Tivoli Identity Manager

Transcription

1 Tivoli Identity Manager Version 4.6 Directory Integrator- Based Oracle ebs Adapter Installation and Configuration Guide SC

2

3 Tivoli Identity Manager Version 4.6 Directory Integrator- Based Oracle ebs Adapter Installation and Configuration Guide SC

4 Note: Before using this information and the product it supports, read the information in Appendix F, Notices, on page 45. This edition applies to version 4.6 of this adapter and to all subsequent releases and modifications until otherwise indicated in new editions. Copyright International Business Machines Corporation All rights reserved. US Government Users Restricted Rights Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

5 Contents Preface v About this book v Intended audience for this book v Publications and related information......v Tivoli Identity Manager library v Prerequisite product publications vii Related publications viii Accessing terminology online viii Accessing publications online viii Ordering publications ix Accessibility ix Tivoli technical training ix Support information ix Conventions used in this book ix Typeface conventions x Operating system-dependent variables and paths x Definitions for HOME and other directory variables x Chapter 1. Overview of the Oracle ebs Adapter Features of the adapter Architecture of the adapter Supported configurations Chapter 2. Installing the Oracle ebs Adapter Prerequisites Tivoli Directory Integrator adapters solution directory 4 Installing the adapter Running the installer Importing the adapter profile into the Tivoli Identity Manager server Creating an Oracle ebs Adapter service Starting and stopping the adapter service Chapter 3. Configuring the Oracle ebs Adapter Customizing the Oracle ebs Adapter profile....9 Configuration properties of the adapter Changing the port number for the RMI Dispatcher 11 Configuring logging for the adapter Naming the log file Sizing the log file Configuring logging levels Displaying logs in the user interface Appending information to an existing log file..13 Managing passwords when restoring accounts...13 Configuring for one-way SSL authentication..16 Configuring for two-way SSL authentication..17 Task performed on the SSL server (Tivoli Directory Integrator server workstation) Creating a keystore for the Tivoli Directory Integrator server Creating a truststore for the Tivoli Directory Integrator server Creating a server-signed certificate for the Tivoli Directory Integrator server Creating a CA certificate for Tivoli Directory Integrator Importing the WebSphere Application Server CA certificate into the Tivoli Directory Integrator truststore Configure Tivoli Directory Integrator to use the keystores Configure Tivoli Directory Integrator to use the truststores Enabling the adapter service to use SSL Tasks performed on the SSL client (Tivoli Identity Manager and WebSphere Application Server workstation) Creating a signed certificate for the Tivoli Identity Manager server Creating a WebSphere Application Server CA certificate for Tivoli Identity Manager Importing the Tivoli Identity Manager CA certificate into the WebSphere Application Server truststore Chapter 5. Verifying the Oracle ebs Adapter profile installation Chapter 6. Troubleshooting the Oracle ebs Adapter Warning and error messages Logging information format Installer problems on UNIX and Linux platforms..26 Symptoms Corrective action Chapter 7. Uninstalling the Oracle ebs Adapter Uninstalling the adapter from the Tivoli Directory Integrator server Removing the adapter profile from the Tivoli Identity Manager server Chapter 4. Configuring SSL authentication for the Oracle ebs Adapter SSL terminology SSL configurations Appendix A. Adapter attributes Attribute descriptions Attributes by Oracle ebs Adapter actions System Login Add System Login Change Copyright IBM Corp iii

6 System Login Delete System Login Suspend System Login Restore Test Reconciliation Appendix B. Installing on a zos operating system RMI Dispatcher installation: Appendix C. Running in Federal Information Processing Standards compliance mode Appendix D. Accessibility features for the Oracle ebs Adapter Accessibility features Keyboard navigation IBM and accessibility Appendix E. Support information Searching knowledge bases Search the information center on your local system or network Search the Internet Contacting IBM Software Support Determine the business impact of your problem 42 Describe your problem and gather background information Submit your problem to IBM Software Support 43 Appendix F. Notices Trademarks Index iv IBM Tivoli Identity Manager: Directory Integrator- Based Oracle ebs Adapter Installation and Configuration Guide

7 Preface About this book This installation guide provides the basic information that you need to install and configure the IBM Tivoli Identity Manager Directory-Based Oracle E-Business Suite Adapter (Oracle ebs Adapter). The Oracle ebs Adapter enables connectivity between the Tivoli Identity Manager server and a managed resource. The Tivoli Identity Manager server is the server for your Tivoli Identity Manager product. Intended audience for this book This book is intended for Oracle ebs security administrators responsible for installing software on their site s computer systems. Readers are expected to understand operating system concepts. The person completing the Oracle ebs Adapter installation procedure must also be familiar with their site s system standards. Readers should be able to perform routine security administration tasks. Publications and related information This section lists publications in the IBM Tivoli Identity Manager library and related documents. The section also describes how to access Tivoli publications online and how to order Tivoli publications. Read the descriptions of the IBM Tivoli Identity Manager library. To determine which additional publications you might find helpful, read the Prerequisite product publications on page vii and the Related publications on page viii. After you determine the publications you need, refer to the instructions in Accessing publications online on page viii. Tivoli Identity Manager library The publications in the technical documentation library for your product are organized into the following categories: v Release information v Online user assistance v Server installation and configuration v Problem determination v Technical supplements v Adapter installation and configuration Release Information: v Release Notes Provides software and hardware requirements for the product, and additional fix, patch, and other support information. v Read This First card Lists the publications for the product. Online user assistance: Provides online help topics and an information center for administrative tasks. Copyright IBM Corp v

8 Server installation and configuration: Provides installation and configuration information for the product server. Problem determination: Provides problem determination, logging, and message information for the product. Technical supplements: The following technical supplements are provided by developers or by other groups who are interested in this product: v Performance and tuning information Provides information needed to tune your production environment, available on the Web at: Click the I character in the A-Z product list to locate IBM Tivoli Identity Manager products. Click the link for your product, and then browse the information center for the Technical Supplements section. v IBM Redbooks and white papers are available on the Web at: IBMTivoliIdentityManager.html Browse to the Self Help section, in the Learn category, and click the Redbooks link. v Technotes are available on the Web at: v Field guides are available on the Web at: v For an extended list of other Tivoli Identity Manager resources, search the following IBM developerworks Web address: Adapter documentation: The technical documentation library also includes a set of platform-specific documents for the adapter components of the product. Adapter information is available on the Web at: Click the I character in the A-Z product list to locate IBM Tivoli Identity Manager products. Click the link for your product, and then browse the information center for the adapter information that you want. Skills and training: The following additional skills and technical training information were available at the time that this manual was published: v Virtual Skills Center for Tivoli Software on the Web at: v Tivoli Education Software Training Roadmaps on the Web at: vi IBM Tivoli Identity Manager: Directory Integrator- Based Oracle ebs Adapter Installation and Configuration Guide

9 v Tivoli Technical Exchange on the Web at: supp_tech_exch.html Prerequisite product publications To use the information in this book effectively, you must have knowledge of the products that are prerequisites for your product. Publications are available from the following locations: v directory server v Operating systems IBM AIX Solaris Operating Environment Red Hat Linux Microsoft Windows Server v Database servers IBM DB2 Universal Database - Support: - Information center: index.jsp - Documentation: winos2unix/support/v8pubs.d2w/en_main - DB2 product family: - Fix packs: downloadv8.html - System requirements: sysreqs.html Oracle Microsoft SQL Server v Directory server applications IBM Directory Server Click the D character in the A-Z list, and then click the link for your product to access the product library. Preface vii

10 Related Sun ONE Directory Server v WebSphere Additional information is available in the product directory or Web sites. v WebSphere embedded messaging v IBM HTTP Server publications The following documents also provide useful information: v The Tivoli Software Library provides a variety of Tivoli publications such as white papers, datasheets, demonstrations, IBM Redbooks, and announcement letters. The Tivoli Software Library is available on the Web at: v The Tivoli Software Glossary includes definitions for many of the technical terms related to Tivoli software. The Tivoli Software Glossary is available from the Glossary link of the Tivoli Software Library Web page at: Accessing terminology online The Tivoli Software Glossary includes definitions for many of the technical terms related to Tivoli software. The Tivoli Software Glossary is available at the following Tivoli software library Web site: The IBM Terminology Web site consolidates the terminology from IBM product libraries in one convenient location. You can access the Terminology Web site at the following Web address: Accessing publications online IBM posts publications for this and all other Tivoli products, as they become available and whenever they are updated, to the Tivoli Information Center Web site at In the Tivoli Information Center window, click the letter that matches the first letter of your product name to access your product library. For example, click M to access the IBM Tivoli Monitoring library or click O to access the IBM Tivoli OMEGAMON library. Note: If you print PDF documents on other than letter-sized paper, set the option in the File Print window that allows Adobe Reader to print letter-sized pages on your paper. viii IBM Tivoli Identity Manager: Directory Integrator- Based Oracle ebs Adapter Installation and Configuration Guide

11 Accessibility Ordering Tivoli technical training publications You can order many Tivoli publications online at You can also order by telephone by calling one of these numbers: v In the United States: v In Canada: In other countries, contact your software account representative to order Tivoli publications. To locate the telephone number of your local representative, perform the following steps: 1. Go to cgibin/pbi.cgi. 2. Select your country from the list and click Go. 3. Click About this site in the main panel to see an information page that includes the telephone number of your local representative. Accessibility features help users with a physical disability, such as restricted mobility or limited vision, to use software products successfully. With this product, you can use assistive technologies to hear and navigate the interface. You can also use the keyboard instead of the mouse to operate all features of the graphical user interface. For additional information, see Appendix D, Accessibility features for the Oracle ebs Adapter, on page 39. For Tivoli technical training information, refer to the following IBM Tivoli Education Web site at Support information If you have a problem with your IBM software, you want to resolve it quickly. IBM provides the following ways for you to obtain the support you need: v IBM Support Assistant: You can search across a large collection of known problems and workarounds, Technotes, and other information at v Obtaining fixes: You can locate the latest fixes that are already available for your product. v Contacting IBM Software Support: If you still cannot solve your problem, and you need to work with someone from IBM, you can use a variety of ways to contact IBM Software Support. For more information about these ways to resolve problems, see Appendix E, Support information, on page 41. Conventions used in this book This reference uses several conventions for special terms and actions and for operating system-dependent commands and paths. Preface ix

12 Typeface conventions This book uses the following typeface conventions: Bold Italic v Lowercase commands and mixed case commands that are otherwise difficult to distinguish from surrounding text v Interface controls (check boxes, push buttons, radio buttons, spin buttons, fields, folders, icons, list boxes, items inside list boxes, multicolumn lists, containers, menu choices, menu names, tabs, property sheets), labels (such as Tip:, and Operating system considerations:) v Keywords and parameters in text v Citations (examples: titles of books, diskettes, and CDs) v Words defined in text (example: a nonswitched line is called a point-to-point line) v Emphasis of words and letters (words as words example: "Use the word that to introduce a restrictive clause," letters as letters example: "The LUN address must start with the letter L.") v New terms in text (except in a definition list): a view is a frame in a workspace that contains data. v Variables and values you must provide:... where myname represents... Monospace v Examples and code examples v File names, programming keywords, and other elements that are difficult to distinguish from surrounding text v Message text and prompts addressed to the user v Text that the user must type v Values for arguments or command options Operating system-dependent variables and paths This guide uses the UNIX convention for specifying environment variables and for directory notation. When using the Windows command line, replace $variable with %variable% for environment variables and replace each forward slash (/) with a backslash (\) in directory paths. The names of environment variables are not always the same in Windows and UNIX. For example, %TEMP% in the Windows operating system is equivalent to $tmp in a UNIX operating system. Note: If you are using the bash shell on a Windows system, you can use the UNIX conventions. Definitions for HOME and other directory variables The following table contains the default definitions that are used in this guide to represent the HOME directory level for various product installation paths. You can customize the installation directory and HOME directory for your specific implementation. If this is the case, you need to make the appropriate substitution for the definition of each variable represented in this table. The value of path varies for these operating systems: x IBM Tivoli Identity Manager: Directory Integrator- Based Oracle ebs Adapter Installation and Configuration Guide

13 v Windows: drive:\program Files v AIX : /usr v Other UNIX: /opt Path variable Default definition Description DB_INSTANCE_HOME Windows: path\ibm\sqllib UNIX: The directory that contains the database for your Tivoli Identity v AIX, Linux : /home/dbinstancename Manager product. v Solaris: /export/home/dbinstancename LDAP_HOME v For IBM Directory Server Version 5.2 The directory that contains the Windows: directory server path\ibm\ldap code. UNIX: path/ibm/ldap AIX, Linux: path/ldap Solaris: path/ibmldaps v For IBM Directory Server Version 6.0 Windows: path\ibm\ldap UNIX: /opt/ibm/ldap/ AIX, Solaris: /opt/ibm/ldap/ Linux: /opt/ibm/ldap/ v For Sun ONE Directory Server Windows: path\sun\mps UNIX: /var/sun/mps Preface xi

14 Path variable Default definition Description IDS_instance_HOME For IBM Directory Server Version 6.0 Windows: drive\ idsslapd-instance_owner_name The value of drive might be C:\. An example of instance_owner_name might be ldapdb2. For example, the log file might be C:\idsslapd-itimldap\logs\ ibmslapd.log UNIX: INSTANCE_HOME/idsslapd-instance_name The directory that contains the IBM Directory Server Version 6.0 instance. HTTP_HOME ITIM_HOME WAS_HOME WAS_NDM_HOME On Linux and AIX systems, the default home directory is the /home/instance_name/idsslapdinstance_name directory. On Solaris systems, for example, the directory is the /export/home/itimldap/idsslapditimldap. directory. Windows: path\ibmhttpserver UNIX: path/ibmhttpserver Windows: path\ibm\itim UNIX: path/ibm/itim Windows: path\ibm\websphere\appserver UNIX: path/ibm/websphere/appserver Windows: path\ibm\websphere\deploymentmanager UNIX: path/ibm/websphere/deploymentmanager The directory that contains the IBM HTTP Server code. The base directory that contains the Tivoli Identity Manager code, configuration, and documentation. The WebSphere Application Server home directory. The home directory on the Deployment Manager. xii IBM Tivoli Identity Manager: Directory Integrator- Based Oracle ebs Adapter Installation and Configuration Guide

15 Path variable Default definition Description ITDI_HOME Windows: The directory where v for version 6.1.1: Tivoli Directory Integrator is drive\program Files\IBM\TDI\V6.1.1 installed. UNIX: v for version 6.1.1: /opt/ibm/tdi/v6.1.1 Tivoli_Common_Directory The ITDI_HOME directory contains the jars/connectors subdirectory that contains files for the adapters. For example, the jars/connectors subdirectory contains the files for the UNIX adapter. Note: If Tivoli Directory Integrator is not automatically installed with your Tivoli Identity Manager product, the default directory path for Tivoli Directory Integrator might be as follows: path/ibm/ibmdirectoryintegrator Windows: path\ibm\tivoli\common\ UNIX: path/ibm/tivoli/common/ The central location for all serviceability-related files, such as logs and first-failure data capture. Preface xiii

16 xiv IBM Tivoli Identity Manager: Directory Integrator- Based Oracle ebs Adapter Installation and Configuration Guide

17 Chapter 1. Overview of the Oracle ebs Adapter Features of the adapter An adapter is a program that provides an interface between a managed resource and the Tivoli Identity Manager server. Adapters might or might not reside on the managed resource and the Tivoli Identity Manager server manages access to the resource by using your security system. Adapters function as trusted virtual administrators on the target platform, performing such tasks as creating login IDs, suspending IDs, and performing other functions administrators normally run manually. The adapter runs as a service, independent of whether a user is logged on to the Tivoli Identity Manager server. The Oracle ebs Adapter enables communication between the Tivoli Identity Manager server and an Oracle ebs user database also referred to as a FND_USER directory. The following sections provide information about the Oracle ebs Adapter: v Features of the adapter v Architecture of the adapter Architecture of the adapter v Supported configurations on page 2 You can use the Oracle ebs Adapter to automate the following administrative tasks: v Adding new users accounts on the oracle database v Modifying the attributes of existing users v Changing user account passwords v Suspending and restoring existing user accounts v Reconciling user accounts and other support data IBM Tivoli Identity Manager communicates with the Oracle ebs Adapter to administer the user accounts on the Oracle ebs. You can perform these actions on an account: Add, Modify, Restore, and Suspend. You can also search for account information and change an account password. The Oracle ebs Adapter contains Tivoli Directory Integrator AssemblyLines that serve one or more account operation. When the first request is sent from Tivoli Identity Manager, the required AssemblyLine is loaded into Tivoli Directory Integrator. The same Assemblyline is then cached to serve subsequent operations of same type. All Tivoli Directory Integrator-based adapters consist of the following components: v RMI Dispatcher v Tivoli Directory Integrator connector v Tivoli Identity Manager adapter profile Copyright IBM Corp

18 Each component must be installed for the adapter to function correctly. You need to install the RMI Dispatcher and the adapter profile, however, the Tivoli Directory Integrator connector might already be installed with the base Tivoli Directory Integrator product. Figure 1 shows the various components that work together to complete user management tasks in a Tivoli Directory Integrator environment. Figure 1. The architecture of the Oracle ebs Adapter For additional information about Tivoli Directory Integrator, see the Getting Started Guide for your level of the IBM Tivoli Directory Integrator. Supported configurations The Oracle ebs Adapter supports different configurations. The fundamental components in each environment are a Tivoli Identity Manager server, a Tivoli Directory Integrator server, an Oracle ebs system, and the Oracle ebs Adapter. In each configuration, the Oracle ebs Adapter must reside directly on the server running the Tivoli Directory Integrator server. For a single server configuration, you must install the Tivoli Identity Manager server, Tivoli Directory Integrator server, and the Oracle ebs Adapter on one server. The server communicates with an Oracle ebs, which is installed on a different server. Refer to Figure 2. Tivoli Identity Manager Server Tivoli Directory Integrator Server Managed resource Adapter Figure 2. Example of a single server configuration 2 IBM Tivoli Identity Manager: Directory Integrator- Based Oracle ebs Adapter Installation and Configuration Guide

19 Chapter 2. Installing the Oracle ebs Adapter Prerequisites For every Tivoli Directory Integrator-based adapter, the RMI Dispatcher must be installed. If you already have the RMI Dispatcher installed from a previous installation, you do not need to install it again unless there is an upgrade to the RMI Dispatcher. You can run the RMI Dispatcher installer so that it can detect if there are any upgrades that would require you to reinstall the RMI Dispatcher. After ensuring that the RMI Dispatcher is correctly installed, you might need to install the Tivoli Directory Integrator connector. Depending on your adapter, the connector might already be installed as part of the Tivoli Directory Integrator product and no further action is required. The final installation task is to import the adapter profile. The following sections provide information for installing and configuring the adapter. v Prerequisites v Installing the adapter on page 4 v Importing the adapter profile into the Tivoli Identity Manager server on page 5 v Creating an Oracle ebs Adapter service on page 6 v Starting and stopping the adapter service on page 7 Table 1 identifies the software and operating system prerequisites for the Oracle ebs Adapter. Verify that all of the prerequisites have been met before installing the adapter. Table 1. Prerequisites to run the adapter Prerequisite Description Tivoli Directory Integrator server v 6.0 Tivoli Identity Manager server (Enterprise or Express) v 6.1 v Version 4.6 Oracle ebs A system running Oracle ebs Release 11i ( ) Oracle Thin JDBC Driver Note: See the online documentation for how to install the JDBC driver at ( software/tech/java/sqlj_jdbc/ index.html). All JDBC driver listed below can talk with all the supported version of Oracle except Oracle 10g r2: v JDBC Driver v JDBC Driver For Oracle 10g r2: v JDBC Driver Network Connectivity The adapter must be installed on a system that can communicate with the Tivoli Identity Manager service through the TCP/IP network. Copyright IBM Corp

20 Table 1. Prerequisites to run the adapter (continued) Prerequisite Description System Administrator Authority A user with administrator privileges is needed for the installation. The Oracle ebs Adapter and the appropriate Oracle Thin JDBC drivers must be installed on the same system as the Tivoli Directory Integrator server. For information on the prerequisites and supported operating systems for Tivoli Directory Integrator, see the IBM Tivoli Directory Integrator 6.1.1: Administrator Guide. Tivoli Directory Integrator adapters solution directory Installing the adapter A Tivoli Directory Integrator adapters solution directory is a Tivoli Directory Integrator work directory for Tivoli Identity Manager adapters. The installer must have read and write access to the Tivoli Directory Integrator adapters solution directory and read access to the Tivoli Directory Integrator home directory. If this is the first Tivoli Directory Integrator-based adapter installation, then you are prompted to enter a directory as your adapters solution directory for all the Tivoli Directory Integrator-based adapters to be installed. The parent folder that you enter for the adapters solution directory needs to exist. For every subsequent adapter installation, the installer uses the adapters solution directory that is already set in the global.properties file and does not prompt for an adapters solution directory. The Oracle ebs Adapter uses the Tivoli Directory Integrator JDBC connector. This connector is available with the base Tivoli Directory Integrator product. Because the Tivoli Directory Integrator JDBC connector is already installed, you only need to install the RMI Dispatcher. The RMI Dispatcher installer is included in the Oracle ebs Adapter adapter compressed file. The RMI Dispatcher has several different types of installer binaries. Select the one appropriate for your operating system. v For Linux operating systems only: DispatcherInstall_linux.bin v For Windows operating systems only: DispatcherInstall_win.exe v For all operating systems: DispatcherInstall.jar Note: If you are running on a 64-bit operating system, you must use the Tivoli Directory Integrator-supplied JVM. The JVM is located in ITDI_HOME/jvm/jre/bin/, where ITDI_HOME is the directory where Tivoli Directory Integrator is installed. This can be accomplished either by: v Ensuring that the first JVM path in the PATH environment variable is set to ITDI_HOME/jvm/jre/bin v Running the Java-based installer ITDI_HOME/jvm/jre/bin/java -jar DispatcherInstall.jar 4 IBM Tivoli Identity Manager: Directory Integrator- Based Oracle ebs Adapter Installation and Configuration Guide

21 Running the installer For zos installation, see Appendix B, Installing on a zos operating system, on page 35. Note: All directory paths and binaries for this procedure apply to Windows operating systems. Change them as needed for other operating systems. To run the installer: 1. Download the Oracle ebs Adapter compressed file from the IBM Web site. Contact your IBM account representative for the Web address and download instructions. 2. Extract the contents of the compressed file into a temporary directory and navigate to that directory. 3. Start the installation program using the DispatcherINSTALL file in the temporary directory. For example on a Windows operating system, select Run... from the Start menu and type C:\Temp\Dispatcher_win.exe in the Open field. Note: If you are running the Tivoli Directory Integrator on platforms other than Linux or Windows operating systems, run the Java-based installer. Use the java.exe that comes with Tivoli Directory Integrator to launch the install. The java.exe located in the ITDI_HOME\jvm\jre\bin directory. Issue the command: ITDI_HOME/jvm/jre/bin/java jar DispatcherInstall.jar 4. In the Welcome window, click Next. 5. In the License Agreement window, review the license agreement and decide if you accept the terms of the license. If you do, click Accept, and then click Next. 6. In the Tivoli Directory Integrator Based Adapter Installer window, specify the location where Tivoli Directory Integrator is installed. You can accept the default location, or click Browse to specify a different directory. Then, click Next. 7. If this is the first Tivoli Directory Integrator-based adapter installation, you are prompted in the Adapter Solution Directory panel to specify the adapters solution directory to be used for the Tivoli Directory Integrator-based Tivoli Identity Manager adapters. If the adapters solution directory has been specified during a previous Tivoli Directory Integrator-based adapter installation, the prompt is not displayed. 8. In the confirmation window that displays the components that are to be installed and the upgrades that are to be completed, click Install to begin the installation. Otherwise, click Back to make changes. 9. In the Installation Completed window, click Finish to exit the program. Importing the adapter profile into the Tivoli Identity Manager server An adapter profile defines the types of resources that the Tivoli Identity Manager server can manage. The profile is used to create an Oracle ebs Adapter service on the Tivoli Identity Manager server. You must import the adapter profile into the Tivoli Identity Manager server before using the Oracle ebs Adapter. Before you import the adapter profile, verify that the following conditions are met: v The Tivoli Identity Manager server is installed and running. v You have root or Administrator authority on the Tivoli Identity Manager server. Chapter 2. Installing the Oracle ebs Adapter 5

22 The adapter profile is included in the JAR file for the adapter, OraEBSProfile.jar. To import the adapter profile, complete these steps: 1. Log in to the Tivoli Identity Manager server using an account that has the authority to perform administrative tasks. 2. Import the adapter profile (or service type) using the import service type feature for your IBM Tivoli Identity Manager product. Refer to the information center or the online help for specific instructions about importing service types. When you import the adapter profile, if you receive an error related to the schema, refer to the trace.log file for information about the error. The trace.log file location is specified using the handler.file.filedir property defined in the IBM Tivoli Identity Manager enrolelogging.properties file. The enrolelogging.properties file is installed in the IBM Tivoli Identity Manager \data directory. Creating an Oracle ebs Adapter service You must create a service for the Oracle ebs Adapter before the Tivoli Identity Manager server can use the adapter to communicate with the managed resource. The Oracle ebs Adapter profile name is Oracle EBS Adapter Service Profile. To create a service, complete these steps: 1. Log in to the Tivoli Identity Manager server using an account that has the authority to perform administrative tasks. 2. Create the service using the information for your IBM Tivoli Identity Manager product. Refer to the information center or the online help for specific instructions about creating a service. To create or change a service, you must use the service form to provide information for the service. Service forms might vary depending on the adapter. Note: If the following fields on the service form are changed for an existing service, the IBM Tivoli Identity Manager Adapter service on the Tivoli Directory Integrator server needs to be restarted. v Service Name v v Password Owner v Service prerequisite See Starting and stopping the adapter service on page 7. The Oracle ebs Adapter service form contains the following fields: Service name Specify a name that defines this service on the Tivoli Identity Manager server. Description Optional: Specify a description for this service. Tivoli Directory Integrator location Optional: Specify the URL for the Tivoli Directory Integrator instance. Valid syntax is rmi://ip-address:port/itdidispatcher, where ip-address is the Tivoli Directory Integrator host and port is the port number for the RMI Dispatcher. The default URL is rmi://localhost:16231/itdidispatcher 6 IBM Tivoli Identity Manager: Directory Integrator- Based Oracle ebs Adapter Installation and Configuration Guide

23 See Changing the port number for the RMI Dispatcher on page 11 for information about changing the port number. Oracle ebs Service Name Specify the service name of Oracle ebs database instance to which the adapter is going to connect. Oracle ebs Service Host Specify the host workstation on which the Oracle ebs database instance is running. Oracle ebs Service Port Specify the port on which the Oracle ebs database service is listening. Administrator Name Specify the user that has access to the Oracle ebs database to log in and perform administrative operations. Password Specify the password for administrator user. Owner Optional: Specify a Tivoli Identity Manager user as a service owner. Service Prerequisite Optional: Specify a Tivoli Identity Manager service that is prerequisite to this service. Starting and stopping the adapter service After you edit the properties file for the adapter, you must stop and restart the adapter service in order for the changes to take effect. The method used to stop and restart the adapter depends on the operating system. AIX operating systems The adapter installer creates a subsystem called ITIMAd when the adapter is first installed. ITIM_RMI.xml is the configuration file. Use these commands to start and stop the adapter service. startsrc s ITIMAd stopsrc c s ITIMAd The adapter service runs the ibmdisrv.bat command. The bat file starts a Java process that does not stop when the adapter service is stopped. To stop this process, obtain the process ID (PID) and then kill the process. v To obtain the PID of the process, type this command: ps -ef grep <ITDI_HOME_DIR>/_jvm/jre/bin/, where ITDI_HOME_DIR is the directory where Tivoli Directory Integrator is installed. v To kill the process, type this command: kill -9 <pid>. HP-UX operating systems The adapter installer copies the ITIMAd script file to the adapters solution directory. This directory is a separate solution directory for all Tivoli Directory Integrator-based Tivoli Identity Manager adapters. From this directory, type these commands to start, stop, and restart the adapter service. ITIMAd start ITIMAd stop ITIMAd restart Chapter 2. Installing the Oracle ebs Adapter 7

24 Linux or Solaris operating systems The adapter installer automatically copies the ITIMAd script file to the /etc/init.d/ directory when the adapter is installed. From the /etc/init.d/ directory, type these commands to start, stop, and restart the adapter service. ITIMAd start ITIMAd stop ITIMAd restart Windows operating systems From the Control Panel, select Administrative Tools -> Services. From the Services menu, you can start and stop the adapter service. The service name is IBM Tivoli Identity Manager Adapter. zos operating systems Navigate to the adapter solution directory and enter the following commands: 1. To start the adapter: %./ITIMAd start 2. To verify that the process ibmdisrv_ascii is running: % ps ef grep ibmdisrv_ascii 3. To stop the adapater: %./ITIMAd stop 4. To verify that the process ibmdisrv_ascii is not running: % ps ef grep ibmdisrv_ascii 8 IBM Tivoli Identity Manager: Directory Integrator- Based Oracle ebs Adapter Installation and Configuration Guide

25 Chapter 3. Configuring the Oracle ebs Adapter This chapter describes the configuration options for the Oracle ebs Adapter. The following sections provide information for configuring the adapter. v Customizing the Oracle ebs Adapter profile v Configuration properties of the adapter on page 10 v Changing the port number for the RMI Dispatcher on page 11 v Configuring logging for the adapter on page 11 Customizing the Oracle ebs Adapter profile To customize the Oracle ebs Adapter profile, you must make changes to the Oracle ebs Adapter JAR file, OraEBSProfile.jar. You might customize the adapter profile to make changes to the account form or the service form. The OraEBSProfile.jar file is included in the Oracle ebs Adapter compressed file that you downloaded from the IBM Web site. Note: You cannot modify the schemas for this adapter. Attributes cannot be added to or deleted from the schema. v v v v v v v v Service.def Schema.dsml CustomLabels.properties eroracleebsaccount.xml eroracleebsrmiservice.xml OracleEBSAdapter.xml OracleEBSManageUserAL.xml OracleEBSSearchUserAL.xml To edit the OraEBSProfile.jar file, complete these steps: 1. Log in to the system where the Oracle ebs Adapter is installed. 2. Copy the OraEBSProfile.jar file into a temporary directory. 3. Extract the contents of the OraEBSProfile.jar file into the temporary directory by running the following command. jar -xvf OraEBSProfile.jar The jar command extracts the files into the OraEBSProfile directory. 4. Edit the file that you want to change. After you edit the file, you must import the file into the Tivoli Identity Manager server for the changes to take effect. To import the file, complete these steps: 1. Create a new JAR file using the files in the /tmp directory by running the following commands: cd c:\temp #jar -cvf OraEBSProfile.jar OraEBSProfile Copyright IBM Corp

26 2. Import the OraEBSProfile.jar file into the Tivoli Identity Manager Application server. For more information on importing the JAR file, refer to Importing the adapter profile into the Tivoli Identity Manager server on page Stop and start the Tivoli Identity Manager server. 4. Stop and start the Oracle ebs Adapter service. See Starting and stopping the adapter service on page 7 for information about stopping and starting the adapter service. Configuration properties of the adapter Table 2. Configuration properties for the adapter The global.properties and the itim_listener.properties files contain the configuration properties for the adapters. To configure the properties for an adapter, you must change one of these files. Table 2 lists the properties contained in the properties files. Property Properties file Description ALShutdownTimeout itim_listener.properties Specifies the amount of time, in seconds, before the RMI Dispatcher should shut down when a shutdown request is sent to the dispatcher. All assembly lines that are being maintained are terminated when the dispatcher shuts down. The default value 300 seconds, which is five minutes. com.ibm.di.dispatcher.bindname global.properties Specifies the RMI bind name to be used. The default value is ITDIDispatcher. com.ibm.di.dispatcher.disableconntectorcache global.properties Specifies whether the RMI Dispatcher should cache the connection to the managed resource so that no new connections are established upon subsequent calls. In this case, the same connection is used for all calls. The default value is true. com.ibm.di.dispatcher.objectport global.properties Specifies the port on which the actual Dispatcher remote object listens for RMI requests. The default value is 0, which means a random port is selected at runtime. com.ibm.di.dispatcher.registryport global.properties Specifies the port on which the RMI Dispatcher listens for provisioning requests from IBM Tivoli Identity Manager. The default value is SearchALUnusedTimeout itim_listener.properties Specifies the amount of time, in seconds, to wait before deleting assembly lines that have not been used. The default value is 600 seconds, which is 10 minutes. 10 IBM Tivoli Identity Manager: Directory Integrator- Based Oracle ebs Adapter Installation and Configuration Guide

27 Table 2. Configuration properties for the adapter (continued) Property Properties file Description SearchReaperThreadTimeOut itim_listener.properties Specifies the amount of time, in seconds, to release data from memory. This property is used during a reconciliation response. The default value is 300 seconds, which is five minutes. SearchResultSetSize itim_listener.properties Specifies the number of records, per response, returned during a reconciliation between IBM Tivoli Identity Manager and the adapter. The default value is 100. Changing the port number for the RMI Dispatcher If the Remote Method Invocation (RMI) Dispatcher is run as a service, by default, the port number is The installer automatically sets this parameter in the global.properties file. If the Tivoli Directory Integrator home directory is the same directory as the IBM Solutions directory, change the port number in the global.properties file. Otherwise, change the port number in the solutions.properties file in the IBM Solutions directory. To change the port number for the dispatcher, complete these steps. 1. Stop the service that is used to run the adapter. Refer to Starting and stopping the adapter service on page 7 for information about stopping and starting the Oracle ebs Adapter service. 2. Change the global.properties file or the solutions.properties file to use the correct port number. com.ibm.di.dispatcher.registryport= Start the service again. Configuring logging for the adapter Log files might provide information that is helpful for diagnosing and troubleshooting problems with the adapter. The type of information collected in your log file is determined by the settings in the log4j.properties file. To configure logging for the adapter, you must update this file. The file in Tivoli Directory Integrator versions 6.1 or later, the file is located in the adapter solutions/etc directory. To find the location of the adapter solutions directory, search for the ADAPTER_SOLDIR entry in the global.properties file, which is located in your ITDI_HOME/etc directory. When multiple adapters are running on the same server where Tivoli Directory Integrator is installed, logging information for the adapters is stored in the same log file. The RMI Dispatcher logs are also stored in this log file. You cannot configure logging to store information about the different components in different log files. After you complete the changes to the log4j.properties file, you must stop and restart the service for the adapter to view the configuration changes. Chapter 3. Configuring the Oracle ebs Adapter 11

28 The following sections contain information about configuring logging for the adapter. Naming the log file The log4j.appender.default.file entry in the log4j.properites file is used to configure the name of the log file. To change the name of the log file, change the value of log4j.appender.default.file. In the example below, the log file generated is ibmdi.log. log4j.appender.default.file=ibmdi.log Sizing the log file The log4j.appender.default.maxfilesize entry in the log4j.properties file is used to configure the maximum size of the log file. For example, log4j.appender.default.maxfilesize=8mb The number of log files generated is determined by the log4j.appender.default.maxbackupindex entry. In the example below, the number of log files generated is 10. log4j.appender.default.maxbackupindex=10 Configuring logging levels The Directory Integrator-based adapter logging level is determined by the log4j.rootcategory attribute in the log file. The four levels for logging information are ERROR, WARN, INFO, and DEBUG. By default the logging level is set to INFO. Other Tivoli Directory Integrator components might have their own log level set. These settings are not changed by the log4j.rootcategory setting. For example, log4j.logger.com.ibm.config and the log4j.logger.com.ibm.loader logging categories are set to WARN by default. To control the level of information logged you can either edit the component log level settings to be the same as the setting of the log4j.rootcategory attribute setting or comment out the individual component logging statement. For example, if you set the log4j.rootcategory logging level to ERROR, log4j.rootcategory=error you would also need to change the component logging level settings log4j.logger.com.ibm.di.config=error log4j.logger.com.ibm.di.loader=error or comment out the statements. # log4j.logger.com.ibm.di.config=warn # log4j.logger.com.ibm.di.loader=warn DEBUG The DEBUG level logs all of the details related to a specific operation. This is the highest level of logging. If logging is set to DEBUG, all other levels of logging information are displayed in the log file. ERROR The ERROR level logs only error conditions. The ERROR level provides the lowest amount of logging information. 12 IBM Tivoli Identity Manager: Directory Integrator- Based Oracle ebs Adapter Installation and Configuration Guide

29 INFO The INFO level logs information about workflow. It generally explains how an operation occurs. WARN The WARNING level logs information when an operation completes successfully but there are issues with the operation. Displaying logs in the user interface If the RMI Dispatcher is running from the command prompt by calling ibmdisrv (ibmdisrv.bat file for Windows operating systems and ibmdisrv for UNIX and Linux operating systems), the logs can be displayed on the console. To display the logs on the console: 1. Set the TDI_SOLDIR environment variable to the Tivoli Directory Integrator adapters solution directory. 2. Change your working directory to the Tivoli Directory Integrator adapters solution directory. 3. Edit the log4j.properties file located in the etc directory under the Tivoli Directory Integrator adapters solution directory: v Add CONSOLE to the log4j.rootcategory. log4j.rootcategory=debug, Default, CONSOLE v Uncomment the log4j.appender.console lines: log4j.appender.console=org.apache.log4j.consoleappender log4j.appender.console.layout=org.apache.log4j.patternlayout log4j.appender.console.layout.conversionpattern=%d [%t] %-5p - %m%n0 4. To run the RMI Dispatcher from the command line, at the command prompt for the Tivoli Directory Integrator adapters solution directory issue the following commands: For Windows operating systems cd c:\program Files\IBM\TDI\V6.1.1\timsol set TDI_SOLDIR="c:\Program Files\IBM\TDI\V6.1.1\timsol" c:\program Files\IBM\TDI\V6.1.1\ibmdisrv.bat -c ITIM_RMI.xml -d For UNIX and Linux operating systems cd /opt/ibm/tdi/v6.1.1/timsol export TDI_SOLDIR=/opt/IBM/TDI/V6.1.1/timsol /opt/ibm/tdi/v6.1.1/ibmdisrv -c ITIM_RMI.xml -d Appending information to an existing log file By default, log file information is deleted and created again each time the RMI Dispatcher starts. To append information to an existing log file before or after the dispatcher starts, change the value of the following entry from false to true in the log4j.properties file: log4jappender.default.append. For example, log4j.appender.default.append=true Managing passwords when restoring accounts How each restore action interacts with its corresponding managed resource depends on either the managed resource, or the business processes that you implement. Certain resources reject a password when a request is made to restore an account. In this case, you can configure IBM Tivoli Identity Manager to forego the new password requirement. You can set the Oracle ebs Adapter to require a Chapter 3. Configuring the Oracle ebs Adapter 13