Universal Provisioning Agent

Transcription

1 IBM Tivoli Identity Manager Universal Provisioning Agent SA

2

3 IBM Tivoli Identity Manager Universal Provisioning Agent SA

4 !, 51 C. ( ), Copyright International Business Machines Corporation All rights reserved.

5 v v v Tivoli Identity Manager.. v v vi vi vi vii : : : : : : : : : : : : : : SSL SSL Tivoli Identity Manager request.pem PKCS CA CA CA A Universal Provisioning Agent B Copyright IBM Corp iii

6 C iv IBM Tivoli Identity Manager: Universal Provisioning Agent

7 Tivoli Identity Manager Universal Provisioning Agent(Universal Provisioning Agent) IBM Tivoli Identity Manager Server. Tivoli Identity Manager. Universal Provisioning Agent..... Tivoli Identity Manager.. Tivoli Identity Manager Tivoli Identity Manager. v Tivoli Identity Manager Tivoli Identity Manager. v Tivoli Identity Manager Policy and Organization Administration Guide Tivoli Identity Manager. v Tivoli Identity Manager Server Configuration Guide Tivoli Identity Manager. Tivoli Identity Manager. v Tivoli Software Library,,, Tivoli. Tivoli Software Library. Copyright IBM Corp v

8 v Tivoli Software Glossary Tivoli. Tivoli Software Glossary Tivoli Software Library Glossary. IBM Tivoli Software Library PDF(Portable Document Format) HTML(Hypertext Markup Language). Product manuals. Tivoli Software Information Center.,,,. : PDF Adobe Acrobat ( ).. v HTML PDF. v. IBM Tivoli IBM Tivoli Software Support. IBM Software Support Guide. vi IBM Tivoli Identity Manager: Universal Provisioning Agent

9 v v v,.., ( )... v v v v v v vii

10 viii IBM Tivoli Identity Manager: Universal Provisioning Agent

11 1 Universal Provisioning Agent.. Universal Provisioning Agent Tivoli Identity Manager Server.. Tivoli Identity Manager Server Universal Provisioning Agent.,,. v. v Universal Provisioning Agent. v Universal Provisioning Agent Tivoli Identity Manager Server. v Tivoli Identity Manager Server. v Tivoli Identity Manager Server. Universal Provisioning Agent Universal Provisioning Agent Tivoli Identity Manager Server. Tivoli Identity Manager Server Tivoli Identity Manager Server. Tivoli Identity Manager Server, Tivoli Identity Manager Server. agentcfg. agentcfg,. Copyright IBM Corp

12 5 A B C CertTool. CertTool,, IBM Tivoli Identity Manager: Universal Provisioning Agent

13 2 Universal Provisioning Agent... Universal Provisioning Agent.... : Universal Provisioning Agent Tivoli Identity Manager. Universal Provisioning Agent,. Universal Provisioning Agent x86, 128MB 100MB. SP 6 Windows NT Windows 2000 Server. FTP. Universal Provisioning Agent Microsoft Exchange Client Microsoft Outlook Lotus Notes Client v MAPI. Universal Provisioning Agent. :. Microsoft Exchange,. Lotus Notes,. TCP/IP Tivoli Identity Manager Server. Windows NT. Copyright IBM Corp

14 1. ( ) Universal Provisioning Agent. IBM Windows NT Server Tivoli Identity Manager Server.. Universal Provisioning Agent.. Tivoli Identity Manager. Universal Provisioning Agent., Universal Provisioning Agent Windows NT,. 1 : Tivoli Identity Manager Universal Provisioning Agent IBM. IBM. Universal Provisioning Agent. Universal Provisioning Agent C:\Tivoli\Agents\UPAgent. 6 1 :. v Universal Provisioning Agent. UPAgent. v Universal Provisioning Agent. C:\Tivoli\Agents\UPAgent\bin. v Universal Provisioning Agent v Universal Provisioning Agent v Universal Provisioning Agent v : 4 IBM Tivoli Identity Manager: Universal Provisioning Agent

15 v : v. C:\Tivoli\Agents\UPAgent\binRecon_Outbox. v v v v v 2 : Universal Provisioning Agent. 8 2 :. 3 : DAML Tivoli Identity Manager Server. 8 3 :. 4 :. DAML Tivoli Identity Manager Server. 8 4 :. 5 : Tivoli Identity Manager Server. 9 5 :. 6 : Universal Provisioning Agent :. 2 5

16 7 : Tivoli Identity Manager Server :. 1 : Universal Provisioning Agent.. Tivoli Identity Manager Universal Provisioning Agent IBM. IBM.. 1. IBM Universal Provisioning Agent zip. 2. Universal Provisioning Agent zip Setup.exe. : C:\Temp\Setup.exe , IBM Tivoli Identity Manager: Universal Provisioning Agent

17 Lotus Notes Server Microsoft Exchange Server Microsoft Exchange,. Lotus Notes, Notes Client ID :. Tivoli Identity Manager Server Universal 2 7

18 Provisioning Agent,. resource_name. resource_name : Universal Provisioning Agent Windows NT Server.. Universal Provisioning Agent Universal Provisioning Agent. 3 : Universal Provisioning Agent DAML Tivoli Identity Manager Server.. DAML. 17. : DAML : DAML. CA(Certificate Authority) CA. Universal Provisioning Agent , Tivoli Identity Manager Server CA. Tivoli Identity Manager Server Configuration Guide. : DAML.. 8 IBM Tivoli Identity Manager: Universal Provisioning Agent

19 5 : Tivoli Identity Manager Server. Tivoli Identity Manager Server :,. Tivoli Identity Manager.. Tivoli Identity Manager. 6 : DAML.. :. Tivoli Identity Manager Server. Tivoli Identity Manager Server DAML. 3. SRV_NODENAME. 4. Tivoli Identity Manager Server IP Enter.. 5. SRV_PORTNUMBER. 6. Tivoli Identity Manager Server Enter.. 7. SRV_USERNAME. 8. Tivoli Identity Manager Server Enter.. 9. SRV_PASSWORD. 2 9

20 10. Tivoli Identity Manager Server Enter.. 7 : Tivoli Identity Manager Server. Tivoli Identity Manager Policy and Organization Administration Guide. Universal Provisioning Agent,. 10 IBM Tivoli Identity Manager: Universal Provisioning Agent

21 3 Tivoli Identity Manager Server. Universal Provisioning Agent Tivoli Identity Manager Server. Tivoli Identity Manager Server Universal Provisioning Agent... : 1. Tivoli Identity Manager Server,.. 2., Tivoli Identity Manager Server. 3. WebLogic Application Server.,. 4. WebSphere Application Server, Network Deployment Manager.. Tivoli Identity Manager Server Universal Provisioning Agent,. Universal Provisioning Agent. Copyright IBM Corp

22 2. Tivoli Identity Manager Server. Universal Provisioning Agent Tivoli Identity Manager Server root. 1. root Tivoli Identity Manager Server. 2. IBM Universal Provisioning Agent zip zip. : IBM. 3.. v UNIX Tivoli Identity Manager Server :. #cd/tmp, tmp. Universal Provisioning Agent. #./upaprofile_<operating system>.bin, <operating system> aix, solaris hpxxxx.. v Windows Tivoli Identity Manager Server :..., upaprofile.exe.,. C:\temp\upaprofile.exe. 4.. Tivoli Identity Manager. 5. Tivoli Identity Manager Server IBM Tivoli Identity Manager: Universal Provisioning Agent

23 Tivoli Identity Manager Server. : Tivoli Identity Manager Server, ITIM , remote_resources.,. Windows: C:\itim\data\remote_resources\nt40profile\ UNIX: /itim/data/remote_resources/nt40profile/ 3 13

24 14 IBM Tivoli Identity Manager: Universal Provisioning Agent

25 4 agentcfg Universal Provisioning Agent.. Universal Provisioning Agent agentcfg. 1.,. DOS. 2. bin. Universal Provisioning Agent,. cd \Tivoli\Agents\UPAgent\bin 3. agentcfg -agent UPAgent. Enter configuration key for Agent UPAgent : agentcfg. -hostname Universal Provisioning Agent UPAgent Agent Main Configuration Menu A. Configuration Settings. B. Protocol Configuration. C. Event Notification D. Change Configuration Key. E. Activity Logging. F. Registry Settings. G. Advanced Settings. H. Statistics X. Done Select menu option: Copyright IBM Corp

26 . v A, v B, 17 v C, 20 v D, 25 v E, 25 v F, 27 v G, 30 v H, 31 Universal Provisioning Agent. 1. A(Configuration Settings). Universal Provisioning Agent. Universal Provisioning Agent. Configuration Settings Name : UPAgent Version : ADK Version : 4.27 ERM Version : 4.27 enrole Version : 4.0 License : NONE Asynchronous ADD Requests : TRUE (Max.Threads:3) Asynchronous MOD Requests : TRUE (Max.Threads:3) Asynchronous DEL Requests : TRUE (Max.Threads:3) Asynchronous SEA Requests : TRUE (Max.Threads:3) Available Protocols : DAML, FTP Configured Protocols : DAML Logging Enabled : TRUE Logging Directory : C:\Tivoli\Agents\UPAgent\Log Log File Name : UPAgent.log Max. log files : 3 Max.log file size (Mbytes) : 1 Debug Logging Enabled : TRUE Detail Logging Enabled : FALSE Press any key to continue IBM Tivoli Identity Manager: Universal Provisioning Agent

27 DAML FTP Tivoli Identity Manager Server. DAML. DAML. FTP. Universal Provisioning Agent.. 1. B(Protocol Configuration)... DAML Universal Provisioning Agent. Agent Protocol Configuration Menu Available Protocols: DAML, FTP Configured Protocols: DAML A. Add Protocol. B. Remove Protocol. C. Configure Protocol. X. Done Select menu option 2.. v A, v B, v C, 18 X. 1. A(Add Protocol).., B(Remove Protocol). 4 17

28 ., C(Configure Protocol) :. DAML. DAML Protocol Properties A. PORTNUMBER ;Protocol Server port number. B. USERNAME ****** ;Authorized user name. C. PASSWORD ****** ;Authorized user password. D. SRV_NODENAME ;Event Notif. Server name. E. SRV_PORTNUMBER 443 ;Event Notif. Server port number. F. SRV_USERNAME ****** ;Event Notif. user name. G. SRV_PASSWORD ****** ;Event Notif. Server password. H. VALIDATE_CLIENT_CE FALSE ;Require client certificate. X. Done Select menu option: 3.. DAML. 3. DAML A(PORTNUMBER). Modify Property PORTNUMBER :. : 7004 Tivoli Identity Manager Server. 18 IBM Tivoli Identity Manager: Universal Provisioning Agent

29 3. DAML ( ) B(USERNAME). Modify Property USERNAME :. : admin C(PASSWORD) Tivoli Identity Manager Server.. Modify Property PASSWORD :. : ******* D(SRV_NODENAME) Tivoli Identity Manager Server.. Modify Property SRV_NODENAME :. : E(SRV_PORTNUMBER) Tivoli Identity Manager Server IP DNS.. Modify Property SRV_PORTNUMBER : Tivoli Identity Manager Server. : 7004 F(SRV_USERNAME) Tivoli Identity Manager Server.. Modify Property SRV_USERNAME :. : admin G(SRV_PASSWORD) Tivoli Identity Manager Server.. Modify Property SRV_PASSWORD :. : ***** Tivoli Identity Manager Server. 4 19

30 3. DAML ( ) H(VALIDATE_CLIENT_CE). Modify Property VALIDATE_CLIENT_CE : Tivoli Identity Manager Server. Tivoli Identity Manager Server. : CertTool D - H. 4. Enter.. : Enter. Tivoli Identity Manager Server. Tivoli Identity Manager Server Tivoli Identity Manager Server. :.. 1. C(Event Notification).. Event Notification Menu * Reconciliation interval : 1 day(s) * Next Reconciliation time : 23 hour(s) 56 min(s). 23 sec(s). * Configured Contexts : Jupiter, dd309 A. Enabled B. Time interval between reconciliations. C. Set Processing cache size. (currently: 50 Mbytes) D. Start event notification now. E. Set attributes to be reconciled. F. Reconciliation process priority. (current: 1) G. Add Event Notification Context. H. Modify Event Notification Context. I. Remove Event Notification Context. J. List Event Notification Contexts. X. Done Select menu option: IBM Tivoli Identity Manager: Universal Provisioning Agent

31 : A. 4. A, Tivoli Identity Manager Server.. v,. B(Time interval between reconciliations) v,.. Enter new interval ([ww:dd:hh:mm:ss]) [00:01:00:00:00]:. C(Set processing cache size) Enter.. Enter new cache size[5]:. Enter. D(Start event notification. now) E(Set attributes to be reconciled) F(Reconciliation process priority) Enter new thread priority [1-10]:. G(Add Event Notification Context) H(Modify Event Notification Context) Enter.. Context name : Enter

32 4. ( ) I(Remove Event Notification Context) J(List Event Notification Contexts).. Delete context context1? [no]: Enter, Enter.. Context Name : Context1 Target DN : erservicename=context1,o=ibm, ou=ibm,dc=com --- Attributes for search request --- {search attributes listed} B, C, E F Enter.. :.. ( : ). 1. E(Set attributes to be reconciled).. Event Notification Entry Types A. USER B. GROUP X. Done Select menu option: 2. A B.. :. 22 IBM Tivoli Identity Manager: Universal Provisioning Agent

33 Event Notification Attribute Listing (a) ** (b) ** (c) ** (d) ** (e) ** (f) ** (g) ** (h) ** (i) ** (j) ** (k) ** (l) ** (m) ** (o) ** (q) ** (r) ** (s) ** (t) ** (p)rev page 1 of 3 (n)ext X. Done Select menu option: H(Modify Event Notification Context).. Modify Context Menu A. Context1 B. Context2 C. Context3 X. Done Select menu option: 2... A. Set attributes for search B. Target DN: C. Delete Baseline Database X. Done Select menu option: A 24. B 24 DN. C

34 1. A(Set attributes for search).. Reconciliation Attributes Passed to Agent for Context: Context A. Add new attribute B. Modify attribute value C. Remove attribute X. Done Select menu option: 2... DN 1. B(Target DN).. Enter Target DN: 2. DN Enter. DN. erservicename=nameofservice,o=organizationname,ou=tenantname,dc=com DN. erservicename o ou (tenant).,. dc=com DN.. C(Delete Baseline Database). 24 IBM Tivoli Identity Manager: Universal Provisioning Agent

35 . Universal Provisioning Agent.. 1. D(Change Configuration Key). 2. Enter. Enter new configuration key for Agent UPAgent : Enter.. :.. Configuration key successfully changed.. Universal Provisioning Agent., Tivoli Identity Manager UPAgent.log. 1. E(Activity Logging)... Agent Activity Logging Menu A. Activity Logging (Enabled). B. Logging Directory (current: C:\Tivoli\Agents\UPAgent\Log). C. Activity Log File Name (current: UPAgent.log). D. Activity Logging Max. File Size ( 1 mbytes) E. Activity Logging Max. Files ( 3) F. Debug Logging (Enabled). G. Detail Logging (Disabled). H. Base Logging (Disabled). X. Done Select menu option: 2.. : A(Activity Logging). 4 25

36 5. A(Activity Logging), Tivoli Identity Manager.. v,. B(Logging Directory) v,.. : C:\Log,. Enter. C(Activity Log File Name).,. D(Activity Logging Max File Size) Enter. ( : 10).. MB.. E(Activity Logging Max Files) Enter. ( : 100). : 5.. F(Debug Logging) Enter.,.. v,. G(Detail Logging) v,.,. :.,.. v,. v,. 26 IBM Tivoli Identity Manager: Universal Provisioning Agent

37 5. ( ) H(Base Logging), ADK.. v,. v,. 3. B, C, D E Enter.. :. Universal Provisioning Agent. 1. F(Registry Settings).. UPAgent Agent Registry Menu A. Modify Non-encrypted registry settings. B. Modify encrypted registry settings. C. Multi-instance settings. X. Done Select menu option: A(Modifying Non-encrypted Registry Settings)

38 Agent Registry Items Add_Action _Subject Add User Request 02. Agent_Profile Agent X 03. Begin_Batch_Period 0: CheckMail_Delay_interval Delete_Action_ _Subject Delete User Request 06. Delete_Recon_File Y 07. End_Batch_Period 24: ENROLE_VERSION MAIL_DLL WinNT_Mailer.dll 10. Minute_Of_Batch_Delay_Inter Modify_Action_ _Subject Modify User Request 12. Process_Add_In_Batches N 13. Process_All_In_Batches N 14. Process_Delete_In_Batches N 15. Process_Modify_In_Batches N 16. Process_Restore_In_Batches N 17. Process_Suspend_In_Batches N 18. Recon_Path C:\Tivoli\Agents\UPAgent\Recon_Outbox 19. Request_Duration Response_Request N 21. Restore_Action_ _Subject Restore User Request 22. Suspent_Action_ _Subject Suspend User Request Page 1 of 1 A. Add new attribute B. Modify attribute value C. Remove attribute X. Done Select menu option: 2.. v A) Add new attribute v B) Modify attribute value v C) Remove attribute v X) Done 3. Enter. 4. A B Enter B(Modifying Encrypted Registry Settings).. 28 IBM Tivoli Identity Manager: Universal Provisioning Agent

39 Encrypted Registry Items PROFILE_PWD ***** Page 1 of 1 A. Add new attribute B. Modify attribute value. C. Remove attribute. X. Done Select menu option: 2.. v A) Add new attribute v B) Modify attribute value v C) Remove attribute v X) Done 3. Enter. 4. A B Enter... :. 1. C(Multi-instance Settings). Universal Provisioning Agent. UPAgent Agent Instance Class Menu A. Select instance class. X. Done Enter. Universal Provisioning Agent. 4 29

40 Universal Provisioning Agent. v v v v Universal Provisioning Agent. 1. G(Advanced Settings)... UPAgent Advanced Settings Menu A. Single Thread Agent (current:true) B. ADD max. thread count. (current:3) C. MODIFY max. thread count. (current:3) D. DELETE max. thread count. (current:3) E. SEARCH max. thread count. (current:3) F. Allow User EXEC procedures (current:false) G. Archive Request Packets (current:false) H. UTF8 Conversion support (current:true) I. Pass search filter to agent (current:false) J. Thread Priority Level (1-10) (current:4) X. Done Select menu option: 2.. : UTF8 Conversion support FALSE. 6. DAML A(Single Thread Agent) B(ADD max. thread count) C(MODIFY max. thread count) D(DELETE max. thread count) E(SEARCH max. thread count) F(Allow User EXEC procedures) G(Archive Request Packets)..... pre- post-exec.... FTP.. 30 IBM Tivoli Identity Manager: Universal Provisioning Agent

41 6. DAML ( ) H(UTF8 Conversion support). I(Pass search filter to agent). J(Thread Priority Level (1-10)) Enter.. Universal Provisioning Agent. 1. H(Statistics).. UPAgent Agent Request Statistics Date Add Mod Del Ssp Res Rec /15/ X. Done 2. X. agentcfg. 1. Universal Provisioning Agent bin. v X. v agentcfg -help

42 -version ; -hostname < value> ; -findall ; -list ; -agent <value> ; -tail ; -schema ; -portnumber <value>; -netsearch <value> ; -confidencetest ; -setup ; -help ; Show version Target nodename to connect to (Default:Local host IP address) Find all agents on target node List available agents on target node Name of agent Display agent s activity log Display agent s attribute schema Specified agent s TCP/IP port number Lookup agents hosted on specified subnet Confidence test Confidence test setup Display this help screen. 7. -version -hostname <value> agentcfg. -hostname. v -findall v v v -list -tail -agent -findall -list -agent <value> -tail -schema -portnumber <value> -netsearch <value> -confidencetest IP.. -list. -hostname.. Universal Provisioning Agent. -hostname... -hostname. -tail. -agent. -hostname. -agent. TCP/IP -agent. -agent.,,,. Tivoli Identity Manager Server. 32 IBM Tivoli Identity Manager: Universal Provisioning Agent

43 7. ( ) -setup -help. agentcfg. 3. agentcfg. agentcfg. 8. -argument -argument <value> -argument <value> -argument -argument -argument <value> -argument <value> -argument <value> : agentcfg -list IP. Tivoli Identity Manager Server Agent(s) installed on node UPAgent (44970) : agentcfg -agent UPAgent Universal Provisioning Agent agentcfg. : agentcfg -list -hostname IP Universal Provisioning Agent Agent(s) installed on node UPAgent (44970) : agentcfg -agent UPAgent -hostname IP agentcfg. Universal Provisioning Agent. 4 33

44 34 IBM Tivoli Identity Manager: Universal Provisioning Agent

45 5 (CertTool) Tivoli Identity Manager (digital certificate). Tivoli Identity Manager Server SSL(Secure Sockets Layer)., CA(Certificate Authority) CA.. Tivoli Identity Manager. SSL Tivoli Identity Manager Server IBM Tivoli Identity Manager System Configuration Guide Managing Digital Certificates. :,. SSL Tivoli Identity Manager. Tivoli Identity Manager SSL(Secure Sockets Layer). SSL ID. SSL. ( ) ID.. SSL. v SSL. v SSL ID. v ID. Copyright IBM Corp

46 v CA(Certificate Authority) ( ). CA. v, CA. : SSL Tivoli Identity Manager. - SSL WebSphere WebLogic Application Server Tivoli Identity Manager. Tivoli Identity Manager Server ( - ). : v Tivoli Identity Manager Server SSL. v RSA SSL-C Open SSL. Tivoli Identity Manager, Tivoli Identity Manager Server CA. : ITIM IBM Tivoli Identity Manager Server SSL 36 IBM Tivoli Identity Manager: Universal Provisioning Agent

47 Tivoli Identity Manager Tivoli Identity Manager Tivoli Identity Manager Server. Tivoli Identity Manager Server CA. CA. Universal Provisioning Agent CertTool. 1.,. Microsoft Windows DOS. 2. bin. Universal Provisioning Agent,. cd \Tivoli\Agents\UPAgent\bin 3. CertTool -agent UPAgent.. Main menu - Configuring agent: UPAgent A. Generate private key and certificate request B. Install certificate from file C. Install certificate and key from PKCS12 file D. View current installed certificate E. List CA certificates F. Install a CA certificate G. Delete a CA certificate H. List registered certificates I. Register certificate J. Unregister a certificate X. Quit Choice: : CSR(Certificate Signing Request).. A CA(Certificate Authority) CSR(Certificate Signing Request). 5 37

48 B C D. CA A CSR. PKCS12. A B, PKCS12.. SSL : ( ). : SSL Tivoli Identity Manager. CA. CA Tivoli Identity Manager Tivoli Identity Manager Server. E F G CA. CA Tivoli Identity Manager Server. CA CA. CA X.509, 2 PEM. CA. SSL : ( ). : SSL Tivoli Identity Manager. Tivoli Identity Manager Server. SSL Tivoli Identity Manager Server. CA Tivoli Identity Manager Server, Tivoli Identity Manager Server. H. 38 IBM Tivoli Identity Manager: Universal Provisioning Agent

49 I J. Base 64 X.509. ( ).. v A, v B, 41 v C, 41 PKCS12 v D, 41 v E, 42 CA v F, 42 CA v G, 42 CA v H, 43 v I, 43 v J, 43 X. Universal Provisioning Agent. 1. A(Generate a private key and certificate request). Enter values for certificate request (press enter to skip value) Enter. Organization: 3. Enter. Organizational Unit: 4. Enter. Agent Name: 5. Enter Enter. Country: 7. ( ) Enter. 5 39

50 State: : CA(Certificate Authority) Enter. Locality: 9. Y N Enter. Accept these values (y/n)?. 10. PEM Enter. Enter name of file to store PEM cert request (Enter to cancel): 11. Enter.. CA.. Enter values for certificate request (press enter to skip value) Organization: ibm Organizational Unit: engineering Agent Name: ntagent admin@ibm.com Country: US State: California Locality: Irvine Accept these values (y/n)? y Generating key pair and certificate request... Enter name of file to store PEM cert request (Enter to cancel) : request.pem Certificate request written to request.pem. Press Enter to continue. request.pem -----BEGIN CERTIFICATE REQUEST----- MIIB1jCCAT8CAQAwgZUxEjAQBgNVBAoTCWFjY2VzczM2MDEUMBIGA1UECxMLZW5n aw5lzxjpbmcxedaobgnvbamtb250ywdlbnqxjdaibgkqhkig9w0bcqewfw50ywdl bnraywnjzxnzmzywlmnvbtelmakga1uebhmcvvmxezarbgnvbagtcknhbglmb3ju awexdzanbgnvbactbklydmluztcbnzanbgkqhkig9w0baqefaaobjqawgykcgyea mr6acpnwf6hllc72bmukawaxcebtxcocnnth9uc8vumhpbimagjuc4s91hprilg7 UtlbOfy6X3R3kbeR8apRR9uLYrPIvQ1b4NK0whsytij6syCySaFQIB6V7RPBatFr 6XQ9hpsARdkGytZmGTgGTJ1hSS/jA6mbxpgmttz9HPECAwEAAaAAMA0GCSqGSIb3 DQEBAgUAA4GBADxA1cDkvXhgZntHkwT9tCTqUNV9sim8N/U15HgMRh177jVaHJqb N1Er46vQSsOOOk4z2i/XwOmFkNNTXRVl9TLZZ/D+9mGZcDobcO+lbAKlePwyufxK Xqdpu3d433H7xfJJSNYLYBFkrQJesITqKft0Q45gIjywIrbctVUCepL END CERTIFICATE REQUEST IBM Tivoli Identity Manager: Universal Provisioning Agent

51 . CA(Certificate Authority). :, ( ) bin. 1. B(Install certificate from file).. Enter name of certificate file: 2. Enter.. PKCS12 PKCS12(.pfx).. : bin. : C:\Tivoli\Agents\<agentname>\bin 1. C(/ph>(Install certificate and key from PKCS12 file). 2. PKCS12 Enter. Enter name of PKCS12 file: : DamlSrvr.pfx 3. Enter. Enter password:. D(View currently installed certificates). D(View currently installed certificates). 5 41

52 .. The following certificate is currently installed. Subject: c=us,st=california,l=irvine,o=daml,cn=daml Server CA CA. E(List CA certificates). CA.. Subject: o=ibm,ou=samplecacert,cn=testca Valid To: Wed Jul 26 23:59: CA CA. 1. F(Install a CA certificate).. Enter name of certificate file: 2. Enter.. e=admin@ibm.com,c=us,st=california,l=irvine,o=ibm,ou=engineering,cn=eng Install the CA? (Y/N) 3. Y Enter. CA CACerts.pem. CA CA. 1. G(Delete a CA certificate). CA. 0 - e=admin@ibm.com,c=us,st=california,l=irvine,o=ibm,ou=engineering,cn=eng 1 - e=support@ibm.com,c=us,st=california,l=irvine,o=ibm,ou=support,cn=support Enter number of CA certificate to remove: 2. CA Enter. CA CACerts.pem. 42 IBM Tivoli Identity Manager: Universal Provisioning Agent

53 .. H(List registered certificates) e=admin@ibm.com,c=us,st=california,l=irvine,o=ibm,ou=engineering,cn=eng 1 - e=support@ibm.com,c=us,st=california,l=irvine,o=ibm,ou=support,cn=support. 1. I(Register certificate).. Enter name of certificate file: 2. Enter.. e=admin@ibm.com,c=us,st=california,l=irvine,o=ibm,ou=engineering,cn=eng Register this CA? (Y/N) 3. Y Enter J(Unregister a certificate) e=admin@ibm.com,c=us,st=california,l=irvine,o=ibm,ou=engineering,cn=eng 1 - e=support@ibm.com,c=us,st=california,l=irvine,o=ibm,ou=support,cn=support 2. Enter.. 3. Y Enter

54 44 IBM Tivoli Identity Manager: Universal Provisioning Agent

55 A. Universal Provisioning Agent Tivoli Identity Manager. Tivoli Identity Manager Tivoli Identity Manager Server. 9. Tivoli Identity Manager Server Universal Provisioning Agent. Tivoli Identity Manager Server Universal Provisioning Agent. Universal Provisioning Agent.. Directory Server _addr_list erupa addrlist,. _group_list erupa grouplist,. recon_filename erupareconfilename resource_name eruparesourcename Universal Provisioning Agent.. Directory Server attribute1 erupaattribute1 1 attribute2 erupaattribute2 2 comment erupacomment dayofbirth erupadayofbirth description description address erupa address faxnbr erupafaxnbr firstname erupafirstname fullname erupafullname group erupagroup Copyright IBM Corp

56 Directory Server grouptype erupagrouptype homedir erupahomedir jobtitle erupajobtitle lastname erupalastname maritalstatus erupamaritalstatus organization erupaorganization othercomment erupaothercomment phonenbr erupaphonenbr placeofbirth erupaplaceofbirth postaladdress erupapostaladdress ssnbr erupassnbr userdn erupauserdn DN Universal Provisioning Agent Universal Provisioning Agent. Universal Provisioning Agent. _addr_list _group_list _addr_list _group_list resource_name _addr_list _group_list resource_name 46 IBM Tivoli Identity Manager: Universal Provisioning Agent

57 Active Directory _addr_list _group_list resource_name _addr_list _group_list resource_name _addr_list _group_list resource_name Tivoli Identity Manager.. (*). 15. A. 47

58 48 IBM Tivoli Identity Manager: Universal Provisioning Agent

59 B..,.... setupconsole.exe. setupconsole.exe Java setup.exe... <agent or profile install>.exe -is:javaconsole -console GUI. Telnet.. -is:javaconsole -console GUI. <agent or profile install>.exe -options-record <filename>. <agent or profile install>.exe -options-template <filename>.. Copyright IBM Corp

60 <agent or profile install>.exe -options-silent <filename>. Universal Provisioning Agent.., Universal Provisioning Agent. Universal Provisioning Agent. 1. Universal Provisioning Agent. 2. Windows uninstaller.exe Universal Provisioning Agent. 4.. Universal Provisioning Agent. 5.. : Universal Provisioning Agent,. Universal Provisioning Agent. 50 IBM Tivoli Identity Manager: Universal Provisioning Agent

61 C.. IBM,. IBM. IBM, IBM,. IBM,,. IBM,. IBM ,.. : (DBCS) IBM. IBM World Trade Asia Corporation Licensing 2-31 Roppongi 3-chome, Minato-ku Tokyo , Japan. IBM, (, ).,..,. IBM / /. Copyright IBM Corp

62 IBM,. IBM. IBM. (1) ( ) (2) ,.. (, ). IBM IBM, IBM (IPLA)....,.. IBM,. IBM, IBM,. IBM. IBM Corporation. AIX DB2 IBM 52 IBM Tivoli Identity Manager: Universal Provisioning Agent

63 IBM SecureWay Tivoli Tivoli Universal Database WebSphere Lotus IBM Corporation / Lotus Development Corporation. Domino IBM Corporation Lotus Development Corporation. Microsoft, Windows, Windows NT Windows Microsoft Corporation. Java Java Sun Microsystems, Inc.. UNIX Open Group.,. C. 53

64 54 IBM Tivoli Identity Manager: Universal Provisioning Agent

65 4 16 agentcfg 15 agentcfg 16 15, agentcfg 25 vii i agentcfg / , agentcfg 26 /, agentcfg 26, agentcfg 27 / / 26 / , 25 ( ) 31, agentcfg 25, 26 / 18 vii vi, Universal Provisioning Agent , 12, 30 vi 4, , Tivoli Identity Manager Server agentcfg / Copyright IBM Corp

66 ( ) agentcfg Universal Provisioning Agent agentcfg 3 / ( ) ( ) 22 DN agentcfg 20, CertTool request.pem CertTool CA CertTool agentcfg 18 agentcfg 18 agentcfg 17 agentcfg IBM Tivoli Identity Manager: Universal Provisioning Agent

67 25 A agentcfg , 31 agentcfg -agent 31 -confidencetest 31 -findall 31 -help 31 -hostname 31 -list 31 -netsearch 31 -portnumber 31 -schema 31 -setup 31 -tail 31 -version 31 -help 31 C CertTool, , 41 CertTool ( ) CA D DAML 18, agentcfg password 19 srv_nodename 19 srv_password 19 srv_portnumber 19 srv_username 19 username 19 validate_client_ce 20 P password agentcfg 19 portnumber S srv_nodename, agentcfg 19 srv_password, agentcfg 19 srv_portnumber, agentcfg 19 srv_username, agentcfg 19 57

68 T Tivoli Identity Manager 37 U username, agentcfg 19 UTF8 30 V validate_client_ce, agentcfg IBM Tivoli Identity Manager: Universal Provisioning Agent

69

70 Printed in Denmark by IBM Danmark A/S SA