Tivoli Identity Manager

Transcription

1 Tivoli Identity Manager Version 4.6 Adapter for SAP NetWeaver AS ABAP Installation and Configuration Guide SC

2

3 Tivoli Identity Manager Version 4.6 Adapter for SAP NetWeaver AS ABAP Installation and Configuration Guide SC

4 Note Before using this information and the product it supports, read the information in Appendix F, Notices, on page 71 Eleventh Edition (November, 2006) This edition applies to version of the Tivoli Identity Manager Adapter for SAP NetWeaver AS ABAP and to all subsequent releases and modifications until otherwise indicated in new editions. This edition replaces all previous editions. Copyright International Business Machines Corporation 2004, 2005, All rights reserved. US Government Users Restricted Rights Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

5 Contents Preface v Who should read this book v Publications and related information v Tivoli Identity Manager library v Prerequisite Product Publications vii Related Publications viii Accessing publications online viii Accessibility viii Support information ix Conventions used in this book ix Typeface conventions ix Operating system differences ix Definitions for HOME directory variables x Chapter 1. Overview Chapter 2. Adapter Installation Requirements Step 1: Testing Network Connectivity Step 2: Installing the Adapter Step 3: Importing the Transport Files Step 4: Activating the Adapter as a Service Step 5: Configuring the Adapter Step 6: Installing the Adapter s Certificate Step 7: Installing the Adapter s Profile Step 8: Configuring the Adapter s Forms Chapter 3. Adapter Profile Installation Introduction Requirements Installing the Adapter Profile Verifying the Adapter Profile is Installed Chapter 4. Adapter Parameters Modification Accessing the Adapter Configuration Tool Main Menu Viewing Configuration Settings Changing Protocol Configuration Settings Adding a Protocol Removing a Protocol Configuring a Protocol Setting Event Notification Setting Attributes to be Reconciled Modifying an Event Notification Context Changing the Configuration Key Changing Activity Logging Settings Changing Registry Settings Modifying Non-encrypted Registry Settings Modifying Encrypted Registry Settings Multi-instance Settings Changing Advanced Settings Viewing Statistics Changing code page settings Accessing Help and Additional Options Copyright IBM Corp. 2004, 2005, 2006 iii

6 Chapter 5. Certificate Installation Introduction Overview of SSL and Digital Certificates Basic Configuration for Server-to-Adapter SSL Clustered Tivoli Identity Manager Configuration Accessing the Certificate Configuration Tool Main Menu Generating a Private Key and Certificate Request Example of Certificate Request Script Example of request.pem File Installing the Certificate from a File Installing the Certificate and Key from a PKCS12 File Viewing Installed Certificates Viewing CA Certificates Installing a CA Certificate Deleting a CA Certificate Viewing Registered Certificates Registering a Certificate Unregistering a Certificate Exporting a certificate and key to PKCS12 file Appendix A. Adapter Variables Variable Descriptions Variables Used by Tivoli Identity Manager Adapter for SAP NetWeaver AS ABAP Actions System Login Add System Login Change System Login Delete System Login Suspend System Login Restore Reconciliation Appendix B. SAP Account Requirements SAP Objects SAP User Appendix C. Additional Installation Options Installation Options Setup Arguments Adapter Removal Appendix D. Example Deployment Scenarios Tivoli Identity Manager for non-unicode SAP non-cua with HR Linking Tivoli Identity Manager for non-unicode SAP CUA with HR Linking Appendix E. Support information Searching knowledge bases Search the information center on your local system or network Search the Internet Contacting IBM Software Support Determine the business impact of your problem Describe your problem and gather background information Submit your problem to IBM Software Support Appendix F. Notices Trademarks iv IBM Tivoli Identity Manager: Adapter for SAP NetWeaver AS ABAP Installation and Configuration Guide

7 Preface Who should read this book The IBM Tivoli Identity Manager Adapter for SAP NetWeaver AS ABAP enables connectivity between the IBM and a network of systems running SAP NetWeaver AS ABAP. This document describes the procedural steps that are required to install and configure the adapter. This document assumes that both Tivoli Identity Manager and SAP NetWeaver AS ABAP are installed, configured and running on your network. No details are provided regarding the installation and configuration of these products, except where necessary to achieve integration. This manual is intended for security administrators responsible for installing software on their site s computer systems. Readers are expected to understand security administration concepts. The person completing the installation procedure should also be familiar with their site s system standards. Readers should be able to perform routine security administration tasks. Publications and related information Read the descriptions of the Tivoli Identity Manager library. To determine which additional publications you might find helpful, read the Prerequisite Product Publications on page vii and the Related Publications on page viii. After you determine the publications you need, refer to the instructions in Accessing publications online on page viii. Tivoli Identity Manager library The publications in the Tivoli Identity Manager technical documentation library are organized into the following categories: v Release information v Online user assistance v Server installation and configuration v Problem determination v Technical supplements v Adapter installation and configuration Release Information: v IBM Tivoli Identity Manager Release Notes Provides software and hardware requirements for Tivoli Identity Manager, and additional fix, patch, and other support information. v IBM Tivoli Identity Manager Documentation Read This First Card Lists the Tivoli Identity Manager publications. Online user assistance: Copyright IBM Corp. 2004, 2005, 2006 v

8 Provides online help topics and an information center for all Tivoli Identity Manager administrative tasks. The information center includes information that was previously provided in the IBM Tivoli Identity Manager Configuration Guide and the IBM Tivoli Identity Manager Policy and Organization Administration Guide. Server installation and configuration: IBM Tivoli Identity Manager Server Installation and Configuration Guide for WebSphere Environments provides installation and configuration information for Tivoli Identity Manager. Configuration information that was previously provided in the IBM Tivoli Identity Manager Configuration Guide is now included in either the installation guide or in the IBM Tivoli Identity Manager Information Center. Problem determination: IBM Tivoli Identity Manager Problem Determination Guide provides problem determination, logging, and message information for the Tivoli Identity Manager product. Technical supplements: The following technical supplements are provided by developers or by other groups who are interested in this product: v IBM Tivoli Identity Manager Performance Tuning Guide Provides information needed to tune Tivoli Identity Manager Server for a production environment, available on the Web at: Click the I character in the A-Z product list, and then, click the Tivoli Identity Manager link. Browse the information center for the Technical Supplements section. v Redbooks and white papers are available on the Web at: IBMTivoliIdentityManager.html Browse to the Self Help section, in the Learn category, and click the Redbooks link. v Technotes are available on the Web at: v Field guides are available on the Web at: v For an extended list of other Tivoli Identity Manager resources, search the following IBM developerworks Web address: Adapter installation and configuration: The Tivoli Identity Manager Server technical documentation library also includes an evolving set of platform-specific installation documents for the adapter components of a Tivoli Identity Manager Server implementation. Locate adapters on the Web at: vi IBM Tivoli Identity Manager: Adapter for SAP NetWeaver AS ABAP Installation and Configuration Guide

9 IBMTivoliIdentityManager.html Browse to the Other resources, and click the link for the current inventory of adapters. Skills and training: The following additional skills and technical training information were available at the time that this manual was published: v Virtual Skills Center for Tivoli Software on the Web at: v Tivoli Education Software Training Roadmaps on the Web at: v Tivoli Technical Exchange on the Web at: supp_tech_exch.html Prerequisite Product Publications To use the information in this book effectively, you must have knowledge of the products that are prerequisites for Tivoli Identity Manager Server. Publications are available from the following locations: v Operating systems IBM AIX Sun Solaris Red Hat Linux Microsoft Windows Server v Database servers IBM DB2 - Support: - Information center: index.jsp - Documentation: winos2unix/support/v8pubs.d2w/en_main - DB2 product family: - Fix packs: downloadv8.html - System requirements: sysreqs.html Oracle Microsoft SQL Server 2000 Preface vii

10 Related v Directory server applications IBM Directory Server en_us/html/ldapinst.htm Sun ONE Directory Server v WebSphere Application Server Additional information is available in the product directory or Web sites. v WebSphere embedded messaging v IBM HTTP Server Publications Information that is related to Tivoli Identity Manager Server is available in the following publications: v The Tivoli Software Library provides a variety of Tivoli publications such as white papers, datasheets, demonstrations, redbooks, and announcement letters. The Tivoli Software Library is available on the Web at: v The Tivoli Software Glossary includes definitions for many of the technical terms related to Tivoli software. The Tivoli Software Glossary is available from the Glossary link of the Tivoli Software Library Web page at: Accessing publications online IBM posts publications for this and all other Tivoli products, as they become available and whenever they are updated, to the Tivoli software information center Web site. Access the Tivoli software information center at the following Web address: Click the I character in the A-Z list, and then click the Tivoli Identity Manager link to access the product library. Note: If you print PDF documents on other than letter-sized paper, set the option in the File Print window that allows Adobe Reader to print letter-sized pages on your local paper. Accessibility The product documentation includes the following features to aid accessibility: v Documentation is available in convertible PDF format to give the maximum opportunity for users to apply screen-reader software. viii IBM Tivoli Identity Manager: Adapter for SAP NetWeaver AS ABAP Installation and Configuration Guide

11 v All images in the documentation are provided with alternative text so that users with vision impairments can understand the contents of the images. Support information If you have a problem with your IBM software, you want to resolve it quickly. IBM provides the following ways for you to obtain the support you need: v Searching knowledge bases: You can search across a large collection of known problems and workarounds, Technotes, and other information. v Obtaining fixes: You can locate the latest fixes that are already available for your product. v Contacting IBM Software Support: If you still cannot solve your problem, and you need to work with someone from IBM, you can use a variety of ways to contact IBM Software Support. For more information about these ways to resolve problems, see Appendix E, Support information, on page 67. Conventions used in this book Typeface This reference uses several conventions for special terms and actions and for operating system-dependent commands and paths. conventions This guide uses the following typeface conventions: Bold Italic v Lowercase commands and mixed case commands that are otherwise difficult to distinguish from surrounding text v Interface controls (check boxes, push buttons, radio buttons, spin buttons, fields, folders, icons, list boxes, items inside list boxes, multicolumn lists, containers, menu choices, menu names, tabs, property sheets), labels (such as Tip:, and Operating system considerations:) v Keywords and parameters in text v Words defined in text v Emphasis of words (words as words) v New terms in text (except in a definition list) v Variables and values you must provide Monospace v Examples and code examples v File names, programming keywords, and other elements that are difficult to distinguish from surrounding text v Message text and prompts addressed to the user v Text that the user must type v Values for arguments or command options Operating system differences This guide uses the UNIX convention for specifying environment variables and for directory notation. Preface ix

12 When using the Windows command line, replace $variable with %variable% for environment variables and replace each forward slash (/) with a backslash (\) in directory paths. The names of environment variables are not always the same in Windows and UNIX. For example, %TEMP% in the Windows operating system is equivalent to $tmp in a UNIX operating system. Note: If you are using the bash shell on a Windows system, you can use the UNIX conventions. Definitions for HOME directory variables The following table contains the default definitions that are used in this guide to represent the HOME directory level for various product installation paths. You can customize the installation directory and HOME directory for your specific implementation. If this is the case, you need to make the appropriate substitution for the definition of each variable represented in this table. The value of path for the Windows operating system is drive:\program Files. The value of path for the AIX operating system is /usr. The value of path is /opt for other UNIX and Linux operating systems. Path Variable Default Definition Description DB_INSTANCE_HOME Windows: path\ibm\sqllib UNIX and Linux: v AIX, Linux: /home/dbinstancename v Solaris: /export/home/ dbinstancename LDAP_HOME v IBM Directory Server Windows: path\ibm\ldap UNIX: path/ibm/ldap v Sun ONE Directory Server Windows: path\sun\mps UNIX: /var/sun/mps The directory that contains the database for Tivoli Identity Manager. The directory that contains the directory server code. HTTP_HOME ITIM_HOME Windows: path\ibmhttpserver UNIX and Linux: path/ibmhttpserver Windows: path\ibm\itim UNIX and Linux: path/ibm/itim The directory that contains the IBM HTTP Server code. The base directory that contains the Tivoli Identity Manager code, configuration, and documentation. x IBM Tivoli Identity Manager: Adapter for SAP NetWeaver AS ABAP Installation and Configuration Guide

13 Path Variable Default Definition Description WAS_HOME Windows: path\websphere\appserver The WebSphere Application Server home directory UNIX and Linux: path/websphere/appserver WAS_MQ_HOME Windows: path\ibm\webspheremq The directory that contains the WebSphere MQ code. UNIX and Linux: path/mqm WAS_NDM_HOME Windows: path\websphere\deploymentmanager The home directory on the deployment manager UNIX and Linux: path/websphere/deploymentmanager Tivoli_Common_Directory Windows: path\ibm\tivoli\common\ctgim UNIX and Linux: path/ibm/tivoli/common/ctgim The central location for all serviceability-related files, such as logs and first-failure capture data Preface xi

14 xii IBM Tivoli Identity Manager: Adapter for SAP NetWeaver AS ABAP Installation and Configuration Guide

15 Chapter 1. Overview This installation guide provides all of the basic information necessary to install and configure the Tivoli Identity Manager Adapter for SAP NetWeaver AS ABAP. On successful installation, the adapter enables IBM Tivoli Identity Manager to provision access to your network s SAP NetWeaver AS ABAP resources. The basic procedures required to install, configure, and run the adapter are as follows: v Install the adapter software. v Activate the Tivoli Identity Manager Adapter for SAP NetWeaver AS ABAP as a service on the adapter s system. v Configure the adapter s communication protocols to enable the Tivoli Identity Manager Adapter for SAP NetWeaver AS ABAP to communicate with the Tivoli Identity Manager Server. v Install the adapter s profile on the Tivoli Identity Manager Server. v Configure the Tivoli Identity Manager Server to recognize the adapter as a service. Copyright IBM Corp. 2004, 2005,

16 2 IBM Tivoli Identity Manager: Adapter for SAP NetWeaver AS ABAP Installation and Configuration Guide

17 Chapter 2. Adapter Installation This chapter describes the steps required to install and configure the Tivoli Identity Manager Adapter for SAP NetWeaver AS ABAP software. You must complete the steps in the order they are listed. This chapter has the following sections: v Requirements v Step 1: Testing Network Connectivity on page 8 v Step 2: Installing the Adapter on page 9 v Step 3: Importing the Transport Files on page 11 v Step 4: Activating the Adapter as a Service on page 13 v Step 5: Configuring the Adapter on page 13 v Step 6: Installing the Adapter s Certificate on page 13 v Step 7: Installing the Adapter s Profile on page 13 v Step 8: Configuring the Adapter s Forms on page 14 Requirements The following sections identify the hardware, software, and authorization requirements to install the Tivoli Identity Manager Adapter for SAP NetWeaver AS ABAP. Verify that all of the requirements have been met before installing the Tivoli Identity Manager Adapter for SAP NetWeaver AS ABAP. System The adapter must be installed on a server with a 32-bit x86-based microprocessor (486 minimum), at least 512 MB of memory, and at least 300 MB of free disk space. Operating System Windows NT 4.0 with SP6 or Windows 2000 workstation with SP2. Solaris version 2.8 AIX 5.x SAP NetWeaver AS ABAP Software SAP 4.6C, 4.6D, 6.10, 6.20, 6.40 or 7.00 must be installed and operational on a system that is accessible from the machine where the adapter is installed. The adapter will work with the SAP system even if the Central User Administration (CUA) feature is installed and configured. Note: Each SAP NetWeaver AS ABAP 4.6 system must be patched to at the following levels or higher: v ABA Support Package 22 for 4.6C v R/3 Support Package 21 for 4.6C v Basis Support Package 31 for 4.6C v R/3 HR Support Package 27 Each SAP NetWeaver AS ABAP 6.20 system should be patched at the following levels or higher: v SAP_BASIS SAPKB62043 v SAP_ABA SAPKA62043 Copyright IBM Corp. 2004, 2005,

18 SAP SAP Each SAP NetWeaver AS ABAP 6.40 system should be patched at the following levels or higher: v SAP_BASIS v SAP_ABA Each SAP NetWeaver AS ABAP 700 system should be patched at the following levels or higher: v SAP_BASIS SAPKB70000 v SAP_ABA SAPKA70000 The adapter also requires the 32 bit SAP SDK runtime library (for Win32 it is librfc32.dll, for Solaris it is librfccm.so, for AIX it is librfccm.o). Get this library from the SAP presentation CDs or download it from SAP Market Place Web site. After installation of the adapter place this library in the adapter s lib directory or set your path to make it accessible. For Solaris, export the environment variable LD_LIBRARY_PATH to include the adapter s lib directory with a command such as the following: export LD_LIBRARY_PATH=Adapter_Install_dir/ lib:$ld_library_path For AIX, export the environment variable LIBPATH to include the Agent s lib directory with a command such as the following: export LIBPATH=Agent_Install_dir/ lib:$libpath For Windows, place the library in the either the system32 directory, the adapter s bin directory, or set the Path environment variable to make it accessible. The adapter will not run without this library! Authority The administrator installing the Tivoli Identity Manager Adapter must have general SAP Basis resources to perform a transport import of RFC (Remote Function Call) and related objects as well as setup OS specific directories and authorizations. The Security Administrator must create the CPIC (Common Programming Interface for Communications) or System user for use by the adapter to connect to the SAP NetWeaver AS ABAP system via the external RFC interface. User The Tivoli Identity Manager Adapter for SAP NetWeaver AS ABAP user must be authorized to perform user account administration: v Add v v v v Modify Delete Lock Unlock v Retrieve user detail v Retrieve supporting data v Set, unset and retrieve HR infotype 0105 (Communication) subtypes only if the SAP HR module is installed on a SAP system in your SAP environment. 4 IBM Tivoli Identity Manager: Adapter for SAP NetWeaver AS ABAP Installation and Configuration Guide

19 To perform these tasks, at a minimum, a Role should be assigned with at least these SAP authorization objects assigned to it. You may wish to create a specific Role only for use by this SAP user account. This can be accomplished using transaction SU02 via the SAP GUI. v S_RFC (SAP R/3 6.20) v S_RFCACL (SAP R/3 6.20) v v v v v S_TABU_DIS S_USER_GRP S_USER_AGR S_USER_PRO S_USER_SYS v P_ORGIN (Required for HR linking only) In addition, the Tivoli Identity Manager Adapter for SAP NetWeaver AS ABAP user type should be set to Communication (CPIC) or System and not Dialog. SAP Transport Files The Tivoli Identity Manager Adapter for SAP NetWeaver AS ABAP requires custom RFCs and BAPIs. These custom RFCs and BAPIs are provided in transport files packaged with the adapter and are therefore only available after adapter installation. These transport file packages must be imported into your SAP system prior to running the adapter. The transport files you must import into your SAP system vary depending on your site s configuration of SAP. The adapter will not function without one of these transport files in place. Select the transport file based on the version of your SAP system. The transport files WITHOUT HR Linking are as follows: v For NON-CUA (4.6C, 4.6D and 6.10): TV2K (cofile = K TV2, data = R TV2) v For NON-CUA (6.20 and 6.40): Non-unicode: - TV2K (cofile = K TV2, data = R TV2) Unicode: - TV1K (cofile = K TV1, data = R TV1) v For CUA (4.6C, 4.6D and 6.10) : TV2K (cofile = K TV2, data = R TV2) v For CUA (6.20 and 6.40) : Non-unicode: - TV2K (cofile = K TV2, data = R TV2) Unicode: - TV1K (cofile = K TV1, data = R TV1) v For HR InfoType 0105 Support, import one of the transport files below into the targeted SAP HR system. These transports contain the functionality to link the HR Personnel record to the SAP user account by assigning the account an SAP HR Personnel Number. You can link the HR record in both CUA and non-cua SAP environments. If your HR system is a child system in a CUA environment, three actions are required for the adapter to link HR personnel records: Chapter 2. Adapter Installation 5

20 1. Import one of TV2K or TV1K into the CUA Master system. Then import the CUA Master transport into the CUA master system. 2. Import the non-cua transport into your child system. 3. An RFC destination of type R3 Connection must exist in the CUA master system. This RFC destination will connect to your HR system. The Gateway services file on the CUA Master system most be configured for the gateway service of your HR system. There should already be and RFC Destination to the child HR System which is used as part of the CUA configuration. If you don not wish to use this RFC destination then you can create one. An RFC destination requires the following details: SAP user account on HR system with HR authorization. SAP user account password on HR system. HR system s host name or IP address. HR system s SAP system number. Use the SAP GUI transaction SM59 to create RFC destinations. The transports WITH HR linking are as follows: v For NON-CUA (4.6C, 4.6D and 6.10): TV2K (cofile = K TV2, data = R TV2) v For NON-CUA (6.20 and 6.40): Non-unicode: - TV2K (cofile = K TV2, data = R TV2) Unicode: - TV1K (cofile = K TV1, data = R TV1) v For CUA (4.6C, 4.6D and 6.10) : TV2K (cofile = K TV2, data = R TV2) TV2K (cofile = K TV2, data = R TV2) v For CUA (6.20 and 6.40) : Non-unicode: - TV2K (cofile = K TV2, data = R TV2) - TV2K (cofile = K TV2, data = R TV2) Unicode: - TV1K (cofile = K TV1, data = R TV1) - TV1K (cofile = K TV1, data = R TV1) These transport files contain custom RFCs (BAPIs), data elements and tables used by the adapter in various operations: Table 1. Transport Identifiers and Contents Transport Identifier Uni code HR CUA Transport Contents TV2K NO NO NO /TIVSECTY/TIM_USER_LIST_620 (RFC) /TIVSECTY/TIM_USER_USR02_620 (RFC) /TIVSECTY/TIM_USER_CHG_46C (RFC) /TIVSECTY/TIM_USER_PWD_46C (RFC) /TIVSECTY/TIM_USER_ADD_46C (RFC) 6 IBM Tivoli Identity Manager: Adapter for SAP NetWeaver AS ABAP Installation and Configuration Guide

21 Table 1. Transport Identifiers and Contents (continued) Transport Identifier Uni code HR CUA Transport Contents TV2K NO YES NO /TIVSECTY/TIM_USER_LIST_620 (RFC) /TIVSECTY/TIM_USER_USR02_620 (RFC) /TIVSECTY/TIM_USER_CHG_46C (RFC) /TIVSECTY/TIM_USER_PWD_46C (RFC) /TIVSECTY/TIM_USER_ADD_46C (RFC) /TIVSECTY/TIM_USER_HR_620 (RFC) TV2K NO NO YES /TIVSECTY/TIM_USER_LIST_620 (RFC) /TIVSECTY/TIM_USER_USR02_620 (RFC) /TIVSECTY/TIM_USER_CHG_46C (RFC) /TIVSECTY/TIM_USER_PWD_46C (RFC) /TIVSECTY/TIM_USER_ADD_46C (RFC) /TIVSECTY/TIM_USER_SUBSYS_46C (RFC) /TIVSECTY/TIM_SYSTEMS (Structure) TV2K NO YES YES /TIVSECTY/TIM_USER_LIST_620 (RFC) /TIVSECTY/TIM_USER_USR02_620 (RFC) /TIVSECTY/TIM_USER_CHG_46C (RFC) /TIVSECTY/TIM_USER_PWD_46C (RFC) /TIVSECTY/TIM_USER_ADD_46C (RFC) /TIVSECTY/TIM_USER_SUBSYS_46C (RFC) /TIVSECTY/TIM_SYSTEMS (Structure) /TIVSECTY/TIM_USER_CUAHR_620 (RFC) /TIVSECTY/TIM_READ_TABLE_620 TV2K NO NO NO /TIVSECTY/TIM_USER_LIST_620 (RFC) /TIVSECTY/TIM_USER_USR02_620 (RFC) /TIVSECTY/TIM_USER_CHG_620 (RFC) /TIVSECTY/TIM_USER_PWD_620 (RFC) /TIVSECTY/TIM_USER_ADD_620 (RFC) TV2K NO YES NO /TIVSECTY/TIM_USER_LIST_620 (RFC) /TIVSECTY/TIM_USER_USR02_620 (RFC) /TIVSECTY/TIM_USER_CHG_620 (RFC) /TIVSECTY/TIM_USER_PWD_620 (RFC) /TIVSECTY/TIM_USER_ADD_620 (RFC) /TIVSECTY/TIM_USER_HR_620 (RFC) TV2K NO NO YES /TIVSECTY/TIM_USER_LIST_620 (RFC) /TIVSECTY/TIM_USER_USR02_620 (RFC) /TIVSECTY/TIM_USER_CHG_620 (RFC) /TIVSECTY/TIM_USER_PWD_620 (RFC) /TIVSECTY/TIM_USER_ADD_620 (RFC) /TIVSECTY/TIM_USER_SUBSYS_620 (RFC) /TIVSECTY/TIM_SYSTEMS (Structure) TV2K NO YES YES /TIVSECTY/TIM_USER_LIST_620 (RFC) /TIVSECTY/TIM_USER_USR02_620 (RFC) /TIVSECTY/TIM_USER_CHG_620 (RFC) /TIVSECTY/TIM_USER_PWD_620 (RFC) /TIVSECTY/TIM_USER_ADD_620 (RFC) /TIVSECTY/TIM_USER_SUBSYS_620 (RFC) /TIVSECTY/TIM_SYSTEMS (Structure) /TIVSECTY/TIM_USER_CUAHR_620 (RFC) /TIVSECTY/TIM_READ_TABLE_620 (RFC) TV2K NO YES YES /TIVSECTY/HRDELIMITDATE (Data Element) /TIVSECTY/P0105NL (Table) Chapter 2. Adapter Installation 7

22 Table 1. Transport Identifiers and Contents (continued) Transport Identifier Uni code HR CUA Transport Contents TV1K YES NO NO /TIVSECTY/TIM_USER_LIST_620 (RFC) /TIVSECTY/TIM_USER_USR02_620 (RFC) /TIVSECTY/TIM_USER_CHG_620 (RFC) /TIVSECTY/TIM_USER_PWD_620 (RFC) /TIVSECTY/TIM_USER_ADD_620 (RFC) TV1K YES YES NO /TIVSECTY/TIM_USER_LIST_620 (RFC) /TIVSECTY/TIM_USER_USR02_620 (RFC) /TIVSECTY/TIM_USER_CHG_620 (RFC) /TIVSECTY/TIM_USER_PWD_620 (RFC) /TIVSECTY/TIM_USER_ADD_620 (RFC) /TIVSECTY/TIM_USER_HR_620 (RFC) TV1K YES NO YES /TIVSECTY/TIM_USER_LIST_620 (RFC) /TIVSECTY/TIM_USER_USR02_620 (RFC) /TIVSECTY/TIM_USER_CHG_620 (RFC) /TIVSECTY/TIM_USER_PWD_620 (RFC) /TIVSECTY/TIM_USER_ADD_620 (RFC) /TIVSECTY/TIM_USER_SUBSYS_620 (RFC) /TIVSECTY/TIM_SYSTEMS (Structure) TV1K YES YES YES /TIVSECTY/TIM_USER_LIST_620 (RFC) /TIVSECTY/TIM_USER_USR02_620 (RFC) /TIVSECTY/TIM_USER_CHG_620 (RFC) /TIVSECTY/TIM_USER_PWD_620 (RFC) /TIVSECTY/TIM_USER_ADD_620 (RFC) /TIVSECTY/TIM_USER_SUBSYS_620 (RFC) /TIVSECTY/TIM_SYSTEMS (Structure) /TIVSECTY/TIM_USER_CUAHR_620 (RFC) /TIVSECTY/TIM_READ_TABLE_620 (RFC) TV1K YES YES YES /TIVSECTY/HRDELIMITDATE (Data Element) /TIVSECTY/P0105NL (Table) Network Connectivity The adapter must be installed on a system that can communicate with the Tivoli Identity Manager Server through a TCP/IP network. System Administrator Authority The person completing the Tivoli Identity Manager Adapter for SAP NetWeaver AS ABAP installation procedure must have system administrator authority to complete the steps in this chapter. Server Step 1: Testing Network Connectivity Communication Communication between the Tivoli Identity Manager Server and the Tivoli Identity Manager Adapter for SAP NetWeaver AS ABAP should be tested with a low-level communication ping before installing any IBM software. This makes troubleshooting easier if you encounter installation problems. This step tests basic network connectivity and file transfer capability. Testing is done between the Windows workstation where the Tivoli Identity Manager Adapter for SAP NetWeaver AS ABAP will be installed, and the workstation where the Tivoli Identity Manager Server is or will be located. 8 IBM Tivoli Identity Manager: Adapter for SAP NetWeaver AS ABAP Installation and Configuration Guide

23 Step 2: Installing the Adapter You must issue a ping command from the Tivoli Identity Manager to the designated adapter workstations to verify communication. 1. Log on to the host running the SAP NetWeaver AS ABAP Adapter. 2. Test communication between the Tivoli Identity Manager Server and the host running the SAP NetWeaver AS ABAP Adapter: # ping ITIM_Server_host_name/IP_address 3. Test communication between the host running the SAP NetWeaver AS ABAP Adapter and the host running SAP NetWeaver AS ABAP Server. You will need to know the SAP instance number for this step (default SAP NetWeaver AS ABAP installations have the instance number 00). If the instance number is different, make the port number below 33<instance_number>. If the instance number was 80, then the port would become 3380 in the telnet command: telnet SAP_NetWeaver_AS_ABAP_Server_host_name/IP_address 3300 An executable installation program is provided for the Tivoli Identity Manager Adapter for SAP NetWeaver AS ABAP. When you run the installation program, you can accept the default settings or select new values. The Tivoli Identity Manager Tivoli Identity Manager Adapter for SAP NetWeaver AS ABAP installation files are available for download from IBM s Web site. Contact your IBM account representative for the Web address and download instructions. To install the adapter, do the following: 1. Download the Tivoli Identity Manager Adapter for SAP NetWeaver AS ABAP installation zip file from IBM s Web site. 2. Extract the contents of the Tivoli Identity Manager Adapter for SAP NetWeaver AS ABAP installation zip file into a temporary directory. 3. Complete one of the following: For a Tivoli Identity Manager Adapter installed on a UNIX platform: a. Change the working directory to the temporary directory where you extracted the profile installation file. # cd /tmp where tmp is the path of the directory containing the adapter installation file. b. Run the Tivoli Identity Manager Adapter for SAP NetWeaver AS ABAP adapter installation binary that is appropriate for your operating system. #./SapAgent/install/Agent/SAPAgentSetup_operating system.bin where operating system is the name of your operating system, such as aix or solaris. For a Tivoli Identity Manager Adapter installed on Windows: Select Run... from the Start menu and type the path to the temporary directory followed by SapAgent\install\agent\ SapAgentSetup_win32.exe. For example: 4. Click Next. C:\Temp\SapAgent\install\agent\SapAgentSetup_win32.exe The Welcome dialog window appears. Chapter 2. Adapter Installation 9

24 The License dialog window appears. 5. Read the License agreement and select the I accept option to continue. 6. Click Next. The Select Destination Directory dialog window appears. Installer Click Next to install < agentname> to this directory, or click Browse to install to a different directory Directory Name: C:\tivoli\agents\< agentname> Browse... InstallShield < Back Next > Cancel Figure 1. Select Destination Directory dialog window 7. Accept the default or select an alternate destination path and click Next. The Install Summary dialog window appears. 8. Click Next. The SAP NetWeaver AS ABAP Instance Setup dialog is displayed. 9. In the respective fields, type the SAP NetWeaver AS ABAP instance name and the password for the CPIC SAP user account that the adapter will use and click Next. The SAP NetWeaver AS ABAP enter more instances dialog is displayed. To enter more instances select Yes and repeat this step for as many SAP NetWeaver AS ABAP instances as required. Otherwise select No. 10. Click Finish. 11. Check the installation directory has been created as specified in step 7. Make the SAP SDK shared library accessible by the adapter. For For Solaris: Copy the SAP SDK library (librfccm.so) into the adapter s lib directory, and then export the environment variable LD_LIBRARY_PATH to include the adapter s lib directory with a command such as this. export LD_LIBRARY_PATH=adapter_install_dir/lib:$LD_LIBRARY_PATH AIX: Copy the SAP SDK library (librfccm.o) into the adapter s lib directory, and then export the environment variable LIBPATH to include the adapter s lib directory with a command such as this. 10 IBM Tivoli Identity Manager: Adapter for SAP NetWeaver AS ABAP Installation and Configuration Guide

25 export LIBPATH=adapter_install_dir/lib:$LIBPATH For Windows: Copy the SAP SDK library (librfc32.dll) into either the system32 directory, the adapter s bin directory, or set the Path environment variable to make it accessible. If you already have the SAP GUI installed on this Windows host, a version of the SAP SDK library should already exist in the system32 directory. 12. Locate the transport files in the adapter s transports directory. Give the COFILES and the DATA files to your SAP BASIS administrator to import into all targeted SAP NetWeaver AS ABAP systems. As these transports are client independent, ensure that your transport landscape allows for this before importing. The next section describes the transport import procedure. Note: By setting the transport landscape up appropriately, you will be sure not to import the transports into clients that do not need them (even though importing the transports files into other clients will not have any impact on them). The imported function modules and data structures can be removed via a new transport/change request if required. Step 3: Importing the Transport Files Note: IBM recommends that these imports be performed by a SAP Basis Administrator. For the adapter to function, it is necessary to import one of the transport files sets described above. You must first copy the transports set to the transport directory in each mysap.com landscape, so that the Tivoli Identity Manager Adapter for SAP NetWeaver AS ABAP can communicate with your target SAP systems. For demonstration purposes the following instructions refer to the transport TV2K as an example. You will need to repeat these steps for each transport in your required transport file set as defined in the table above. Before you begin the transport import process, complete the following steps: 1. Locate the transport files in the transports installation subdirectory for the adapter. For example, on a Windows installation this would be C:\Tivoli\Agents\SapAgent\transports. 2. Copy the transport files to the application server that will be used to execute the import: a. Copy all files in the cofiles subdirectory (K TV2) in ASCII format to the /usr/sap/trans/cofiles directory. Ensure that the files have write permission. b. Copy all files in the data subdirectory (R TV2) in binary format to the /usr/sap/trans/data directory. Ensure that the files have write permission. c. Ensure that the files are owned by the group sapsys. 3. Perform the following prerequisite checks before beginning the import process: a. The transport and correction system must be already configured and functioning. b. The target system must be properly defined within a transport domain. You can now perform the transport import. This procedure can be performed from either the command line or by using the Transport Managing System. Using the Transport Managing System: Chapter 2. Adapter Installation 11

26 1. Log into the SAP GUI with a mysap.com SAP GUI administrator account. 2. Display the Transport Management System. Either: v Run transaction STMS, or v Select Tools then Administration, then Transport, then Transport Management System. 3. Display the available mysap.com system import queues. Either: v Click the Import Overview icon, then click Display Import Queue, or v Double-click the target system in the Import Overview window. 4. Add the transport to the buffer. If the transports already exist in the buffer, proceed to the next step. If the buffer does not exist, perform the following steps: a. From the Extras menu, select Other Requests then Add to display the Add Transport Request to Import Queue dialog. b. In the Transp. request field, enter the transport name that you want to add, such as TV2K Click the icon with the green check on it and then click Yes on the confirmation dialog. 5. Import the transport as follows: a. From the Import Queue window, select the transport. b. From the Request menu, select Import to display the Import Transport Request dialog. c. In the Target client field, select the target client from the drop-down list. Click the icon with the green check on it and then click Yes on the confirmation dialog. 6. Verify that the import was successful. To do this, log into the SAP GUI and go to the Function builder transaction (se37) and check that the Function Modules (RFCs) listed in the transport description table above (see Table 1 on page 6) are installed and active. If the Function Modules (RFCs) are not active, activate the objects. Note: A mysap.com developer key is required to activate the objects. Using the command line: 1. Log on to the target SAP system host machine as the mysap.com administrator and change to the /usr/sap/trans/bin directory. 2. Show the current contents of the transport buffer: tp showbuffer sid where sid is the three-character identifier of your mysap.com system. 3. Verify that there are no other transports included in the transport buffer. 4. Add the transport to the buffer: tp addtobuffer TV2K sid 5. Verify that the transport has been placed in the buffer: tp showbuffer sid 6. Import the transport: tp import TV2K sid 7. Verify that the import was successful. To do this, log into the SAP GUI and go to the Function builder transaction (se37) and check that the Function Modules (RFCs) listed in the transport description table above 12 IBM Tivoli Identity Manager: Adapter for SAP NetWeaver AS ABAP Installation and Configuration Guide

27 Step 4: Activating the Adapter as a Service (see Table 1 on page 6) are installed and active. If the Function Modules (RFCs) are not active, activate the objects. If the Tivoli Identity Manager Agent for SAP NetWeaver AS ABAP was installed on a Windows host, a service is created for starting and stopping the agent. On UNIX platforms, the agent is deployed with script files to start and stop the agent. The following scripts are located in the bin directory of the agent installation: v v StopAgent.sh StartAgent.sh Use the Tivoli Identity Manager Adapter for SAP NetWeaver AS ABAP service or scripts to start the Tivoli Identity Manager Adapter for SAP NetWeaver AS ABAP software on the target platform. Step 5: Configuring the Adapter The Tivoli Identity Manager Adapter for SAP NetWeaver AS ABAP uses the DAML protocol to ensure secure communication with the Tivoli Identity Manager Server. Default protocol values are provided. However, you must configure the DAML protocol for your site s systems. Refer to Changing Protocol Configuration Settings on page 21 for more information. Step 6: Installing the Adapter s Certificate A certificate must also be installed for the DAML protocol. You must obtain a production certificate from a well-known Certificate Authority or create your own certificate using your own Certificate Authority. The Tivoli Identity Manager Adapter for SAP NetWeaver AS ABAP does not come prepackaged with a certificate. Refer to Chapter 5, Certificate Installation, on page 37 for more information about installing certificates. When you install the new certificate, you will also need to install the new Certificate Authority on the Tivoli Identity Manager Server. For more information, refer to the IBM Tivoli Identity Manager Server Installation and Configuration Guide, specifically the sections marked Preparing to install adapters. Note: You must configure the DAML protocol before installing your certificate. Stop and restart the adapter after the certificate is installed. Step 7: Installing the Adapter s Profile Before an adapter can be added as a service to the Tivoli Identity Manager Server, the server must have a service profile to recognize the adapter as a service. See Chapter 3, Adapter Profile Installation, on page 17 for more information on installing the adapter s profile on the Tivoli Identity Manager Server. Note: If this is an upgrade of an existing adapter, the new adapter schema will not be reflected immediately. The Tivoli Identity Manager system stores the adapter schema in memory. However, this cache is periodically refreshed Chapter 2. Adapter Installation 13

28 and the new adapter schema will be reflected after the cache is refreshed. Re-boot the Tivoli Identity Manager system to refresh the adapter schema immediately. Step 8: Configuring the Adapter s Forms Configure the adapter s service maintenance and account maintenance forms on the Tivoli Identity Manager Server. Refer to the IBM Tivoli Identity Manager Information Center for more information. When adding the adapter as a Tivoli Identity Manager Service to the Tivoli Identity Manager Server, the following SAP connection parameters must be defined: Table 2. Service Attributes ITIM Service Attribute Name ITIM Service Attribute Description SAP System Version Legacy Service attribute. The adapter officially only supports 4.6C to WAS Recommend value is 46C+. SAP Client Instance Name Required Service Attribute. This is the SAP instance name for the SAP instance your connecting to. Interface with CUA? Optional Service Attribute. Check this radio button if the adapter is provisioning to a Central User Administration (CUA) SAP client. Do Not Force Password Change? Optional Service Attribute. Check this radio button if you want to disable SAP s password reset functionality. Required to synchronize passwords across other Tivoli Identity Manager accounts for this identity. Disable Admin Unlock On Restore? By default users will not be allowed to restore their account if the account was locked by an administrator. Check this radio button if you want to allow users to restore their account after it has been locked by an administrator. Unlock Account On Password Change? Optional Service Attribute. Check this radio button if you want the adapter to perform a secondary unlock action on a password change request. If activated, the account will be unlocked if the reason for its lock state was to many failed login attempts. Display Indirectly Assigned Roles? Optional Service Attribute. Check this radio button if you want an to have Roles assigned indirectly reconciled for accounts. Roles are assigned indirectly as a result of Composite Role assignment. Enable HR infotype 105 Link? Optional Service Attribute. Check this radio button if you want to allow the adapter to Link SAP accounts to HR Personnel Records using infotype 105 (Communication). RFC Destination for HR System (CUA only) Optional Service Attribute. This option requires a value when you have selected the option above Enable HR infotype 105 Link?, and your SAP System uses the CUA configuration. 14 IBM Tivoli Identity Manager: Adapter for SAP NetWeaver AS ABAP Installation and Configuration Guide

29 Table 2. Service Attributes (continued) ITIM Service Attribute Name ITIM Service Attribute Description Role Default End Date Optional Service Attribute. This is the default Role End Date. Role Date Max Year Optional Service Attribute. This is the maximum year value for the Role start and end date widgets. Default value is Span Role Date Years? Optional Service Attribute. Check this radio button if you want to Span the Role End Date Year field (that is, display all years from 1990 to the defined Role Date Max Year above). Target Client Required Service Attribute. This is the SAP instance client number. Login ID Required Service Attribute. This is the CPIC SAP User account login ID that the adapter will use to connect to the SAP client. Language Required Service Attribute. This is the SAP login language parameter. Mode (only NetWeaver AS ABAP supported now) Legacy Service attribute. The adapter officially only supports the NetWeaver AS ABAP mode. SAP System (DNS hostname or IP) Required Service Attribute. Hostname of the SAP server host machine only if DNS is set up correctly. Otherwise use the IP address. Test the connection using the ping command from the command line on the host running the adapter. SAP System Number Required Service Attribute. The SAP server system number. Default SAP install has system number 00. SAP Gateway (DNS hostname or IP) Required Service Attribute. Hostname of the SAP gateway host machine only if DNS is set up correctly. Otherwise use the IP address. Test the connection using the ping command from the command line on the host running the adapter. Usually this is the same host that contains the SAP server SAP Gateway Service Name Required Service Attribute. The SAP gateway service string. Default SAP install has system number sapgw00. Enable RFC Trace? Optional Service Attribute. Set to ON to enable RFC trace files for debug purposes. If you find a problem with the adapter, ensure you re-produce the request with Trace enabled and capture the trace file. The logs are created in the directory where the RFCSDK runtime library is located. Enable Extended RFC Logon? Optional Service Attribute. Check this radio button to enable use of entended RFC logon. Define the extended logon attributes by creating unencryped registry values. Note: This SAP functionality does not currently support AIX in a reliable fashion. Therefore it is recommended that this setting not be used for Agent s running on AIX with the SAP RFCSDK 6.40 AIX library. Chapter 2. Adapter Installation 15

30 Figure 2. Configuring the Adapter s Forms 16 IBM Tivoli Identity Manager: Adapter for SAP NetWeaver AS ABAP Installation and Configuration Guide