Exchange 2000 Agent Installation Guide

Transcription

1 IBM Tivoli Identity Manager Exchange 2000 Agent Installation Guide Version SC

2

3 IBM Tivoli Identity Manager Exchange 2000 Agent Installation Guide Version SC

4 Note: Before using this information and the product it supports, read the information in Appendix C, Notices, on page 43. First Edition (August 2003) This edition applies to version of this agent and to all subsequent releases and modifications until otherwise indicated in new editions. Copyright International Business Machines Corporation All rights reserved. US Government Users Restricted Rights Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

5 Contents Preface v Who should read this book v Publications v Tivoli Identity Manager Agent library..... v Related publications v Accessing publications online vi Accessibility vi Contacting software support vi Conventions used in this book vi Chapter 1. Overview Basic Installation Chapter Descriptions Chapter 2. Agent Installation Requirements Information Worksheet Step 1: Installing the Agent Step 2: Activating the Agent as a Service Step 3: Configuring the Agent Step 4: Installing the Agent s Certificate Step 5: Installing the Agent s Profile Step 6: Configuring the Agent for Event Notification Step 7: Configuring the Agent s Forms Step 1: Installing the Agent Step 2: Activating the Agent as a Service Step 3: Configuring the Agent Step 4: Installing the Agent s Certificate Step 5: Installing the Agent s Profile Step 6: Configuring the Agent for Event Notification 6 Step 7: Configuring the Agent s Forms Chapter 3. Agent Profile Installation... 9 Requirements Installing the Agent Profile Verifying the Agent Profile is Installed Chapter 4. Agent Parameters Modification Accessing the Agent Configuration Tool Main Menu 13 Viewing Configuration Settings Changing Protocol Configuration Settings Adding a Protocol Removing a Protocol Configuring a Protocol Setting Event Notification Setting Attributes to be Reconciled Modifying an Event Notification Context Changing the Configuration Key Changing Activity Logging Settings Changing Registry Settings Modifying Non-encrypted Registry Settings.. 24 Multi-instance Settings Changing Advanced Settings Viewing Statistics Accessing Help and Additional Options Chapter 5. Certificate Installation Overview of SSL and Digital Certificates Basic Configuration for Server-to-Agent SSL.. 30 Clustered Tivoli Identity Manager Configuration 30 Accessing the Certificate Configuration Tool Main Menu Generating a Private Key and Certificate Request.. 32 Example of Certificate Request Script Example of request.pem File Installing the Certificate from a File Installing the Certificate and Key from a PKCS12 File Viewing Installed Certificates Viewing CA Certificates Installing a CA Certificate Deleting a CA Certificate Viewing Registered Certificates Registering a Certificate Unregistering a Certificate Appendix A. Agent Variables Variable Descriptions Variables by Exchange 2000 Agent Actions Login Add Login Change Login Delete Login Suspend Login Restore Ping Reconciliation Appendix B. Additional Installation Options Installation Options Batch File Option Console Option Setup Arguments Agent Removal Appendix C. Notices Trademarks Index Copyright IBM Corp iii

6 iv IBM Tivoli Identity Manager: Exchange 2000 Agent Installation Guide

7 Preface Who should read this book Publications The Tivoli Identity Manager Exchange 2000 Agent (Exchange 2000 Agent) enables connectivity between the IBM Tivoli Identity Manager Server and a network of workstations running the Exchange 2000 Server. After the agent is installed and prepared, Tivoli Identity Manager manages access to Exchange 2000 Server resources with your site s security system. This manual describes how to install and prepare an Exchange 2000 Agent. This manual is intended for security administrators responsible for installing software on their site s computer systems. Readers are expected to understand security administration concepts. The person completing the installation procedure should also be familiar with their site s system standards. Readers should be able to perform routine security administration tasks. Read the descriptions of the Tivoli Identity Manager library, and the related publications to determine which publications you might find helpful. After you determine the publications you need, refer to the instructions for accessing publications online. Tivoli Identity Manager Agent library The publications in the Tivoli Identity Manager Agent library are: v Online user assistance for Tivoli Identity Manager Provides integrated online help topics for all Tivoli Identity Manager administrative tasks. v Tivoli Identity Manager Policy and Organization Administration Guide Provides topics for Tivoli Identity Manager administrative tasks. v Tivoli Identity Manager Server Configuration Guide Provides configuration information for single-server and cluster Tivoli Identity Manager configurations. Related publications Information related to Tivoli Identity Manager is available in the following publications: v v The Tivoli Software Library provides a variety of Tivoli publications such as white papers, datasheets, demonstrations, redbooks, and announcement letters. The Tivoli Software Library is available on the Web at: The Tivoli Software Glossary includes definitions for many of the technical terms related to Tivoli software. The Tivoli Software Glossary is available, in English only from the Glossary link on the left side of the Tivoli Software Library Web page: Copyright IBM Corp v

8 Accessibility Accessing publications online The IBM publications for this product are available online in Portable Document Format (PDF) or Hypertext Markup Language (HTML) format, or both at the Tivoli Software Library: Contacting software support To locate product publications in the library, click the Product manuals link on the left side of the Library page. Then, locate and click the name of the product on the Tivoli Software Information Center page. Product publications include release notes, installation guides, user s guides, administrator s guides, and developer s references. Note: To ensure proper printing of PDF publications, select the Fit to page check box in the Adobe Acrobat Print window (which is available when you click File Print). The product documentation includes the following features to aid accessibility: v Documentation is available in both HTML and convertible PDF formats to give the maximum opportunity for users to apply screen-reader software. v All images in the documentation are provided with alternative text so that users with vision impairments can understand the contents of the images. Before contacting IBM Tivoli Software support with a problem, refer to the IBM Tivoli Software support Web site at: If you need additional help, contact software support using the methods described in the IBM Software Support Guide at the following Web site: This guide provides the following information: v Registration and eligibility requirements for receiving support v Telephone numbers and addresses, depending on the country in which you are located v A list of information you should gather before contacting customer support Conventions used in this book This reference uses several conventions for special terms and actions and for operating system-dependent commands and paths. The following typeface conventions are used in this book: Bold Bold text indicates selectable window buttons, field entries, and commands appearing in this manual except from within examples or the contents of files. vi IBM Tivoli Identity Manager: Exchange 2000 Agent Installation Guide

9 Monospace italic Text in monospace type indicates the contents of files or the output from commands. Italic text indicates context-specific values such as: v path names v file names v user names v group names v system parameters v environment variables Preface vii

10 viii IBM Tivoli Identity Manager: Exchange 2000 Agent Installation Guide

11 Chapter 1. Overview Basic Installation Chapter Descriptions This installation guide provides all of the basic information necessary to install and configure the Exchange 2000 Agent components. This chapter provides a simple overview of the installation process and a brief overview of the information in each chapter. The following lists the basic procedures necessary to install, configure, and run the agent: v Install the agent software. v Activate the Exchange 2000 Agent as a service on the agent s system. v Configure the agent s communication protocols to enable the Exchange 2000 Agent to communicate with the Tivoli Identity Manager Server. v Install the agent s profile on the Tivoli Identity Manager Server. v Configure the Tivoli Identity Manager Server to recognize the agent as a service. The Exchange 2000 Agent Installation Guide contains information pertinent to the proper installation and configuration of the Exchange 2000 Agent in the following chapters and appendices: Chapter 1, Overview Chapter 2, Agent Installation Chapter 3, Agent Profile Installation Chapter 4, Agent Parameters Modification Chapter 5, Certificate Installation Appendix A, Agent Variables Appendix B, Additional Installation Options Appendix C, Notices Provides an overview of this document and the basic procedures necessary to install and configure this agent. Contains detailed information about installing the agent. This chapter also contains additional steps required to configure the agent properly. Contains detailed information about installing the agent s profile on the Tivoli Identity Manager Server. Installing the agent s profile on the Tivoli Identity Manager Server allows the Tivoli Identity Manager Server to recognize the agent. If the agent profile is not installed on the Tivoli Identity Manager Server, the Tivoli Identity Manager Server will not be able to manage access to the Exchange 2000 Server. Contains information about using the agentcfg tool. The agentcfg tool provides an easy way to configure various properties specific to the agent, such as communication protocols, logging settings, and so on. Contains information about using the CertTool tool. The CertTool tool provides an easy way to request, install, and register certificates for use with the agent. Contains information about the agent variables. Contains additional installation options information and information about uninstalling the agent. Contains legal notices for this agent. Copyright IBM Corp

12 2 IBM Tivoli Identity Manager: Exchange 2000 Agent Installation Guide

13 Chapter 2. Agent Installation This chapter describes the procedure to install and configure the Exchange 2000 Agent software. Each step includes a short procedure that completes one aspect of the overall agent installation process. You must complete the steps in the order they are listed. Requirements The following table identifies hardware, software, and authorization requirements to install the Exchange 2000 Agent. Verify that all of the requirements have been met before installation. Table 1. Requirements to install the agent System The agent must be installed on a server with at minimum a 266 MHz Pentium CPU, at least 512 MB of memory, and at least 2 GB of free disk space. NNTP (Network News Transport Protocol) Services located from the Microsoft Windows Components Wizard under Internet Information Services must also be installed. The system must be installed and operational in the Windows 2000 Advanced Server domain. Operating System Exchange Server Network Connectivity System Administrator Authority Server Communication Important: Active Directory Services must be running in the same domain. Windows 2000 with Service Pack 3 or higher must be installed and operational on the system where the agent will be installed. The system must also be in a Windows 2000 Advanced Server domain. Microsoft Exchange 2000 System Management Tools must be installed and operational on the system where the agent is installed. The system must also be in a Windows 2000 Advanced Server domain. The agent must be installed on a system that can communicate with the Tivoli Identity Manager Server through a TCP/IP network. For security purposes, IBM recommends installing the agent on a Windows NT file system (NTFS). The person completing the Exchange 2000 Agent installation procedure must have system administrator authority to complete the steps in this chapter. Communication between the Tivoli Identity Manager Application Server and the Exchange 2000 Server should be tested with a low-level communications ping before installing any IBM software. This makes troubleshooting easier if you encounter installation problems. Copyright IBM Corp

14 Information Worksheet Use the following worksheet to document information required to install and configure the Exchange 2000 Agent. Complete this worksheet before starting the installation procedure. The worksheet includes default values used by the agent and identifies the information you need to modify during installation. Make a copy of the worksheet for each server where you are installing the Exchange 2000 Agent. For example, if you have five Exchange 2000 Servers where you are installing the agent, you need five copies of the worksheet. Step 1: Installing the Agent The Tivoli Identity Manager Exchange 2000 Agent installation files are available for download from IBM s Web site. Contact your IBM account representative for the Web address and download instructions. Install the Exchange 2000 Agent using the provided executable installation program. The Exchange 2000 Agent destination directory default is the C:\Tivoli\Agents\E2KAgent directory. For more information, see Step 1: Installing the Agent. Step 2: Activating the Agent as a Service Start the Exchange 2000 Agent as a service and configure it to start automatically. For more information, see Step 2: Activating the Agent as a Service on page 6. Step 3: Configuring the Agent Configure the agent s communication protocol to use the DAML protocol to communicate with the Tivoli Identity Manager Server. For more information, see Step 3: Configuring the Agent on page 6. Step 4: Installing the Agent s Certificate Install the agent s certificate. This certificate is used by the DAML protocol during communication with the Tivoli Identity Manager Server. For more information, see Step 4: Installing the Agent s Certificate on page 6. Step 5: Installing the Agent s Profile Install the agent s profile on the Tivoli Identity Manager Server. For more information, see Step 5: Installing the Agent s Profile on page 6. Step 6: Configuring the Agent for Event Notification Configure the Exchange 2000 Agent for event notification. This step is optional. For more information, see Step 6: Configuring the Agent for Event Notification on page 6. Step 7: Configuring the Agent s Forms Configure the agent s forms on the Tivoli Identity Manager Server. For more information, see Step 7: Configuring the Agent s Forms on page 7. Step 1: Installing the Agent An executable installation program is provided for the Exchange 2000 Agent. Use this executable program to install the Exchange 2000 Agent. 4 IBM Tivoli Identity Manager: Exchange 2000 Agent Installation Guide

15 The Tivoli Identity Manager Exchange 2000 Agent installation files are available for download from IBM s Web site. Contact your IBM account representative for the Web address and download instructions. To install the agent, do the following: 1. Download the Exchange 2000 Agent installation zip file from IBM s Web site. 2. Extract the contents of the Exchange 2000 Agent installation zip file into a temporary directory. 3. Select Run... from the Start menu and type the path to the temporary directory followed by Setup.exe. For example: C:\Temp\Setup.exe The Welcome dialog window appears. 4. Click Next. The License Agreement window opens. 5. Read the license agreement and decide whether to accept its terms. If you do, click Accept. 6. Click Next. The Select Destination Directory dialog window appears. Installer Click Next to install < agentname> to this directory, or click Browse to install to a different directory. Directory Name: C:\tivoli\agents\< agentname> Browse... InstallShield < Back Next > Cancel Figure 1. Select Destination Directory dialog window 7. Accept the default or select an alternate destination path and click Next. The Install Summary dialog window appears. 8. Click Next. The agent components are installed and the Installation Completed dialog window appears. 9. Click Finish. Chapter 2. Agent Installation 5

16 Step 2: Activating the Agent as a Service The Exchange 2000 Agent is installed on the Windows 2000 Server and automatically starts whenever the server is rebooted. However, the service is not active after installation. Select the Exchange 2000 Agent service to start the Exchange 2000 Agent software on the target platform. Step 3: Configuring the Agent The Exchange 2000 Agent uses the DAML protocol to ensure secure communication with the Tivoli Identity Manager Server. Default protocol values are provided. However, you must configure the DAML protocol for your site s systems. See Changing Protocol Configuration Settings on page 14 for more information. Note: A certificate must be installed for the DAML protocol. Refer to Chapter 5, Certificate Installation, on page 29 for more information about installing certificates. Step 4: Installing the Agent s Certificate A certificate must also be installed for the DAML protocol. You must obtain a production certificate from a well-known Certificate Authority or create your own certificate using your own Certificate Authority. The Exchange 2000 Agent does not come prepackaged with a certificate. See Chapter 5, Certificate Installation, on page 29 for more information about installing certificates. When you install the new certificate, you will also need to install the new Certificate Authority on the Tivoli Identity Manager Server. See Tivoli Identity Manager Server Configuration Guide for more information. Note: You must configure the DAML protocol before installing your certificate. Stop and restart the agent after the certificate is installed. Step 5: Installing the Agent s Profile Before an agent can be added as a service to the Tivoli Identity Manager Application Server, the server must have a service profile to recognize the agent as a service. See Chapter 3, Agent Profile Installation, on page 9 for more information on installing the agent s profile on the Tivoli Identity Manager Server. Note: If this is an upgrade of an existing agent, the new agent schema will not be reflected immediately. The Tivoli Identity Manager System stores the agent schema in memory. However, this cache is periodically refreshed and the new agent schema will be reflected after the cache is refreshed. Re-boot the Tivoli Identity Manager System to refresh the agent schema immediately. Step 6: Configuring the Agent for Event Notification You can choose to configure event notification for agents configured to use the DAML protocol. Complete this step only if you want to monitor agent attributes for changes that will trigger event notifications. Note: This step is optional. The agent can accept requests from the Tivoli Identity Manager Server whether you configure event notification or not. 6 IBM Tivoli Identity Manager: Exchange 2000 Agent Installation Guide

17 To do this, identify the Tivoli Identity Manager Server. 1. Select Configure Protocol from the Agent Protocol Configuration Menu. For more information, see Changing Protocol Configuration Settings on page Select DAML as the protocol to configure. 3. Select SRV_NODENAME. 4. Specify the IP address or fully-qualified hostname that identifies the Tivoli Identity Manager Server and press Enter. The Protocol Properties menu reappears and displays your new settings. 5. Select SRV_PORTNUMBER. 6. Specify the port number the Tivoli Identity Manager Server uses to connect to the agent and press Enter. The Protocol Properties menu reappears and displays your new settings. 7. Select SRV_USERNAME. 8. Specify the username the Tivoli Identity Manager Server uses to connect to the agent and press Enter. The Protocol Properties menu reappears and displays your new settings. 9. Select SRV_PASSWORD 10. Specify the password for the username the Tivoli Identity Manager Server uses to connect to the agent and press Enter. The Protocol Properties menu reappears and displays your new settings. Step 7: Configuring the Agent s Forms Configure the agent s service maintenance and account maintenance forms on the Tivoli Identity Manager Server. Refer to the Tivoli Identity Manager Policy and Organization Administration Guide for more information. The Exchange 2000 Agent s Base Point is the point in the Directory Server that is used as the root for the agent. This point can be an OU or DC point. The Base Point is an optional value. If it is left blank, the agent will use the default domain of the machine on which it is installed. Note: The Base Point must match the Base Point defined for the Exchange 2000 Agent. The following is an example of a base point defined from the root of the Directory Server: dc=irvine,dc=ibm,dc=com The following is an example of a base point defined from an organizational unit level: o=engineering,dc=irvine,dc=ibm,dc=com The Admin User Account and Admin User Password are optional values that are only required if 1) an administrator account is defined for the agent s base point and 2) you want to use this account for logging purposes. If these values are not defined, the agent will use the account assigned to the agent service. Note: Do not create service instances that overlap in scope in the directory tree. Service instances that contain other service instances of the same type will return duplicate accounts during reconciliations. Chapter 2. Agent Installation 7

18 8 IBM Tivoli Identity Manager: Exchange 2000 Agent Installation Guide

19 Chapter 3. Agent Profile Installation Requirements Before an agent can be added as a service to the Tivoli Identity Manager Server, the server must have a service profile to recognize the agent as a service. The Exchange 2000 Agent comes with a second installation script that installs the agent s profile on the Tivoli Identity Manager Server as a service profile. This chapter describes the procedure to install and configure the Exchange 2000 Agent profile on the Tivoli Identity Manager Server. Each step includes a short procedure that completes one aspect of the overall profile installation process. You must complete the steps in the order they are listed. Notes: 1. If you intend to install multiple agent profiles on the Tivoli Identity Manager Server, it is important that you install them one at a time. You must wait for a single profile installation to complete before starting the next profile installation. 2. If you are upgrading the agent software, you must also upgrade the agent profile on the Tivoli Identity Manager Server. 3. In a WebLogic Application Server cluster, the agent profile must be installed on every managed server. If the agent profile is not installed on every member of the cluster, the managed server that did not have the agent profile installed will not recognize the agent as a service if the other managed servers become unavailable. 4. In a WebSphere Application Server cluster, you should install the agent profile on the computer on which Network Deployment Manager is installed, although the agent profile can be installed on any server in the cluster. The profile information is pushed into the directory and becomes available to all cluster members. The following table identifies hardware, software, and authorization requirements to install the Exchange 2000 Agent profile on the Tivoli Identity Manager Server. Verify that all the requirements have been met before installing the Exchange 2000 Agent profile. Table 2. Requirements before installing an agent profile Server System Administrator Authority The Tivoli Identity Manager Server must be installed and running before the agent s profile can be installed. The person completing the Exchange 2000 Agent profile installation must have root access to the Tivoli Identity Manager Server to complete the procedures in this chapter. Installing the Agent Profile 1. Log in to the Tivoli Identity Manager Server as root. 2. Download the Exchange 2000 Agent installation zip file from IBM s Web site and extract the contents of the zip file into a temporary directory. Copyright IBM Corp

20 Note: Contact your IBM account representative for the Web address and download instructions for agent installation files. 3. Complete one of the following: v For a Tivoli Identity Manager Server installed on a UNIX platform: Change the working directory to the temporary directory where you extracted the agent installation files. #cd/tmp where tmp is the path of the directory containing the agent installation files. Run the Exchange 2000 Agent profile installation script that is appropriate for your operating system. #./e2kprofile_<operating system>.bin where <operating system> is the name of your operating system, such as aix, solaris, or hpxxxx. v A graphical user interface appears. For Tivoli Identity Manager Servers installed on Windows: Select Run... from the Start menu, type the path to the temporary directory where you extracted the agent installation followed by e2kprofile.exe. For example: C:\temp\e2kprofile.exe The Welcome dialog window appears. 4. Click Next. The Select Tivoli Identity Manager Home Directory screen appears. 5. Type the Tivoli Identity Manager Server home directory in the text field and click Next. You can also select the directory by clicking Browse... and browsing to the correct directory. You must install the agent profile in the same home directory in which the Tivoli Identity Manager Server is installed. Note: If the installation program cannot determine whether the Tivoli Identity Manager Server home directory that you entered is correct, the ITIM Not Found dialog window is displayed. The Install Summary dialog window appears. 6. Click Next. The Installation Progress dialog window appears. Upon successful installation, the Applying Schema Updates window appears, and any schema updates will be applied. The Install Complete dialog window appears after installation is complete. 7. Click Finish to conclude the installation process. Verifying the Agent Profile is Installed To ensure that the agent profile installed correctly, navigate to the directory where agent profile files are installed. If the agent profile installation was successful, an agent profile directory will be created in the remote_resources folder. Examples are provided below: 10 IBM Tivoli Identity Manager: Exchange 2000 Agent Installation Guide

21 For Windows: C:\itim\data\remote_resources\nt40profile\ For UNIX: /itim/data/remote_resources/nt40profile/ Chapter 3. Agent Profile Installation 11

22 12 IBM Tivoli Identity Manager: Exchange 2000 Agent Installation Guide

23 Chapter 4. Agent Parameters Modification This chapter describes how to use agentcfg, the provided agent configuration program, to view or modify Exchange 2000 Agent parameters. All modifications made to settings with this tool take effect immediately. Accessing the Agent Configuration Tool Main Menu The following procedure describes how to access the main menu of the agentcfg tool for Exchange 2000 Agent parameters. 1. Select Programs from the Start menu, select Accessories, and then select Command Prompt. The DOS Command Prompt window appears. 2. Change to the agent s bin directory. Type the following, if the Exchange 2000 Agent directory is in the default location: cd \Tivoli\Agents\E2KAgent\bin 3. Type agentcfg -agent E2KAgent at the prompt. Enter configuration key for Agent E2KAgent : You can also use agentcfg to view or change configuration settings from a remote computer. See the table in Accessing Help and Additional Options on page 26 for procedures on using the -hostname argument. 4. Type the configuration key for the Exchange 2000 Agent. The default configuration key is agent. See Changing Protocol Configuration Settings on page 14 for procedures to change the configuration key. The Main Configuration menu appears. E2KAgent Agent Main Configuration Menu A. Configuration Settings. B. Protocol Configuration. C. Event Notification D. Change Configuration Key. E. Activity Logging. F. Registry Settings. G. Advanced Settings. H. Statistics X. Done Select menu option: This chapter includes a section for each of the following main functions: v For option A, see Viewing Configuration Settings on page 14 v For option B, see Changing Protocol Configuration Settings on page 14 v For option C, see Setting Event Notification on page 17 v For option D, see Changing the Configuration Key on page 21 v For option E, see Changing Activity Logging Settings on page 22 v For option F, see Changing Registry Settings on page 24 v For option G, see Changing Advanced Settings on page 25 Copyright IBM Corp

24 v For option H, see Viewing Statistics on page 26 Viewing Configuration Settings The following procedure describes how to view the Exchange 2000 Agent configuration settings. 1. Type option A (Configuration Settings) at the main menu prompt. The configuration settings for the Exchange 2000 Agent appear. The following is a sample of the Exchange 2000 Agent configuration settings. Configuration Settings Name : E2KAgent Version : ADK Version : 4.27 ERM Version : 4.27 enrole Version : 4.0 License : NONE Asynchronous ADD Requests : TRUE (Max.Threads:3) Asynchronous MOD Requests : TRUE (Max.Threads:3) Asynchronous DEL Requests : TRUE (Max.Threads:3) Asynchronous SEA Requests : TRUE (Max.Threads:3) Available Protocols : DAML, FTP Configured Protocols : DAML Logging Enabled : TRUE Logging Directory : C:\Tivoli\Agents\E2KAgent\Log Log File Name : E2KAgent.log Max. log files : 3 Max.log file size (Mbytes) : 1 Debug Logging Enabled : TRUE Detail Logging Enabled : FALSE Press any key to continue 2. Press any key to return to the main menu. Changing Protocol Configuration Settings The agent can communicate with the Tivoli Identity Manager Server using DAML or FTP. By default, agents are configured to use DAML as the communication protocol. Procedures provided in this section contain instructions for modifying DAML protocol configuration settings. Configuring the agent to use FTP requires additional configuration not provided in this section. The following procedure describes how to change the Exchange 2000 Agent protocol configuration settings. This section also describes the purpose of the provided functions. 1. Type B (Protocol Configuration) at the main menu prompt. The Protocol Configuration menu appears. The configured and available protocols for your server display above the menu options. The DAML protocol is configured and available by default for the Exchange 2000 Agent. 14 IBM Tivoli Identity Manager: Exchange 2000 Agent Installation Guide

25 Agent Protocol Configuration Menu Available Protocols: DAML, FTP Configured Protocols: DAML A. Add Protocol. B. Remove Protocol. C. Configure Protocol. X. Done Select menu option 2. See the following procedure that corresponds with the option that you want to select: v For option A, see Adding a Protocol v For option B, see Removing a Protocol v For option C, see Configuring a Protocol Type X to return to the main menu. Adding a Protocol 1. Type A (Add Protocol) at the Protocol Configuration menu prompt. The Add New Protocol menu appears and displays protocols that are available on your server. If there are no protocols to add, the Protocol Configuration menu reappears. 2. Type the menu option letter of the protocol that you want to add. The Protocol Configuration menu reappears. The protocol that you added appears as a Configured Protocol. See the procedure for Configuring a Protocol to modify the default configuration settings for the protocol that you added. Removing a Protocol 1. Type B (Remove Protocol) at the Protocol Configuration menu prompt. The Remove Protocol menu appears and displays all protocols that have been added. If there are no protocols to remove, the Protocol Configuration menu reappears. 2. Type the menu option letter of the protocol that you want to remove. The Protocol Configuration menu reappears and the protocol that you removed is no longer listed as a configured protocol. However, the protocol remains as an available protocol that can be added again. Configuring a Protocol 1. Type C (Configure Protocol) at the Protocol Configuration menu prompt. The Configure Protocol menu appears. 2. Type the menu option letter of the protocol that you want to configure. The Protocol Properties menu for the configured protocol appears with protocol properties. Note: The properties on your menu may be different from the ones shown. The following is an example of the DAML protocol properties: Chapter 4. Agent Parameters Modification 15

26 DAML Protocol Properties A. PORTNUMBER ;Protocol Server port number. B. USERNAME ****** ;Authorized user name. C. PASSWORD ****** ;Authorized user password. D. SRV_NODENAME ;Event Notif. Server name. E. SRV_PORTNUMBER 443 ;Event Notif. Server port number. F. SRV_USERNAME ****** ;Event Notif. user name. G. SRV_PASSWORD ****** ;Event Notif. Server password. H. VALIDATE_CLIENT_CE FALSE ;Require client certificate. X. Done Select menu option: 3. Type the menu option letter of the protocol property that you want to configure. See the table below for additional information about the menu options for the DAML protocol. Table 3. Menu options for the DAML protocol Type this Option A (PORTNUMBER) To Accomplish this The following prompt appears: Modify Property PORTNUMBER : Type a different port number, for example, 7004 This is the port number the Tivoli Identity Manager Server uses to connect to the agent. B (USERNAME) The following prompt appears: Modify Property USERNAME : Type a username, for example, admin This is the username the Tivoli Identity Manager Server uses to connect to the agent. C (PASSWORD) The following prompt appears: Modify Property PASSWORD : Type a password, for example, ******* This is the password for the username the Tivoli Identity Manager Server uses to connect to the agent. D (SRV_NODENAME) The following prompt appears: Modify Property SRV_NODENAME : Type a server name, for example, This is the DNS name or IP address of the Tivoli Identity Manager Server. E (SRV_PORTNUMBER) The following prompt appears: Modify Property SRV_PORTNUMBER : Type a different port number to access the Tivoli Identity Manager Server, for example, 7004 This is the port number the agent uses to connect to the Tivoli Identity Manager Server. 16 IBM Tivoli Identity Manager: Exchange 2000 Agent Installation Guide

27 Table 3. Menu options for the DAML protocol (continued) Type this Option F (SRV_USERNAME) To Accomplish this The following prompt appears: Modify Property SRV_USERNAME : Type a different username, for example, admin This is the username the agent uses to connect to the Tivoli Identity Manager Server. G (SRV_PASSWORD) The following prompt appears: Modify Property SRV_PASSWORD : Type a different password, for example, ***** This is the password for the username the agent uses to connect to the Tivoli Identity Manager Server. H (VALIDATE_CLIENT_CE) The following prompt appears: Modify Property VALIDATE_CLIENT_CE : Type TRUE to require the Tivoli Identity Manager Server to send a certificate when communicating with the agent. Type FALSE to allow the Tivoli Identity Manager Server to communicate with the agent without a certificate. Note: You must configure options D through H of the CertTool if you set this option to TRUE. Setting Event Notification 4. Change the value and press Enter. The Protocol Properties menu reappears and displays your new settings. Note: Press Enter to return to the Protocol Properties menu without modifying the selected value. The following procedure describes how to set Event Notification for the Tivoli Identity Manager Server. Event Notification updates the Tivoli Identity Manager Server with changes to the Tivoli Identity Manager Server at set intervals. Note: The example menu shows all the options displayed when Event Notification is enabled. If Event Notification is disabled, not all of the options are displayed. 1. Type C (Event Notification) at the main menu prompt. The Event Notification Menu appears. Chapter 4. Agent Parameters Modification 17

28 Event Notification Menu * Reconciliation interval : 1 day(s) * Next Reconciliation time : 23 hour(s) 56 min(s). 23 sec(s). * Configured Contexts : Jupiter, dd309 A. Enabled B. Time interval between reconciliations. C. Set Processing cache size. (currently: 50 Mbytes) D. Start event notification now. E. Set attributes to be reconciled. F. Reconciliation process priority. (current: 1) G. Add Event Notification Context. H. Modify Event Notification Context. I. Remove Event Notification Context. J. List Event Notification Contexts. X. Done Select menu option: 2. Type the menu option letter of the Event Notification option that you want to change. Note: Option A must be enabled in order for the values of the other options to take affect. Table 4. Event notification options Type this Option To Accomplish this A If this option is enabled, the agent updates the Tivoli Identity Manager Server with changes to the agent at regular intervals. B (Time interval between reconciliations) When the option is set to: v disabled, it automatically changes to enabled v enabled, it automatically changes to disabled The following prompt appears: Enter new interval ([ww:dd:hh:mm:ss]) [00:01:00:00:00]: Type a different reconciliation interval. C (Set processing cache size) Press Enter to return to the Agent Activity Logging menu without changing the value. The following prompt appears: Enter new cache size[5]: Type a different value to change the processing cache size. D (Start event notification now) E (Set attributes to be reconciled) Press Enter to return to the Agent Activity Logging menu without changing the value. If this option is selected, event notification is started. The Event Notification Entry Types menu appears. See Setting Attributes to be Reconciled on page 19 for more information. 18 IBM Tivoli Identity Manager: Exchange 2000 Agent Installation Guide

29 Table 4. Event notification options (continued) Type this Option F (Reconciliation process priority) To Accomplish this The following prompt appears: Enter new thread priority [1-10]: Type a different thread value to change reconciliation process priority. Press Enter to return to the Agent Activity Logging menu without changing the value. G (Add Event Notification Context) The following prompt appears: Context name : Type the new context name and press Enter. The new context is added. H (Modify Event Notification Context) I (Remove Event Notification Context) A menu listing the available contexts appears. See Modifying an Event Notification Context on page 20 for more information. The Remove Context menu appears. Select the context to remove and the following prompt appears: Delete context context1? [no]: Press Enter to exit without deleting the context or type Yes and press Enter to delete the context. J (List Event Notification Contexts) The Event Notification Contexts are displayed in the following format: Context Name : Context1 Target DN : erservicename=context1,o=ibm, ou=ibm,dc=com --- Attributes for search request --- {search attributes listed} Press Enter if you changed the value for option B, C, E or F. The Event Notification menu reappears and displays your new settings. Note: The other options are changed automatically when you type the corresponding menu option letter. Setting Attributes to be Reconciled Setting attributes to be reconciled consists of selecting attributes that will trigger event notifications when their values change. Attributes that change frequently (password age or last successful logon, for example) can be omitted. 1. Type E (Set attributes to be reconciled) at the Event Notification Menu. The Event Notification Entry Types menu appears. Event Notification Entry Types A. USER B. GROUP X. Done Select menu option: 2. Type A for attributes returned during a user reconciliation or type B for attributes returned during a group reconciliation. Chapter 4. Agent Parameters Modification 19

30 The Event Notification Attribute Listing for the selected reconciliation type appears. Note: The default setting lists all attributes the agent supports. Event Notification Attribute Listing (a) ** (b) ** (c) ** (d) ** (e) ** (f) ** (g) ** (h) ** (i) ** (j) ** (k) ** (l) ** (m) ** (o) ** (q) ** (r) ** (s) ** (t) ** (p)rev page 1 of 3 (n)ext X. Done Select menu option: 3. Type the letter option of the attribute to exclude from an event notification. Attributes that are marked with the asterisks are returned during the event notification. Attributes that are not marked with asterisks are not returned during the event notification. Modifying an Event Notification Context 1. Type H (Modify Event Notification Context) at the Event Notification menu. The Modify Context Menu appears. Modify Context Menu A. Context1 B. Context2 C. Context3 X. Done Select menu option: 2. Select the desired context. The Modify Context menu for the selected context appears. A. Set attributes for search B. Target DN: C. Delete Baseline Database X. Done Select menu option: See Adding Search Attributes for Event Notification for option A. See Configuring the Target DN for Event Notification Contexts on page 21 for option B. See Removing the Baseline Database for Event Notification Contexts on page 21 for option C. Adding Search Attributes for Event Notification 1. Type A (Set attributes for search) at the desired context s Modify Context menu. The Reconciliation Attribute Passed to Agent menu appears. 20 IBM Tivoli Identity Manager: Exchange 2000 Agent Installation Guide

31 Reconciliation Attributes Passed to Agent for Context: Context A. Add new attribute B. Modify attribute value C. Remove attribute X. Done Select menu option: 2. Select the desired option and complete the requested information at the prompts. The Reconciliation Attributes Passed to Agent menu reappears with the changes displayed. Configuring the Target DN for Event Notification Contexts 1. Type B (Target DN) at the desired context s Modify Context menu. The following prompt appears: Enter Target DN: 2. Type the target DN for the context and press Enter. The target DN for the event notification context must be in the following format: erservicename=nameofservice,o=organizationname,ou=tenantname,dc=com Each element of the DN is defined as follows: erservicename Name of the target service used by the product name. o ou Name of the organization in the product name. Name of the tenant in which the organization is located. If the product name is an enterprise installation, this is the name of the organization. dc=com Root of the directory tree. The selected context s Modify Context menu reappears with the new target DN listed. Removing the Baseline Database for Event Notification Contexts This option is only available after a context is created and a reconciliation is run on the context to create a Baseline Database file. Type C (Delete Baseline Database) at the desired context s Modify Context menu. The selected context s Modify Context menu reappears with the Delete Baseline Database option removed. Changing the Configuration Key The following procedure describes how to change the Exchange 2000 Agent configuration key. You use this key as a password to access the configuration tool from the selected agent. 1. Type D (Change Configuration Key) at the main menu prompt. 2. Change the value and press Enter. Enter new configuration key for Agent E2KAgent : Chapter 4. Agent Parameters Modification 21

32 Press Enter to return to the Main Configuration menu without changing the configuration key. The default configuration key is agent. Note: Enter a configuration key that you can easily remember. A message appears: Configuration key successfully changed. The configuration program exits and the main prompt reappears. Changing Activity Logging Settings The following procedure describes how to change the Exchange 2000 Agent activity logging settings. When you enable logging, Tivoli Identity Manager maintains a log file of all transactions in a dated archive log file, E2KAgent.log. 1. Type E (Activity Logging) at the main menu prompt. The Agent Activity Logging menu appears. The following sample shows the default activity logging settings. Agent Activity Logging Menu A. Activity Logging (Enabled). B. Logging Directory (current: C:\Tivoli\Agents\E2KAgent\Log). C. Activity Log File Name (current: E2KAgent.log). D. Activity Logging Max. File Size ( 1 mbytes) E. Activity Logging Max. Files ( 3) F. Debug Logging (Enabled). G. Detail Logging (Disabled). H. Base Logging (Disabled). X. Done Select menu option: 2. Type the menu option letter of the activity logging option that you want to change. Note: Option A (Activity Logging) must be enabled in order for the values of the other options to take effect. Table 5. Event notification options Type this Option A (Activity Logging) B (Logging Directory) To Accomplish this Set this option to enabled and Tivoli Identity Manager maintains a log file of all transactions in a dated archive log file. When the option is set to: v disabled, it automatically changes to enabled v enabled, it automatically changes to disabled Type a different value for the logging directory, for example, C:\Log. When the logging option is enabled, details about each access request are stored in the logging file that is located in this directory. Press Enter to return to the Agent Activity Logging menu without changing the value. 22 IBM Tivoli Identity Manager: Exchange 2000 Agent Installation Guide

33 Table 5. Event notification options (continued) Type this Option C (Activity Log File Name) To Accomplish this Type a different value for the log file name. When the logging option is enabled, details about each access request are stored in the logging file. Press Enter to return to the Agent Activity Logging menu without changing the value. D (Activity Logging Max File Size) Type a new value, for example, 10. The oldest data is archived when the log file reaches the maximum file size. File size is measured in megabytes. Activity log file size can exceed disk capacity. Press Enter to return to the Agent Activity Logging menu without changing the value. E (Activity Logging Max Files) Type a new value up to 100, for example, 5. The agent automatically deletes the oldest activity logs beyond the specified limit. Press Enter to return to the Agent Activity Logging menu without changing the value. F (Debug Logging) G (Detail Logging) H (Base Logging) If this option is set to enabled, the agent includes the debug statements in the log file of all transactions. When the option is set to: v disabled, it automatically changes to enabled v enabled, it automatically changes to disabled If this option is set to enabled, the agent maintains a detailed log file of all transactions. Note: The detail logging option should be used for diagnostic purposes only. When the detail logging option is on, the application s performance can be adversely affected. When the option is set to: v disabled, it automatically changes to enabled v enabled, it automatically changes to disabled If this option is set to enabled, the agent maintains a log file of all transactions in the ADK and library files. When the option is set to: v disabled, it automatically changes to enabled v enabled, it automatically changes to disabled 3. Press Enter if you changed the value for option B, C, D, or E. The Agent Activity Logging menu reappears and displays your new settings. Note: The other options are changed automatically when you type the corresponding menu option letter. Chapter 4. Agent Parameters Modification 23