Chapter 3. Adapter installation 13

26 Directory Serer Location Specify the LDAP web address in ldap://host:port format. The default alue is ldap://localhost:389 Administrator Name Specify the full distinguished name (DN) for the LDAP administrator that is stored in the directory. Administrator Password Specify the password for the specified administrator. User Base DN Specify the base DN under which users are stored. Responsibilities Attribute Specify the LDAP attribute in which user responsibilities are stored. You can configure the Siebel serer to use any attribute from the inetorgperson objectclass to store responsibilities. This attribute must be multi-alued to store more than one responsibility because Siebel-supported security adapters cannot read more than one responsibility from a single-alue attribute. User can select one of the attributes from the dropdown list which lists of all multi-alued attributes from LDAP objectclass inetorgperson. Remoe LDAP User on Delete? Specify whether to remoe the LDAP user on user delete operation. The Siebel serer does not remoe the LDAP user from directory. The adapter can remoe it by using the LDAP connector. Dispatcher Attributes Disable AL Caching Select the check box to disable the assembly line (test, add, modify, delete) caching in the dispatcher for the serice. AL FileSystem Path Specify the file path from where the dispatcher loads the assembly lines. If you do not specify a file path, the dispatcher loads the assembly lines receied from IBM Security Identity Manager. For example, you can specify the following file path to load the assembly lines from the profiles directory of the Windows operating system: c:\files\ibm\tdi\v7.1\profiles or you can specify the following file path to load the assembly lines from the profiles directory of the UNIX and Linux operating systems:system:/opt/ibm/tdi/v7.1/profiles Max Connection Count Specify the maximum number of assembly lines that the dispatcher can run simultaneously for the serice. For example, enter 10 when you want the dispatcher to run maximum 10 assembly lines simultaneously for the serice. If you enter 0 in the Max Connection Count field, the dispatcher does not limit the number of assembly lines that run simultaneously for the serice. On the Status and information tab This page contains read only information about the adapter and managed resource. These fields are examples. The actual fields ary depending on the type of adapter and how the serice form is 14 IBM Security Identity Manager: Siebel JDB Adapter Installation and Configuration Guide

27 configured. The adapter must be running to obtain the information. Click Test Connection to populate the fields. Last status update: Date Specifies the most recent date when the Status and information tab was updated. Last status update: Time Specifies the most recent time of the date when the Status and information tab was updated. Managed resource status Specifies the status of the managed resource that the adapter is connected to. Adapter ersion Specifies the ersion of the adapter that the IBM Security Identity Manager serice uses to proision request to the managed resource. Profile ersion Specifies the ersion of the profile that is installed in the IBM Security Identity Manager serer. TDI ersion Specifies the ersion of the Tioli Directory Integrator on which the adapter is deployed. Dispatcher ersion Specifies the ersion of the Dispatcher. Installation platform Specifies summary information about the operating system where the adapter is installed. Adapter account Specifies the account that running the adapter binary file. Adapter up time: Date Specifies the date when the adapter started. Adapter up time: Time Specifies the time of the date when the adapter started. Adapter memory usage Specifies the memory usage for running the adapter. If the connection fails, follow the instructions in the error message. Also Verify the adapter log to ensure that the IBM Security Identity Manager test request was successfully sent to the adapter. Verify the adapter configuration information. Verify IBM Security Identity Manager serice parameters for the adapter profile. For example, erify the work station name or the IP address of the managed resource and the port. 6. Click Finish. Chapter 3. Adapter installation 15

28 16 IBM Security Identity Manager: Siebel JDB Adapter Installation and Configuration Guide

29 Chapter 4. First steps after installation Adapter configuration After you install the adapter, you must perform seeral other tasks. The tasks include configuring the adapter, setting up SSL, installing the language pack, and erifying the adapter works correctly. You can change the configuration options for the Siebel JDB Adapter. Customizing the adapter profile Configuration of iew mode of business components on page 19 Remoing the Responsibilities in LDAP attribute from the account form for database authentication on page 23 See the Dispatcher Installation and Configuration Guide for additional configuration options such as: JVM properties Dispatcher filtering Dispatcher properties Dispatcher port number Logging configurations Secure Sockets Layer (SSL) communication Customizing the adapter profile To customize the adapter profile, you must modify the Siebel JDB Adapter JAR file. About this task You might customize the adapter profile to change the account form or the serice form. You can also change the labels on the forms using the Form Designer or CustomLabels.properties. Each adapter has a CustomLabels.properties file for that adapter. The JAR file is included in the Siebel JDB Adapter compressed file that you downloaded from the IBM website. Note: The adapter supports a set of ready-to-use attributes. To customize the set of attributes that the adapter supports, see the Directory Integrator-Based Siebel JDB Adapter User Guide. The following files are included in the SiebelJDBProfile JAR file: CustomLabels.properties ertdisbljdbaccount.xml ertdisbljdbrmiserice.xml SiebelJDBAdapter.xml siebeljdbadd.xml siebeljdbdelete.xml siebeljdbmodify.xml Copyright IBM Corp. 2012,

30 siebeljdbsearch.xml siebeljdbtest.xml schema.dsml serice.def After you edit the file, you must import the file into the IBM Security Identity Manager serer for the changes to take effect. Procedure 1. Edit the JAR file. a. Log on to the workstation where the Siebel JDB Adapter is installed. b. Copy the JAR file into a temporary directory. c. Extract the contents of the JAR file into the temporary directory. Run the following command. The following example applies to the Siebel JDB Adapter profile. Type the name of the JAR file for your operating system. #cd /tmp #jar -xf SiebelJDBProfile.jar The jar command extracts the files into the SiebelJDBProfile directory. d. Edit the file that you want to change. 2. Import the file. a. Create a JAR file using the files in the /tmp directory Run the following command: #cd /tmp #jar -cf SiebelJDBProfile.jar SiebelJDBProfile b. Import the JAR file into the IBM Security Identity Manager application serer. For more information about importing the JAR file, see Importing the adapter profile into the IBM Security Identity Manager serer on page 9. c. Stop and start the IBM Security Identity Manager serer. d. Stop and start the Siebel JDB Adapter serice. See Start, stop, and restart of the adapter serice for Siebel JDB Adapter on page 8 for information about stopping and starting the Siebel JDB Adapter serice. LDAP Password attribute change for LDAP authentication To manage users on Siebel Serer haing LDAP authentication, Siebel JDB Adapter needs the LDAP password attribute name for the LDAP user, which is userpassword by default. The LDAP password attribute LDAPPwdAttribute is a dispatcher parameter and is defined in the serice.def file as: <dispatcherparameter name="ldappwdattribute"> <default>userpassword</default> </dispatcherparameter> You can change default alue by editing the serice.def file. See the Siebel JDB Adapter white paper for more details on modifying Siebel JDB Profile. Note: The dispatcher parameter LDAPPwdAttribute is ignored, if the Siebel serer is using database authentication. 18 IBM Security Identity Manager: Siebel JDB Adapter Installation and Configuration Guide

31 Editing Siebel JDB adapter profiles on the UNIX or Linux operating system The adapter profile.jar file might contain ASCII files that are created by using the MS-DOS ASCII format. About this task If you edit an MS-DOS ASCII file on the UNIX operating system, you might see a character ^M at the end of each line. These characters indicate new lines of text in MS-DOS. The characters can interfere with the running of the file on UNIX or Linux systems. You can use tools, such as dos2unix, to remoe the ^M characters. You can also use text editors, such as the i editor, to remoe the characters manually. Example You can use the i editor to remoe the ^M characters. From the i command mode, run the following command and press Enter: :%s/^m//g When you use this command, enter ^M or Ctrl-M by pressing ^^M or Ctrl V Ctrl M sequentially. The ^ instructs the i editor to use the next keystroke instead of issuing it as command. Configuration of iew mode of business components The Siebel JDB connector uses custom XML files that specify which user attributes to set or get and which support data attributes to get. You can edit these XML files or create a new one to change the business object, the business component, and the set of attributes under that business component. These XML files for the ready-to-use attributes that the adapter supports are shipped along with the Siebel JDB Adapter, and are in the Adapter_solution_directory/SiebelCustomXMLs/ directory. See View Mode specification in XML file on page 20. View mode The iew modes of a business component determine the allowable access control mechanisms that can be applied to the business component in any iew. When a iew is based on a particular business component, the iew must use one of the iew modes specified for the business component. For example, the Responsibility business component can only be used in Organization iew mode. Each iew mode also determines how data is associated with a user to determine whether the user has access. For example, a business component that allows personal access control might connect the data to the person by comparing the data Owner Id field to the person s user ID. Another business component might apply personal access control through the data Created by field. Use Siebel Tools to work with properties of business components. Note: If a business component has no listed iew modes, then no access control based on the business component exist for iews that are based on that business component. Chapter 4. First steps after installation 19

32 Viewing the iew mode and isibility fields of a business component You can use Siebel Tools to see the iew mode details of a particular business component. Procedure 1. Launch Siebel Tools. 2. In the Siebel Objects Object folder, click + (the plus sign) next to Business Component to expand the Business Component object type. The Business Component sub-tree is displayed. 3. Select the required Business Component and click the BusComp View Mode icon. The business component iew mode details are displayed. A record in Business Component View Modes represents one iew mode the business component can assume. View Mode specification in XML file The adapter supports arious ready-to- use attributes for iew mode. This table shows the XML files for the ready-to-use attributes that the adapter supports. Table 6. XML files used for user management and for arious support data attributes Default iew mode Used for Business object: business component XML file name of business component User management User List: User UserList.xml 5 Default iew modes of MVBBusComoponets and PicklistBusComponents MVGBusComponent name="employee Organization" iewmode="9" name="responsibility" iewmode="9" name="position" iewmode="9" PicklistBusComponent name="time Zone" iewmode="9" name="personal Title" iewmode="9" name="aailability Status" iewmode="9" name="standard Notification" iewmode="9" name="emergency Notification" iewmode="9" 20 IBM Security Identity Manager: Siebel JDB Adapter Installation and Configuration Guide

33 Table 6. XML files used for user management and for arious support data attributes (continued) Default iew mode Used for Business object: business component XML file name of business component User management Employee: Employee Employee.xml 5 Default iew modes of MVBBusComoponets and PicklistBusComponents MVGBusComponent name="employee Organization" iewmode="9" name="responsibility" iewmode="9" name="position" iewmode="9" PicklistBusComponent name="time Zone" iewmode="9" name="personal Title" iewmode="9" name="aailability Status" iewmode="9" name="standard Notification" iewmode="9" name="emergency Notification" iewmode="9" Support data - Aailability Support data - Standard/Emergency Notification Support data - Organization Support data - Personal title (Mr./Mrs.) Support data - Position Support data - Responsibility Support data - Time Zone List Of Values: List Of Values List Of Values: List Of Values Organizations: Organization List Of Values: List Of Values AailStatusTypes.xml NotificationTypes.xml 9 (not used) Not applicable 9 (not used) Not applicable Organization.xml 9 Not applicable PersonalTitle.xml 9 (not used) Not applicable Employee: Position Positions.xml 9 Not applicable Employee: Responsibility Time Zone: Time Zone Responsibility.xml 9 Not applicable TimeZone.xml 9 Not applicable This table lists the integer alues allowed in the definition of the business component for iewmode and their meaning: Chapter 4. First steps after installation 21

34 Table 7. Values for business components in iewmode Value View name Meaning 0 SalesRepView Users can access records owned by them or can access records whose team contains their position. 1 ManagerView Users can access records associated with their own position and positions that report directly to them. 2 PersonalView Users can access records with which their person records are associated. 3 AllView Users can access all records, except those with a missing or an inalid owner. 5 OrganizationView Users can access records that are associated with a single organization or with multiple organizations to which their position is linked. 6 ContactView Users can access records that are associated with a single organization to which their position is linked. 7 GroupView Users can access categories of master data that are associated with any of the access groups with which they are associated. Users are associated with an access group if during the current session, they are associated with a position, organization, account, household, or a user list that is a member of the access group. 8 CatalogView Users can access a flat (uncategorized) list of data in all of the categories across catalogs to which all of the user s access groups hae access. Users are associated with an access group if during the current session, they are associated with a position, organization, account, household, or a user list that is a member of the access group. 9 SubOrganizationView Users can access records associated with their actie organization or a descendant organization. You can edit the XML file and set the required iew mode accordingly. The iewmode is redundant in those XML files that hae searchspecificationattribute or searchspecificationvalue specified for the business component. These XML files are PersonalTitle.xml, NotificationTypes.xml, and AailStatusTypes.xml. But iewmode cannot be remoed due to redundancy, because it is a required attribute in the definition of BusinessComponent. The following sample of the Responsibility.xml file specifies iew mode as 9, SubOrganizationView for business component Responsibility: <?xml ersion="1.0" encoding="utf-8"?> <!DOCTYPE BusinessObject SYSTEM "Validator.dtd"> <BusinessObject name="employee"> <BusinessComponent name = "Responsibility" iewmode = "9"> <Attribute name = "Name" isunique = "true" isrequired = "true"> </Attribute> <Attribute name = "Primary Organization Id"> </Attribute> <Attribute name = "Description"> </Attribute> </BusinessComponent> </BusinessObject> 22 IBM Security Identity Manager: Siebel JDB Adapter Installation and Configuration Guide

35 Remoing the Responsibilities in LDAP attribute from the account form for database authentication If the authentication type used by the Siebel serer is database authentication, then account form attribute Responsibilities in LDAP can be remoed. It is not needed because all responsibilities are stored in a database for database authentication. About this task This attribute can be remoed from the profile manually. It can also be remoed from IBM Security Identity Manager by using form customization, after the Siebel JDB profile is imported to the IBM Security Identity Manager serer. Note: Een if this attribute is present, it is ignored by the adapter if the authentication type is database authentication. Procedure 1. Log on to IBM Security Identity Manager with an account that has administratie authority. 2. Click Configure System. 3. Click Design Forms. 4. Double-click Account. A list of existing account class definitions is displayed. 5. Double-click SiebelJDBAccount. Various account form tabs are displayed. Attributes are displayed on each tab. 6. Click $ertdisblaccesscontrol. The attributes for access control are displayed. 7. Delete the attribute ertdisblldaprelresponsibilit. a. Click ertdisblldaprelresponsibilit. b. Click Attribute. c. Click Delete Attribute. The ertdisblldaprelresponsibilit attribute is remoed from the list of attributes. 8. Click Close. Configuration properties of the dispatcher The solution.properties file and the itim_listener.properties file contain the configuration properties for the Dispatcher. To configure the dispatcher properties, follow the configuration instructions included in the dispatcher download package. Password management when restoring accounts When an account is restored from being preiously suspended, you are prompted to supply a new password for the reinstated account. Howeer, in some cases you might not want to be prompted for a password. The password requirement to restore an account falls into two categories: allowed and required. Note: A password is required for the restore operation, if the authentication is LDAP authentication. Chapter 4. First steps after installation 23